CrowdStrike Falcon Twitter URL

All Operations by Service Collection

Total Service Collections Total Operations Documentation Version Page Updated

Table of Contents

AlertsCloud Connect AWSCSPM RegistrationCustom IOA
D4C RegistrationDetectsDevice Control PoliciesDiscover
Event StreamsFalcon ContainerHostsHost Group
Falcon Complete DashboardFalconX SandboxFileVantageFirewall Management
Firewall PoliciesIdentity ProtectionIncidentsInstallation Tokens
IntelIOCIOCs DeprecatedKubernetes Protection
MalQueryMessage CenterML ExclusionsMobile Enrollment
MSSP (Flight Control)OAuth2Overwatch DashboardPrevention Policies
Response PoliciesSensor Update PoliciesIOA ExclusionsQuarantine
Quick ScanReal Time ResponseReal Time Response AdminRecon
Report ExecutionsSample UploadsScheduled ReportsSensor Download
Sensor Visibility ExclusionsSpotlight Evaluation LogicSpotlight VulnerabilitiesUser Management
Zero Trust Assessment   

Alerts

Operation IDDescription
PostAggregateAlertsV1Retrieve aggregates for Alerts across all CIDs.
PatchEntitiesAlertsV2Perform actions on alerts identified by alert ID(s) in request.
PostEntitiesAlertsV1Retrieve all Alerts given their IDs.
GetQueriesAlertsV1Search for alert IDs that match a given query.

Cloud Connect AWS

Operation IDDescription
QueryAWSAccountsSearch for provisioned AWS Accounts by providing a FQL filter and paging details. Returns a set of AWS accounts which match the filter criteria
GetAWSSettingsRetrieve a set of Global Settings which are applicable to all provisioned AWS accounts
GetAWSAccountsRetrieve a set of AWS Accounts by specifying their IDs
ProvisionAWSAccountsProvision AWS Accounts by specifying details about the accounts to provision
DeleteAWSAccountsDelete a set of AWS Accounts by specifying their IDs
UpdateAWSAccountsUpdate AWS Accounts by specifying the ID of the account and details to update
CreateOrUpdateAWSSettingsCreate or update Global Settings which are applicable to all provisioned AWS accounts
VerifyAWSAccountAccessPerforms an Access Verification check on the specified AWS Account IDs
QueryAWSAccountsForIDsSearch for provisioned AWS Accounts by providing a FQL filter and paging details. Returns a set of AWS account IDs which match the filter criteria

CSPM Registration

Operation IDDescription
GetCSPMAwsAccountReturns information about the current status of an AWS account.
CreateCSPMAwsAccountCreates a new account in our system for a customer and generates a script for them to run in their AWS cloud environment to grant us access.
DeleteCSPMAwsAccountDeletes an existing AWS account or organization in our system.
PatchCSPMAwsAccountPatches a existing account in our system for a customer.
GetCSPMAwsConsoleSetupURLsReturn a URL for customer to visit in their cloud environment to grant us access to their AWS environment.
GetCSPMAwsAccountScriptsAttachmentReturn a script for customer to run in their cloud environment to grant us access to their AWS environment as a downloadable attachment.
GetCSPMAzureAccountReturn information about Azure account registration
CreateCSPMAzureAccountCreates a new account in our system for a customer and generates a script for them to run in their cloud environment to grant us access.
DeleteCSPMAzureAccountDeletes an Azure subscription from the system.
UpdateCSPMAzureAccountClientIDUpdate an Azure service account in our system by with the user-created client_id created with the public key we've provided
UpdateCSPMAzureTenantDefaultSubscriptionIDUpdate an Azure default subscription_id in our system for given tenant_id.
AzureDownloadCertificateReturns JSON object(s) that contain the base64 encoded certificate for a service principal.
GetCSPMAzureUserScriptsAttachmentReturn a script for customer to run in their cloud environment to grant us access to their Azure environment as a downloadable attachment
GetBehaviorDetectionsGet list of detected behaviors
GetConfigurationDetectionsGet list of active misconfigurations
GetIOAEventsFor CSPM IOA events, gets list of IOA events.
GetIOAUsersFor CSPM IOA users, gets list of IOA users.
GetCSPMPolicyGiven a policy ID, returns detailed policy information.
GetCSPMPolicySettingsReturns information about current policy settings.
UpdateCSPMPolicySettingsUpdates a policy setting - can be used to override policy severity or to disable a policy entirely.
GetCSPMScanScheduleReturns scan schedule configuration for one or more cloud platforms.
UpdateCSPMScanScheduleUpdates scan schedule configuration for one or more cloud platforms.

Custom IOA

Operation IDDescription
get_patternsGet pattern severities by ID.
get_platformsMixin0Get platforms by ID.
get_rule_groupsMixin0Get rule groups by ID.
create_rule_groupMixin0Create a rule group for a platform with a name and an optional description. Returns the rule group.
delete_rule_groupsMixin0Delete rule groups by ID.
update_rule_groupMixin0Update a rule group. The following properties can be modified: name, description, enabled.
get_rule_typesGet rule types by ID.
get_rules_getGet rules by ID and optionally version in the following format: ID[:version].
get_rulesMixin0Get rules by ID and optionally version in the following format: ID[:version]. The max number of IDs is constrained by URL size.
create_ruleCreate a rule within a rule group. Returns the rule.
delete_rulesDelete rules from a rule group by ID.
update_rulesUpdate rules within a rule group. Return the updated rules.
validateValidates field values and checks for matches if a test string is provided.
query_patternsGet all pattern severity IDs.
query_platformsMixin0Get all platform IDs.
query_rule_groups_fullFind all rule groups matching the query with optional filter.
query_rule_groupsMixin0Finds all rule group IDs matching the query with optional filter.
query_rule_typesGet all rule type IDs.
query_rulesMixin0Finds all rule IDs matching the query with optional filter.

D4C Registration

Operation IDDescription
GetCSPMAzureAccountReturn information about Azure account registration
CreateCSPMAzureAccountCreates a new account in our system for a customer and generates a script for them to run in their cloud environment to grant us access.
UpdateCSPMAzureAccountClientIDUpdate an Azure service account in our system by with the user-created client_id created with the public key we've provided
GetCSPMAzureUserScriptsAttachmentReturn a script for customer to run in their cloud environment to grant us access to their Azure environment as a downloadable attachment
GetCSPMAzureUserScriptsReturn a script for customer to run in their cloud environment to grant us access to their Azure environment
GetCSPMCGPAccountReturns information about the current status of an GCP account.
CreateCSPMGCPAccountCreates a new account in our system for a customer and generates a new service account for them to add access to in their GCP environment to grant us access.
DiscoverCloudAzureDownloadCertificateReturns JSON object(s) that contain the base64 encoded certificate for a service principal.
GetCSPMGCPUserScriptsAttachmentReturn a script for customer to run in their cloud environment to grant us access to their GCP environment as a downloadable attachment
GetCSPMGCPUserScriptsReturn a script for customer to run in their cloud environment to grant us access to their GCP environment

Detects

Operation IDDescription
GetAggregateDetectsGet detect aggregates as specified via json in request body.
UpdateDetectsByIdsV2Modify the state, assignee, and visibility of detections
GetDetectSummariesView information about detections
QueryDetectsSearch for detection IDs that match a given query

Device Control Policies

Operation IDDescription
queryCombinedDeviceControlPolicyMembersSearch for members of a Device Control Policy in your environment by providing a FQL filter and paging details. Returns a set of host details which match the filter criteria
queryCombinedDeviceControlPoliciesSearch for Device Control Policies in your environment by providing a FQL filter and paging details. Returns a set of Device Control Policies which match the filter criteria
performDeviceControlPoliciesActionPerform the specified action on the Device Control Policies specified in the request
setDeviceControlPoliciesPrecedenceSets the precedence of Device Control Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence
getDeviceControlPoliciesRetrieve a set of Device Control Policies by specifying their IDs
createDeviceControlPoliciesCreate Device Control Policies by specifying details about the policy to create
deleteDeviceControlPoliciesDelete a set of Device Control Policies by specifying their IDs
updateDeviceControlPoliciesUpdate Device Control Policies by specifying the ID of the policy and details to update
queryDeviceControlPolicyMembersSearch for members of a Device Control Policy in your environment by providing a FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria
queryDeviceControlPoliciesSearch for Device Control Policies in your environment by providing a FQL filter and paging details. Returns a set of Device Control Policy IDs which match the filter criteria

Discover

Operation IDDescription
get_accountsGet details on accounts by providing one or more IDs.
get_hostsGet details on assets by providing one or more IDs.
get_loginsGet details on logins by providing one or more IDs.
query_accountsSearch for accounts in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.
query_hostsSearch for assets in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.
query_loginsSearch for logins in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.

Event Streams

Operation IDDescription
refreshActiveStreamSessionRefresh an active event stream. Use the URL shown in a GET /sensors/entities/datafeed/v2 response.
listAvailableStreamsOAuth2Discover all event streams in your environment

Falcon Container

Operation IDDescription
GetCredentialsGets the registry credentials.
GetImageAssessmentReportRetrieve an assessment report for an image by specifying repository and tag.
DeleteImageDetailsDelete image details from the CrowdStrike registry.
ImageMatchesPolicyCheck if an image matches a policy by specifying repository and tag.

Hosts

Operation IDDescription
QueryDeviceLoginHistoryRetrieve details about recent login sessions for a set of devices.
QueryGetNetworkAddressHistoryV1Retrieve history of IP and MAC addresses of devices.
PerformActionV2Take various actions on the hosts in your environment. Contain or lift containment on a host. Delete or restore a host.
UpdateDeviceTagsAppend or remove one or more Falcon Grouping Tags on one or more hosts.
GetDeviceDetailsGet details on one or more hosts by providing agent IDs (AID). You can get a host's agent IDs (AIDs) from the /devices/queries/devices/v1 endpoint, the Falcon console or the Streaming API
GetDeviceDetailsV1
Deprecated
Get details on one or more hosts by providing agent IDs (AID). You can get a host's agent IDs (AIDs) from the /devices/queries/devices/v1 endpoint, the Falcon console or the Streaming API. (Max: 500)
GetDeviceDetailsV2Get details on one or more hosts by providing agent IDs (AID). You can get a host's agent IDs (AIDs) from the /devices/queries/devices/v1 endpoint, the Falcon console or the Streaming API. (Max: 100)
PostDeviceDetailsV2Get details on one or more hosts by providing agent IDs (AID). You can get a host's agent IDs (AIDs) from the /devices/queries/devices/v1 endpoint, the Falcon console or the Streaming API. (Max: 5000)
GetOnlineState_V1Get the online status for one or more hosts by specifying each host’s unique ID.
QueryHiddenDevicesRetrieve hidden hosts that match the provided filter criteria.
QueryDevicesByFilterScrollSearch for hosts in your environment by platform, hostname, IP, and other criteria with continuous pagination capability (based on offset pointer which expires after 2 minutes with no maximum limit)
QueryDevicesByFilterSearch for hosts in your environment by platform, hostname, IP, and other criteria.

Host Group

Operation IDDescription
queryCombinedGroupMembersSearch for members of a Host Group in your environment by providing a FQL filter and paging details. Returns a set of host details which match the filter criteria
queryCombinedHostGroupsSearch for Host Groups in your environment by providing a FQL filter and paging details. Returns a set of Host Groups which match the filter criteria
performGroupActionPerform the specified action on the Host Groups specified in the request
getHostGroupsRetrieve a set of Host Groups by specifying their IDs
createHostGroupsCreate Host Groups by specifying details about the group to create
deleteHostGroupsDelete a set of Host Groups by specifying their IDs
updateHostGroupsUpdate Host Groups by specifying the ID of the group and details to update
queryGroupMembersSearch for members of a Host Group in your environment by providing a FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria
queryHostGroupsSearch for Host Groups in your environment by providing a FQL filter and paging details. Returns a set of Host Group IDs which match the filter criteria

Falcon Complete Dashboard

Operation IDDescription
AggregateAllowListRetrieve aggregate allowlist ticket values based on the matched filter
AggregateBlockListRetrieve aggregate blocklist ticket values based on the matched filter
AggregateDetectionsRetrieve aggregate detection values based on the matched filter
AggregateDeviceCountCollectionRetrieve aggregate host/devices count based on the matched filter
AggregateEscalationsRetrieve aggregate escalation ticket values based on the matched filter
AggregateFCIncidentsRetrieve aggregate incident values based on the matched filter
AggregateRemediationsRetrieve aggregate remediation ticket values based on the matched filter
QueryAllowListFilterRetrieve allowlist tickets that match the provided filter criteria with scrolling enabled
QueryBlockListFilterRetrieve block listtickets that match the provided filter criteria with scrolling enabled
QueryDetectionIdsByFilterRetrieve DetectionsIds that match the provided FQL filter, criteria with scrolling enabled
GetDeviceCountCollectionQueriesByFilterRetrieve device count collection Ids that match the provided FQL filter, criteria with scrolling enabled
QueryEscalationsFilterRetrieve escalation tickets that match the provided filter criteria with scrolling enabled
QueryIncidentIdsByFilterRetrieve incidents that match the provided filter criteria with scrolling enabled
QueryRemediationsFilterRetrieve remediation tickets that match the provided filter criteria with scrolling enabled

FalconX Sandbox

Operation IDDescription
GetArtifactsDownload IOC packs, PCAP files, and other analysis artifacts.
GetSummaryReportsGet a short summary version of a sandbox report.
GetReportsGet a full sandbox report.
DeleteReportDelete report based on the report ID. Operation can be checked for success by polling for the report ID on the report-summaries endpoint.
GetSubmissionsCheck the status of a sandbox analysis. Time required for analysis varies but is usually less than 15 minutes.
SubmitSubmit an uploaded file or a URL for sandbox analysis. Time required for analysis varies but is usually less than 15 minutes.
QueryReportsFind sandbox reports by providing a FQL filter and paging details. Returns a set of report IDs that match your criteria.
QuerySubmissionsFind submission IDs for uploaded files by providing a FQL filter and paging details. Returns a set of submission IDs that match your criteria.
GetSampleV2Retrieves the file associated with the given ID (SHA256)
UploadSampleV2Upload a file for sandbox analysis. After uploading, use /falconx/entities/submissions/v1 to start analyzing the file.
DeleteSampleV2Removes a sample, including file, meta and submissions from the collection
QuerySampleV1Retrieves a list with sha256 of samples that exist and customer has rights to access them, maximum number of accepted items is 200

FileVantage

Operation IDDescription
getChangesRetrieve information on changes
queryChangesReturns one or more change IDs

Firewall Management

Operation IDDescription
aggregate_eventsAggregate events for customer
aggregate_policy_rulesAggregate rules within a policy for customer
aggregate_rule_groupsAggregate rule groups for customer
aggregate_rulesAggregate rules for customer
get_eventsGet events entities by ID and optionally version
get_firewall_fieldsGet the firewall field specifications by ID
get_platformsGet platforms by ID, e.g., windows or mac or droid
get_policy_containersGet policy container entities by policy ID
update_policy_containerUpdate an identified policy container
get_rule_groupsGet rule group entities by ID. These groups do not contain their rule entites, just the rule IDs in precedence order.
create_rule_groupCreate new rule group on a platform for a customer with a name and description, and return the ID
delete_rule_groupsDelete rule group entities by ID
update_rule_groupUpdate name, description, or enabled status of a rule group, or create, edit, delete, or reorder rules
get_rulesGet rule entities by ID (64-bit unsigned int as decimal string) or Family ID (32-character hexadecimal string)
query_eventsFind all event IDs matching the query with filter
query_firewall_fieldsGet the firewall field specification IDs for the provided platform
query_platformsGet the list of platform names
query_policy_rulesFind all firewall rule IDs matching the query with filter, and return them in precedence order
query_rule_groupsFind all rule group IDs matching the query with filter
query_rulesFind all rule IDs matching the query with filter

Firewall Policies

Operation IDDescription
queryCombinedFirewallPolicyMembersSearch for members of a Firewall Policy in your environment by providing a FQL filter and paging details. Returns a set of host details which match the filter criteria
queryCombinedFirewallPoliciesSearch for Firewall Policies in your environment by providing a FQL filter and paging details. Returns a set of Firewall Policies which match the filter criteria
performFirewallPoliciesActionPerform the specified action on the Firewall Policies specified in the request
setFirewallPoliciesPrecedenceSets the precedence of Firewall Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence
getFirewallPoliciesRetrieve a set of Firewall Policies by specifying their IDs
createFirewallPoliciesCreate Firewall Policies by specifying details about the policy to create
deleteFirewallPoliciesDelete a set of Firewall Policies by specifying their IDs
updateFirewallPoliciesUpdate Firewall Policies by specifying the ID of the policy and details to update
queryFirewallPolicyMembersSearch for members of a Firewall Policy in your environment by providing a FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria
queryFirewallPoliciesSearch for Firewall Policies in your environment by providing a FQL filter and paging details. Returns a set of Firewall Policy IDs which match the filter criteria

Identity Protection

Operation IDDescription
api_preempt_proxy_post_graphqlIdentity Protection GraphQL API. Allows to retrieve entities, timeline activities, identity-based incidents and security assessment. Allows to perform actions on entities and identity-based incidents.

Incidents

Operation IDDescription
CrowdScoreQuery environment wide CrowdScore and return the entity data
GetBehaviorsGet details on behaviors by providing behavior IDs
PerformIncidentActionPerform a set of actions on one or more incidents, such as adding tags or comments or updating the incident name or description
GetIncidentsGet details on incidents by providing incident IDs
QueryBehaviorsSearch for behaviors by providing a FQL filter, sorting, and paging details
QueryIncidentsSearch for incidents by providing a FQL filter, sorting, and paging details

Installation Tokens

Operation IDDescription
audit_events_readGets the details of one or more audit events by id.
customer_settings_readCheck current installation token settings.
tokens_readGets the details of one or more tokens by id.
tokens_createCreates a token.
tokens_deleteDeletes a token immediately. To revoke a token, use PATCH /installation-tokens/entities/tokens/v1 instead.
tokens_updateUpdates one or more tokens. Use this endpoint to edit labels, change expiration, revoke, or restore.
audit_events_querySearch for audit events by providing a FQL filter and paging details.
tokens_querySearch for tokens by providing a FQL filter and paging details.

Intel

Operation IDDescription
QueryIntelActorEntitiesGet info about actors that match provided FQL filters.
QueryIntelIndicatorEntitiesGet info about indicators that match provided FQL filters.
QueryIntelReportEntitiesGet info about reports that match provided FQL filters.
GetIntelActorEntitiesRetrieve specific actors using their actor IDs.
GetIntelIndicatorEntitiesRetrieve specific indicators using their indicator IDs.
GetIntelReportPDFReturn a Report PDF attachment
GetIntelReportEntitiesRetrieve specific reports using their report IDs.
GetIntelRuleFileDownload earlier rule sets.
GetLatestIntelRuleFileDownload the latest rule set.
GetIntelRuleEntitiesRetrieve details for rule sets for the specified ids.
QueryIntelActorIdsGet actor IDs that match provided FQL filters.
QueryIntelIndicatorIdsGet indicators IDs that match provided FQL filters.
QueryIntelReportIdsGet report IDs that match provided FQL filters.
QueryIntelRuleIdsSearch for rule IDs that match provided filter criteria.

IOC

Operation IDDescription
indicator_combined_v1Get Combined for Indicators.
indicator_get_v1Get Indicators by ids.
indicator_create_v1Create Indicators.
indicator_delete_v1Delete Indicators by ids.
indicator_update_v1Update Indicators.
indicator_search_v1Search for Indicators.
DevicesCountNumber of hosts in your customer account that have observed a given custom IOC
DevicesRanOnFind hosts that have observed a given custom IOC. For details about those hosts, use GetDeviceDetails
ProcessesRanOnSearch for processes associated with a custom IOC
entities_processesFor the provided ProcessID retrieve the process details

IOCs

This class has been deprecated and will ultimately be dropped. Developers should move all existing code over to use the updated IOC Service Class.

Operation IDDescription
DevicesCountNumber of hosts in your customer account that have observed a given custom IOC
GetIOC
Deprecated
This operation has been superseded by the IOC.indicator_get_v1 operation and is no longer used.
CreateIOC
Deprecated
This operation has been superseded by the IOC.indicator_create_v1 operation and is no longer used.
DeleteIOC
Deprecated
This operation has been superseded by the IOC.indicator_delete_v1 operation and is no longer used.
UpdateIOC
Deprecated
This operation has been superseded by the IOC.indicator_update_v1 operation and is no longer used.
DevicesRanOnFind hosts that have observed a given custom IOC. For details about those hosts, use GetDeviceDetails
QueryIOCs
Deprecated
This operation has been superseded by the IOC.indicator_search_v1 operation and is no longer used.
ProcessesRanOnSearch for processes associated with a custom IOC
entities_processesFor the provided ProcessID retrieve the process details

Kubernetes Protection

Operation IDDescription
GetAWSAccountsMixin0Provides a list of AWS accounts.
CreateAWSAccountCreates a new AWS account in our system for a customer and generates the installation script
DeleteAWSAccountsMixin0Delete AWS accounts.
UpdateAWSAccountUpdates the AWS account per the query parameters provided
GetLocationsProvides the cloud locations acknowledged by the Kubernetes Protection service
GetHelmValuesYamlProvides a sample Helm values.yaml file for a customer to install alongside the agent Helm chart
RegenerateAPIKeyRegenerate API key for docker registry integrations
GetClustersProvides the clusters acknowledged by the Kubernetes Protection service
TriggerScanTriggers a dry run or a full scan of a customer's kubernetes footprint

MalQuery

Operation IDDescription
GetMalQueryQuotasV1Get information about search and download quotas in your environment
PostMalQueryFuzzySearchV1Search Falcon MalQuery quickly, but with more potential for false positives. Search for a combination of hex patterns and strings in order to identify samples based upon file content at byte level granularity.
GetMalQueryDownloadV1Download a file indexed by MalQuery. Specify the file using its SHA256. Only one file is supported at this time
GetMalQueryMetadataV1Retrieve indexed files metadata by their hash
GetMalQueryRequestV1Check the status and results of an asynchronous request, such as hunt or exact-search. Supports a single request id at this time.
GetMalQueryEntitiesSamplesFetchV1Fetch a zip archive with password 'infected' containing the samples. Call this once the /entities/samples-multidownload request has finished processing
PostMalQueryEntitiesSamplesMultidownloadV1Schedule samples for download. Use the result id with the /request endpoint to check if the download is ready after which you can call the /entities/samples-fetch to get the zip
PostMalQueryExactSearchV1Search Falcon MalQuery for a combination of hex patterns and strings in order to identify samples based upon file content at byte level granularity. You can filter results on criteria such as file type, file size and first seen date. Returns a request id which can be used with the /request endpoint
PostMalQueryHuntV1Schedule a YARA-based search for execution. Returns a request id which can be used with the /request endpoint

Message Center

Operation IDDescription
AggregateCasesRetrieve aggregate case values based on the matched filter
GetCaseActivityByIdsRetrieve activities for given id's
CaseAddActivityAdd an activity to case. Only activities of type comment are allowed via API
CaseDownloadAttachmentretrieves an attachment for the case, given the attachment id
CaseAddAttachmentUpload an attachment for the case.
CreateCasecreate a new case
UpdateCaseupdate an existing case
GetCaseEntitiesByIDsRetrieve message center cases
QueryActivityByCaseIDRetrieve activities id's for a case
QueryCasesIdsByFilterRetrieve case id's that match the provided filter criteria

MSSP (Flight Control)

Operation IDDescription
getChildrenGet link to child customer by child CID(s)
getCIDGroupMembersByGet CID group members by CID group ID.
addCIDGroupMembersAdd new CID Group member.
deleteCIDGroupMembersDelete CID Group members entry.
getCIDGroupByIdGet CID groups by ID.
createCIDGroupsCreate new CID Group(s). Maximum 500 CID Group(s) allowed.
deleteCIDGroupsDelete CID groups by ID.
updateCIDGroupsUpdate existing CID Group(s). CID Group ID is expected for each CID Group definition provided in request body. CID Group member(s) remain unaffected.
getRolesByIDGet MSSP Role assignment(s). MSSP Role assignment is of the format :.
addRoleAssign new MSSP Role(s) between User Group and CID Group. It does not revoke existing role(s) between User Group and CID Group. User Group ID and CID Group ID have to be specified in request.
deletedRolesDelete MSSP Role assignment(s) between User Group and CID Group. User Group ID and CID Group ID have to be specified in request. Only specified roles are removed if specified in request payload, else association between User Group and CID Group is dissolved completely (if no roles specified).
getUserGroupMembersByIDGet user group members by user group ID.
addUserGroupMembersAdd new User Group member. Maximum 500 members allowed per User Group.
deleteUserGroupMembersDelete User Group members entry.
getUserGroupsByIDGet user groups by ID.
createUserGroupsCreate new User Group(s). Maximum 500 User Group(s) allowed per customer.
deleteUserGroupsDelete user groups by ID.
updateUserGroupsUpdate existing User Group(s). User Group ID is expected for each User Group definition provided in request body. User Group member(s) remain unaffected.
queryChildrenQuery for customers linked as children
queryCIDGroupMembersQuery a CID groups members by associated CID.
queryCIDGroupsQuery CID Groups.
queryRolesQuery links between user groups and CID groups. At least one of CID group ID or user group ID should also be provided. Role ID is optional.
queryUserGroupMembersQuery User Group member by User UUID.
queryUserGroupsQuery User Groups.

OAuth2

Operation IDDescription
oauth2RevokeTokenRevoke a previously issued OAuth2 access token before the end of its standard 30-minute lifespan.
oauth2AccessTokenGenerate an OAuth2 access token

Overwatch Dashboard

Operation IDDescription
AggregatesDetectionsGlobalCountsGet the total number of detections pushed across all customers
AggregatesEventsCollectionsGet OverWatch detection event collection info by providing an aggregate query
AggregatesEventsGet aggregate OverWatch detection event info by providing an aggregate query
AggregatesIncidentsGlobalCountsGet the total number of incidents pushed across all customers
AggregatesOWEventsGlobalCountsGet the total number of OverWatch events across all customers

Prevention Policies

Operation IDDescription
queryCombinedPreventionPolicyMembersSearch for members of a Prevention Policy in your environment by providing a FQL filter and paging details. Returns a set of host details which match the filter criteria
queryCombinedPreventionPoliciesSearch for Prevention Policies in your environment by providing a FQL filter and paging details. Returns a set of Prevention Policies which match the filter criteria
performPreventionPoliciesActionPerform the specified action on the Prevention Policies specified in the request
setPreventionPoliciesPrecedenceSets the precedence of Prevention Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence
getPreventionPoliciesRetrieve a set of Prevention Policies by specifying their IDs
createPreventionPoliciesCreate Prevention Policies by specifying details about the policy to create
deletePreventionPoliciesDelete a set of Prevention Policies by specifying their IDs
updatePreventionPoliciesUpdate Prevention Policies by specifying the ID of the policy and details to update
queryPreventionPolicyMembersSearch for members of a Prevention Policy in your environment by providing a FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria
queryPreventionPoliciesSearch for Prevention Policies in your environment by providing a FQL filter and paging details. Returns a set of Prevention Policy IDs which match the filter criteria

Response Policies

Operation IDDescription
queryCombinedRTResponsePolicyMembersSearch for members of a Response policy in your environment by providing a FQL filter and paging details. Returns a set of host details which match the filter criteria
queryCombinedRTResponsePoliciesSearch for Response Policies in your environment by providing a FQL filter and paging details. Returns a set of Response Policies which match the filter criteria
performRTResponsePoliciesActionPerform the specified action on the Response Policies specified in the request
setRTResponsePoliciesPrecedenceSets the precedence of Response Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence
getRTResponsePoliciesRetrieve a set of Response Policies by specifying their IDs
createRTResponsePoliciesCreate Response Policies by specifying details about the policy to create
deleteRTResponsePoliciesDelete a set of Response Policies by specifying their IDs
updateRTResponsePoliciesUpdate Response Policies by specifying the ID of the policy and details to update
queryRTResponsePolicyMembersSearch for members of a Response policy in your environment by providing a FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria
queryRTResponsePoliciesSearch for Response Policies in your environment by providing a FQL filter with sort and/or paging details. This returns a set of Response Policy IDs that match the given criteria.

Sensor Update Policies

Operation IDDescription
revealUninstallTokenReveals an uninstall token for a specific device. To retrieve the bulk maintenance token pass the value 'MAINTENANCE' as the value for 'device_id'
queryCombinedSensorUpdateBuildsRetrieve available builds for use with Sensor Update Policies
queryCombinedSensorUpdateKernelsRetrieve kernel compatibility info for Sensor Update Builds
queryCombinedSensorUpdatePolicyMembersSearch for members of a Sensor Update Policy in your environment by providing a FQL filter and paging details. Returns a set of host details which match the filter criteria
queryCombinedSensorUpdatePoliciesSearch for Sensor Update Policies in your environment by providing a FQL filter and paging details. Returns a set of Sensor Update Policies which match the filter criteria
queryCombinedSensorUpdatePoliciesV2Search for Sensor Update Policies with additional support for uninstall protection in your environment by providing a FQL filter and paging details. Returns a set of Sensor Update Policies which match the filter criteria
performSensorUpdatePoliciesActionPerform the specified action on the Sensor Update Policies specified in the request
setSensorUpdatePoliciesPrecedenceSets the precedence of Sensor Update Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence
getSensorUpdatePoliciesRetrieve a set of Sensor Update Policies by specifying their IDs
createSensorUpdatePoliciesCreate Sensor Update Policies by specifying details about the policy to create
deleteSensorUpdatePoliciesDelete a set of Sensor Update Policies by specifying their IDs
updateSensorUpdatePoliciesUpdate Sensor Update Policies by specifying the ID of the policy and details to update
getSensorUpdatePoliciesV2Retrieve a set of Sensor Update Policies with additional support for uninstall protection by specifying their IDs
createSensorUpdatePoliciesV2Create Sensor Update Policies by specifying details about the policy to create with additional support for uninstall protection
updateSensorUpdatePoliciesV2Update Sensor Update Policies by specifying the ID of the policy and details to update with additional support for uninstall protection
querySensorUpdateKernelsDistinctRetrieve kernel compatibility info for Sensor Update Builds
querySensorUpdatePolicyMembersSearch for members of a Sensor Update Policy in your environment by providing a FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria
querySensorUpdatePoliciesSearch for Sensor Update Policies in your environment by providing a FQL filter and paging details. Returns a set of Sensor Update Policy IDs which match the filter criteria

IOA Exclusions

Operation IDDescription
getIOAExclusionsV1Get a set of IOA Exclusions by specifying their IDs
createIOAExclusionsV1Create the IOA exclusions
deleteIOAExclusionsV1Delete the IOA exclusions by id
updateIOAExclusionsV1Update the IOA exclusions
queryIOAExclusionsV1Search for IOA exclusions.

ML Exclusions

Operation IDDescription
getMLExclusionsV1Get a set of ML Exclusions by specifying their IDs
createMLExclusionsV1Create the ML exclusions
deleteMLExclusionsV1Delete the ML exclusions by id
updateMLExclusionsV1Update the ML exclusions
queryMLExclusionsV1Search for ML exclusions.

Mobile Enrollment

Operation IDDescription
RequestDeviceEnrollmentV3Trigger on-boarding process for a mobile device.

Sensor Visibility Exclusions

Operation IDDescription
getSensorVisibilityExclusionsV1Get a set of Sensor Visibility Exclusions by specifying their IDs
createSVExclusionsV1Create the sensor visibility exclusions
deleteSensorVisibilityExclusionsV1Delete the sensor visibility exclusions by id
updateSensorVisibilityExclusionsV1Update the sensor visibility exclusions
querySensorVisibilityExclusionsV1Search for sensor visibility exclusions.

Quarantine

Operation IDDescription
ActionUpdateCountReturns count of potentially affected quarantined files for each action.
GetAggregateFilesGet quarantine file aggregates as specified via json in request body.
GetQuarantineFilesGet quarantine file metadata for specified ids.
UpdateQuarantinedDetectsByIdsApply action by quarantine file ids
QueryQuarantineFilesGet quarantine file ids that match the provided filter criteria.
UpdateQfByQueryApply quarantine file actions by query.

Quick Scan

Operation IDDescription
GetScansAggregatesGet scans aggregations as specified via json in request body.
GetScansCheck the status of a volume scan. Time required for analysis increases with the number of samples in a volume but usually it should take less than 1 minute
ScanSamplesSubmit a volume of files for ml scanning. Time required for analysis increases with the number of samples in a volume but usually it should take less than 1 minute
QuerySubmissionsMixin0Find IDs for submitted scans by providing a FQL filter and paging details. Returns a set of volume IDs that match your criteria.

Real Time Response

Operation IDDescription
RTR_AggregateSessionsGet aggregates on session data.
BatchActiveResponderCmdBatch executes a RTR active-responder command across the hosts mapped to the given batch ID.
BatchCmdBatch executes a RTR read-only command across the hosts mapped to the given batch ID.
BatchGetCmdStatusRetrieves the status of the specified batch get command. Will return successful files when they are finished processing.
BatchGetCmdBatch executes get command across hosts to retrieve files. After this call is made GET /real-time-response/combined/batch-get-command/v1 is used to query for the results.
BatchInitSessionsBatch initialize a RTR session on multiple hosts. Before any RTR commands can be used, an active session is needed on the host.
BatchRefreshSessionsBatch refresh a RTR session on multiple hosts. RTR sessions will expire after 10 minutes unless refreshed.
RTR_CheckActiveResponderCommandStatusGet status of an executed active-responder command on a single host.
RTR_ExecuteActiveResponderCommandExecute an active responder command on a single host.
RTR_CheckCommandStatusGet status of an executed command on a single host.
RTR_ExecuteCommandExecute a command on a single host.
RTR_GetExtractedFileContentsGet RTR extracted file contents for specified session and sha256.
RTR_ListFilesGet a list of files for the specified RTR session.
RTR_ListFilesV2Get a list of files for the specified RTR session.
(Expanded output detail)
RTR_DeleteFileDelete a RTR session file.
RTR_DeleteFileV2Delete a RTR session file.
(Expanded output detail. Use with RTR_ListFilesV2.)
RTR_ListQueuedSessionsGet queued session metadata by session ID.
RTR_DeleteQueuedSessionDelete a queued session command
RTR_PulseSessionRefresh a session timeout on a single host.
RTR_ListSessionsGet session metadata by session id.
RTR_InitSessionInitialize a new session with the RTR cloud.
RTR_DeleteSessionDelete a session.
RTR_ListAllSessionsGet a list of session_ids.

Real Time Response Admin

Operation IDDescription
BatchAdminCmdBatch executes a RTR administrator command across the hosts mapped to the given batch ID.
RTR_CheckAdminCommandStatusGet status of an executed RTR administrator command on a single host.
RTR_ExecuteAdminCommandExecute a RTR administrator command on a single host.
RTR_GetPut_FilesGet put-files based on the ID's given. These are used for the RTR put command.
RTR_GetPut_FilesV2Get put-files based on the ID's given. These are used for the RTR put command.
RTR_CreatePut_FilesUpload a new put-file to use for the RTR put command.
RTR_DeletePut_FilesDelete a put-file based on the ID given. Can only delete one file at a time.
RTR_GetScriptsGet custom-scripts based on the ID's given. These are used for the RTR runscript command.
RTR_GetScriptsV2Get custom-scripts based on the ID's given. These are used for the RTR runscript command.
RTR_CreateScriptsUpload a new custom-script to use for the RTR runscript command.
RTR_DeleteScriptsDelete a custom-script based on the ID given. Can only delete one script at a time.
RTR_UpdateScriptsUpload a new scripts to replace an existing one.
RTR_ListPut_FilesGet a list of put-file ID's that are available to the user for the put command.
RTR_ListScriptsGet a list of custom-script ID's that are available to the user for the runscript command.

Recon

Operation IDDescription
AggregateNotificationsV1Get notification aggregates as specified via JSON in request body.
PreviewRuleV1Preview rules notification count and distribution. This will return aggregations on: channel, count, site.
GetActionsV1Get actions based on their IDs. IDs can be retrieved using the GET /queries/actions/v1 endpoint.
CreateActionsV1Create actions for a monitoring rule. Accepts a list of actions that will be attached to the monitoring rule.
DeleteActionV1Delete an action from a monitoring rule based on the action ID.
UpdateActionV1Update an action for a monitoring rule.
GetNotificationsDetailedTranslatedV1Get detailed notifications based on their IDs. These include the raw intelligence content that generated the match.This endpoint will return translated notification content. The only target language available is English. A single notification can be translated per request
GetNotificationsDetailedV1Get detailed notifications based on their IDs. These include the raw intelligence content that generated the match.
GetNotificationsTranslatedV1Get notifications based on their IDs. IDs can be retrieved using the GET /queries/notifications/v1 endpoint. This endpoint will return translated notification content. The only target language available is English.
GetNotificationsV1Get notifications based on their IDs. IDs can be retrieved using the GET /queries/notifications/v1 endpoint.
DeleteNotificationsV1Delete notifications based on IDs. Notifications cannot be recovered after they are deleted.
UpdateNotificationsV1Update notification status or assignee. Accepts bulk requests
GetRulesV1Get monitoring rules rules by provided IDs.
CreateRulesV1Create monitoring rules.
DeleteRulesV1Delete monitoring rules.
UpdateRulesV1Update monitoring rules.
QueryActionsV1Query actions based on provided criteria. Use the IDs from this response to get the action entities on GET /entities/actions/v1.
QueryNotificationsV1Query notifications based on provided criteria. Use the IDs from this response to get the notification entities on GET /entities/notifications/v1 or GET /entities/notifications-detailed/v1.
QueryRulesV1Query monitoring rules based on provided criteria. Use the IDs from this response to fetch the rules on /entities/rules/v1.

Report Executions

Operation IDDescription
report_executions_download_getGet report entity download
report_executions_retryThis endpoint will be used to retry report executions
report_executions_getRetrieve report details for the provided report IDs.
report_executions_queryFind all report execution IDs matching the query with filter

Scheduled Reports

Operation IDDescription
scheduled_reports_launchLaunch scheduled reports executions for the provided report IDs.
scheduled_reports_getRetrieve scheduled reports for the provided report IDs.
scheduled_reports_queryFind all report IDs matching the query with filter

Sample Uploads

Operation IDDescription
GetSampleV3Retrieves the file associated with the given ID (SHA256)
UploadSampleV3Upload a file for further cloud analysis. After uploading, call the specific analysis API endpoint.
DeleteSampleV3Removes a sample, including file, meta and submissions from the collection

Sensor Download

Operation IDDescription
GetCombinedSensorInstallersByQueryGet sensor installer details by provided query
DownloadSensorInstallerByIdDownload sensor installer by SHA256 ID
GetSensorInstallersEntitiesGet sensor installer details by provided SHA256 IDs
GetSensorInstallersCCIDByQueryGet CCID to use with sensor installers
GetSensorInstallersByQueryGet sensor installer IDs by provided query

Spotlight Evaluation Logic

Operation IDDescription
combinedQueryEvaluationLogicSearch for evaluation logic in your environment by providing a FQL filter and paging details. Returns a set of evaluation logic entities which match the filter criteria.
getEvaluationLogicGet details on evaluation logic items by providing one or more IDs.
queryEvaluationLogicSearch for evaluation logic in your environment by providing a FQL filter and paging details. Returns a set of evaluation logic IDs which match the filter criteria.

Spotlight Vulnerabilities

Operation IDDescription
combinedQueryVulnerabilitiesSearch for Vulnerabilities in your environment by providing a FQL filter and paging details. Returns a set of Vulnerability entities which match the filter criteria
getRemediationsV2Get details on remediation by providing one or more IDs
getVulnerabilitiesGet details on vulnerabilities by providing one or more IDs
queryVulnerabilitiesSearch for Vulnerabilities in your environment by providing a FQL filter and paging details. Returns a set of Vulnerability IDs which match the filter criteria

User Management

Operation IDDescription
GetRolesGet info about a role
GrantUserRoleIdsAssign one or more roles to a user
RevokeUserRoleIdsRevoke one or more roles from a user
GetAvailableRoleIdsShow role IDs for all roles available in your customer account. For more information on each role, provide the role ID to GetRoles.
GetUserRoleIdsShow role IDs of roles assigned to a user. For more information on each role, provide the role ID to GetRoles.
RetrieveUserGet info about a user
CreateUserCreate a new user. After creating a user, assign one or more roles with GrantUserRoleIds.
DeleteUserDelete a user permanently
UpdateUserModify an existing user's first or last name
RetrieveEmailsByCIDList the usernames (usually an email address) for all users in your customer account
RetrieveUserUUIDsByCIDList user IDs for all users in your customer account. For more information on each user, provide the user ID to RetrieveUser.
RetrieveUserUUIDGet a user's ID by providing a username (usually an email address)
combinedUserRolesV1Get User Grant(s). This operation lists both direct as well as flight control grants between a User and a Customer.
queriesRolesV1Show role IDs for all roles available in your customer account. Supports Flight Control.
queryUserV1List user IDs for all users in your customer account.
entitiesRolesV1Get information about a role, supports Flight Control.
userActionV1Apply actions to one or more users.
userRolesActionV1Grant or Revoke one or more role(s) to a user against a CID.
retrieveUsersGETV1Get info about users including their name, UID and CID by providing user UUIDs.
createUserV1Create a new user. Supports Flight Control.
deleteUserV1Delete a user permanently. Supports Flight Control.
updateUserV1Modify an existing user's first or last name. Supports Flight Control.

Zero Trust Assessment

Operation IDDescription
getAssessmentV1Get Zero Trust Assessment data for one or more hosts by providing agent IDs (AID) and a customer ID (CID).
getComplianceV1Get the Zero Trust Assessment compliance report for one customer ID (CID).