Using the Cloud Security Assets service collection
Table of Contents
| Operation ID | Description | ||||
|---|---|---|---|---|---|
| Get findings for an application resource with pagination. | ||||
| Get combined compliance by account. | ||||
| Gets raw resources based on the provided IDs param. Maximum of 100 resources can be requested with this method. Use POST method with same path if more are required. | ||||
| Query cloud security assets. | ||||
Passing credentials
WARNING
client_idandclient_secretare keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.
cloud_security_assets_combined_application_findings
Get findings for an application resource with pagination.
PEP8 method name
combined_application_findings
Endpoint
| Method | Route |
|---|---|
 | /cloud-security-assets/combined/application-findings/v1 |
Required Scope
Content-Type
- Consumes: application/json
- Produces: application/json
Keyword Arguments
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| crn |  | | query | string | Deprecated: Use gcrn instead. Application CRN. |
| gcrn | | | query | string | Application GCRN. |
| type | | | query | string | Finding type. |
| filter | | | query | string | FQL string to filter findings. |
| offset | | | query | integer | Pagination offset. |
| limit | | | query | integer | Page size. Maximum value is 1000, minimum value is 1. When not specified, 50 is used. |
| parameters | | | query | dictionary | Full query string parameters payload in JSON format. |
Usage
Service class example (PEP8 syntax)
from falconpy import CloudSecurityAssets
# Do not hardcode API credentials!
falcon = CloudSecurityAssets(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.combined_application_findings(crn="string",
gcrn="string",
type="string",
filter="string",
offset=integer,
limit=integer
)
print(response)
Service class example (Operation ID syntax)
from falconpy import CloudSecurityAssets
# Do not hardcode API credentials!
falcon = CloudSecurityAssets(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.cloud_security_assets_combined_application_findings(crn="string",
gcrn="string",
type="string",
filter="string",
offset=integer,
limit=integer
)
print(response)
Uber class example
from falconpy import APIHarnessV2
# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.command("cloud_security_assets_combined_application_findings",
crn="string",
gcrn="string",
type="string",
filter="string",
offset=integer,
limit=integer
)
print(response)
Back to Table of Contents
cloud_security_assets_combined_compliance_by_account
Gets combined compliance data aggregated by account and region. Results can be filtered and sorted.
PEP8 method name
get_combined_compliance_by_account
Endpoint
| Method | Route |
|---|---|
| /cloud-security-assets/combined/compliance-controls/by-account-region-and-resource-type/v1 |
Required Scope
Content-Type
- Consumes: application/json
- Produces: application/json
Keyword Arguments
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| filter | | | query | string | FQL string to filter on asset contents. Filterable fields include: account_id, account_name, assessment_id, business_impact, cloud_group, cloud_label, cloud_label_id, cloud_provider, cloud_scope, compliant, control.benchmark.name, control.benchmark.version, control.extension.status, control.framework, control.name, control.type, control.version, environment, last_evaluated, region, resource_provider, resource_type, resource_type_name, service, service_category, severities, tag_key, tag_value, and tags_string. |
| sort | | | query | string | Sort expression in format: field |
| limit | | | query | integer | The maximum number of items to return. When not specified or 0, 20 is used. When larger than 10000, 10000 is used. |
| offset | | | query | integer | Offset returned controls. Use only one of 'offset' and 'after' parameter for paginating. 'offset' can only be used on offsets < 10,000. For paginating through the entire result set, use 'after' parameter |
| after | | | query | string | token-based pagination. use for paginating through an entire result set. Use only one of 'offset' and 'after' parameters for paginating |
| include_failing_iom_severity_counts | | | query | boolean | Include counts of failing IOMs by severity level |
| parameters | | | query | dictionary | Full query string parameters payload in JSON format. |
Usage
Service class example (PEP8 syntax)
from falconpy import CloudSecurityAssets
# Do not hardcode API credentials!
falcon = CloudSecurityAssets(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_combined_compliance_by_account(filter="string",
sort="string",
limit=integer,
offset=integer,
after="string",
include_failing_iom_severity_counts=boolean
)
print(response)
Service class example (Operation ID syntax)
from falconpy import CloudSecurityAssets
# Do not hardcode API credentials!
falcon = CloudSecurityAssets(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.cloud_security_assets_combined_compliance_by_account(filter="string",
sort="string",
limit=integer,
offset=integer,
after="string",
include_failing_iom_severity_counts=boolean
)
print(response)
Uber class example
from falconpy import APIHarnessV2
# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.command("cloud_security_assets_combined_compliance_by_account",
filter="string",
sort="string",
limit=integer,
offset=integer,
after="string",
include_failing_iom_severity_counts=boolean
)
print(response)
Back to Table of Contents
cloud_security_assets_entities_get
Gets raw resources based on the provided IDs param. Maximum of 100 resources can be requested with this method.
PEP8 method name
get_assets
Endpoint
| Method | Route |
|---|---|
| /cloud-security-assets/entities/resources/v1 |
Required Scope
Content-Type
- Consumes: application/json
- Produces: application/json
Keyword Arguments
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| ids | | | query | string or list of strings | List of assets to return (maximum 100 IDs allowed). |
| parameters | | | query | dictionary | Full query string parameters payload in JSON format. |
Usage
Service class example (PEP8 syntax)
from falconpy import CloudSecurityAssets
# Do not hardcode API credentials!
falcon = CloudSecurityAssets(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_assets(ids=id_list)
print(response)
Service class example (Operation ID syntax)
from falconpy import CloudSecurityAssets
# Do not hardcode API credentials!
falcon = CloudSecurityAssets(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.cloud_security_assets_entities_get(ids=id_list)
print(response)
Uber class example
from falconpy import APIHarnessV2
# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("cloud_security_assets_entities_get", ids=id_list)
print(response)
Back to Table of Contents
cloud_security_assets_queries
Gets a list of resource IDs for the given parameters, filters and sort criteria.
PEP8 method name
query_assets
Endpoint
| Method | Route |
|---|---|
| /cloud-security-assets/queries/resources/v1 |
Required Scope
Content-Type
- Consumes: application/json
- Produces: application/json
Keyword Arguments
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| after | | | query | string | token-based pagination. use for paginating through an entire result set. Use only one of 'offset' and 'after' parameters for paginating |
| filter | | | query | string | FQL string to filter on asset contents. Filterable fields include: account_id, account_name, active, aspm.deployment_cloud_resource_id, aspm.deployment_provider, aspm.deployment_type, aspm.technologies, azure.vm_id, business_impact, cloud_group, cloud_label, cloud_label_id, cloud_provider, cloud_risks.rule, cloud_risks.severity, cloud_risks.status, cloud_scope, cluster_id, cluster_name, compartment_ocid, compliant.benchmark_name, compliant.benchmark_version, compliant.framework, compliant.policy_id, compliant.requirement, compliant.rule, compliant.section, configuration.id, control.benchmark.name, control.benchmark.version, control.framework, control.requirement, control.type, control.version, creation_time, cve_ids, data_classifications.found, data_classifications.label, data_classifications.label_id, data_classifications.scanned, data_classifications.tag, data_classifications.tag_id, environment, exprt_ratings, first_seen, highest_severity, id, insights.boolean_value, insights.date_value, insights.id, insights.integer_value, insights.string_list_value, insights.string_value, instance_id, instance_state, ioa_count, iom_count, legacy_resource_id, legacy_uuid, managed_by, non_compliant.benchmark_name, non_compliant.benchmark_version, non_compliant.framework, non_compliant.policy_id, non_compliant.requirement, non_compliant.rule, non_compliant.rule_name, non_compliant.section, non_compliant.severity, organization_Id, os_version, platform_name, publicly_exposed, region, resource_id, resource_name, resource_parent, resource_type, resource_type_name, sensor_priority, service, service_category, severity, snapshot_detections, ssm_managed, status, tag_key, tag_value, tags, tags_string, tenant_id, updated_at, vmware.guest_os_id, vmware.guest_os_version, vmware.host_system_name, vmware.host_type, vmware.instance_uuid, vmware.vm_host_name, vmware.vm_tools_status, and zone |
| sort | | | query | string | The field to sort on. Sortable fields include: account_id, account_name, active, aspm.deployment_cloud_resource_id, aspm.deployment_provider, aspm.deployment_type, aspm.technologies, cloud_provider, cloud_risks.open_risk_count, cluster_id, cluster_name, compartment_name, compartment_ocid, compartment_path, creation_time, data_classifications.found, data_classifications.scanned, first_seen, id, instance_id, instance_state, ioa_count, iom_count, managed_by, organization_Id, os_version, platform_name, publicly_exposed, publiclyExposedAccessRange, publiclyExposedExposureMethod, publiclyExposedToTheInternet, region, resource_id, resource_name, resource_parent, resource_type, resource_type_name, service, service_category, ssm_managed, status, tenancy_name, tenancy_ocid, tenancy_type, tenant_id, updated_at, vmware.guest_os_id, vmware.guest_os_version, vmware.host_system_name, vmware.host_type, vmware.instance_uuid, vmware.vm_host_name, vmware.vm_tools_status, and zone. |
| limit | | | query | integer | The maximum number of items to return. When not specified or 0, 500 is used. When larger than 1000, 1000 is used. |
| offset | | | query | integer | Offset returned assets. Use only one of 'offset' and 'after' parameter for paginating. 'offset' can only be used on offsets < 10,000. For paginating through the entire result set, use 'after' parameter |
| parameters | | | query | dictionary | Full query string parameters payload in JSON format. |
Usage
Service class example (PEP8 syntax)
from falconpy import CloudSecurityAssets
# Do not hardcode API credentials!
falcon = CloudSecurityAssets(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.query_assets(after="string",
filter="string",
sort="string",
limit=integer,
offset=integer
)
print(response)
Service class example (Operation ID syntax)
from falconpy import CloudSecurityAssets
# Do not hardcode API credentials!
falcon = CloudSecurityAssets(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.cloud_security_assets_queries(after="string",
filter="string",
sort="string",
limit=integer,
offset=integer
)
print(response)
Uber class example
from falconpy import APIHarnessV2
# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.command("cloud_security_assets_queries",
after="string",
filter="string",
sort="string",
limit=integer,
offset=integer
)
print(response)
Back to Table of Contents