Using the API Integrations service collection

Table of Contents

Passing credentials

WARNING

client_id and client_secret are keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

GetCombinedPluginConfigs

Queries for config resources and returns details

PEP8 method name

get_plugin_configs

Endpoint

Method	Route
	/plugins/combined/configs/v1

Required Scope

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
filter			query	string	Filter items using a query in Falcon Query Language (FQL).
limit			query	integer	The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
offset			query	integer	The first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
parameters			query	dictionary	Full query string parameters payload as a dictionary. Not required when using other keywords.
sort			query	string	Sort items using their properties.

Usage

Service class example (PEP8 syntax)

from falconpy import APIIntegrations

falcon = APIIntegrations(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_plugin_configs(filter="string",
                                     limit=integer,
                                     offset=integer,
                                     sort="string"
                                     )
print(response)

Service class example (Operation ID syntax)

from falconpy import APIIntegrations

falcon = APIIntegrations(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.GetCombinedPluginConfigs(filter="string",
                                           limit=integer,
                                           offset=integer,
                                           sort="string"
                                           )
print(response)

Uber class example

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetCombinedPluginConfigs",
                          filter="string",
                          limit=integer,
                          offset=integer,
                          sort="string"
                          )
print(response)

Back to Table of Contents

ExecuteCommandProxy

Execute a command and proxy the response directly.

PEP8 method name

execute_command_proxy

Endpoint

Method	Route
	/plugins/entities/execute-proxy/v1

Required Scope

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
body			body	dictionary	Full body payload as a dictionary. Not required when using other keywords.
config_auth_type			body	string	Configuration authorization type for plugin to execute. Only application for security scheme plugins. If not provided, execution will use the default authorization type.
config_id			body	string	Configuration ID. If omitted, the oldest configuration ID will be used.
definition_id			body	string	ID of the definition containing the operation to execute.
id			body	string	ID of the specific plugin to execute provided in "definition_name.operation_name" format.
operation_id			body	string	The specific operation to execute.
data			body	string	Command data.
description			body	string	Command description.
params			body	dictionary	Command parameters. Overwritten if keywords are used to provide command parameters.
cookie			body	dictionary	Command parameter - cookie.
header			body	dictionary	Command parameter - header.
path			body	dictionary	Command parameter - path.
query			body	dictionary	Command parameter - query.
version			body	integer	The version of the definition to execute.

Usage

Service class example (PEP8 syntax)

from falconpy import APIIntegrations

falcon = APIIntegrations(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.execute_command_proxy(config_auth_type="string",
                                        config_id="string",
                                        definition_id="string",
                                        id="string",
                                        operation_id="string",
                                        description="string",
                                        data="string",
                                        version=integer
                                        )
print(response)

Service class example (Operation ID syntax)

from falconpy import APIIntegrations

falcon = APIIntegrations(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.ExecuteCommandProxy(config_auth_type="string",
                                      config_id="string",
                                      definition_id="string",
                                      id="string",
                                      operation_id="string",
                                      description="string",
                                      data="string",
                                      version=integer
                                      )
print(response)

Uber class example

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
        "config_auth_type": "string",
        "config_id": "string",
        "definition_id": "string",
        "id": "string",
        "operation_id": "string",
        "request": {
            "data": "string",
            "description": "string",
            "params": {
                "cookie": {},
                "header": {},
                "path": {},
                "query": {}
            },
            "x-www-form-urlencoded": {}
        },
        "version": integer
        }
    ]
}

response = falcon.command("ExecuteCommandProxy", body=body_payload)

print(response)

Back to Table of Contents

ExecuteCommand

Execute a command.

PEP8 method name

execute_command

Endpoint

Method	Route
	/plugins/entities/execute/v1

Required Scope

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
body			body	dictionary	Full body payload as a dictionary. Not required when using other keywords.
config_auth_type			body	string	Configuration authorization type for plugin to execute. Only application for security scheme plugins. If not provided, execution will use the default authorization type.
config_id			body	string	Configuration ID. If omitted, the oldest configuration ID will be used.
definition_id			body	string	ID of the definition containing the operation to execute.
id			body	string	ID of the specific plugin to execute provided in "definition_name.operation_name" format.
operation_id			body	string	The specific operation to execute.
data			body	string	Command data.
description			body	string	Command description.
params			body	dictionary	Command parameters. Overwritten if keywords are used to provide command parameters.
cookie			body	dictionary	Command parameter - cookie.
header			body	dictionary	Command parameter - header.
path			body	dictionary	Command parameter - path.
query			body	dictionary	Command parameter - query.
version			body	integer	The version of the definition to execute.

Usage

Service class example (PEP8 syntax)

from falconpy import APIIntegrations

falcon = APIIntegrations(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.execute_command(config_auth_type="string",
                                  config_id="string",
                                  definition_id="string",
                                  id="string",
                                  operation_id="string",
                                  description="string",
                                  version=integer
                                  )

print(response)

Service class example (Operation ID syntax)

from falconpy import APIIntegrations

falcon = APIIntegrations(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.ExecuteCommand(config_auth_type="string",
                                 config_id="string",
                                 definition_id="string",
                                 id="string",
                                 operation_id="string",
                                 description="string",
                                 version=integer
                                 )
print(response)

Uber class example

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
        "config_auth_type": "string",
        "config_id": "string",
        "definition_id": "string",
        "id": "string",
        "operation_id": "string",
        "request": {
            "description": "string"
        },
        "version": integer
        }
    ]
}

response = falcon.command("ExecuteCommand", body=body_payload)

print(response)

Back to Table of Contents