CrowdStrike Falcon Twitter URL

Using the CSPM Registration service collection

Uber class support Service class support Documentation Version Page Updated Samples Available

This service collection has code examples posted to the repository.

Table of Contents

Operation IDDescription
GetCSPMAwsAccount
PEP 8get_aws_account
Returns information about the current status of an AWS account.
CreateCSPMAwsAccount
PEP 8create_aws_account
Creates a new account in our system for a customer and generates a script for them to run in their AWS cloud environment to grant us access.
DeleteCSPMAwsAccount
PEP 8delete_aws_account
Deletes an existing AWS account or organization in our system.
PatchCSPMAwsAccount
PEP 8update_aws_account
Patches a existing account in our system for a customer.
GetCSPMAwsConsoleSetupURLs
PEP 8get_aws_console_setup_urls
Return a URL for customer to visit in their cloud environment to grant us access to their AWS environment.
GetCSPMAwsAccountScriptsAttachment
PEP 8get_aws_account_scripts_attachment
Return a script for customer to run in their cloud environment to grant us access to their AWS environment as a downloadable attachment.
GetCSPMAzureAccount
PEP 8get_azure_account
Return information about Azure account registration
CreateCSPMAzureAccount
PEP 8create_azure_account
Creates a new account in our system for a customer and generates a script for them to run in their cloud environment to grant us access.
DeleteCSPMAzureAccount
PEP 8delete_azure_account
Deletes an Azure subscription from the system.
UpdateCSPMAzureAccountClientID
PEP 8update_azure_account_client_id
Update an Azure service account in our system by with the user-created client_id created with the public key we've provided
UpdateCSPMAzureTenantDefaultSubscriptionID
PEP 8update_azure_tenant_default_subscription_id
Update an Azure default subscription_id in our system for given tenant_id
AzureDownloadCertificate
PEP 8azure_download_certificate
Returns JSON object(s) that contain the base64 encoded certificate for a service principal.
GetCSPMAzureUserScriptsAttachment
PEP 8get_azure_user_scripts_attachment
Return a script for customer to run in their cloud environment to grant us access to their Azure environment as a downloadable attachment
GetBehaviorDetections
PEP 8get_behavior_detections
Retrieve a list of detected behaviors.
GetConfigurationDetections
PEP 8get_configuration_detections
Retrieve a list of active misconfigurations.
GetIOAEvents
PEP 8get_ioa_events
For CSPM IOA events, gets list of IOA events.
GetIOAUsers
PEP 8get_ioa_users
For CSPM IOA users, gets list of IOA users.
GetCSPMPolicy
PEP 8get_policy
Given a policy ID, returns detailed policy information.
GetCSPMPolicySettings
PEP 8get_policy_settings
Returns information about current policy settings.
UpdateCSPMPolicySettings
PEP 8update_policy_settings
Updates a policy setting - can be used to override policy severity or to disable a policy entirely.
GetCSPMScanSchedule
PEP 8get_scan_schedule
Returns scan schedule configuration for one or more cloud platforms.
UpdateCSPMScanSchedule
PEP 8update_scan_schedule
Updates scan schedule configuration for one or more cloud platforms.

Passing credentials

WARNING

client_id and client_secret are input variables that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

GetCSPMAwsAccount

Returns information about the current status of an AWS account.

PEP8 method name

get_aws_account

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
group_by
Service Class Support

Uber Class Support
querystringThe field to group by.
ids
Service Class Support

Uber Class Support
querystring or list of stringsAWS Account ID(s).
limit
Service Class Support

Uber Class Support
queryintegerMaximum number of results to return. (Default: 100)
offset
Service Class Support

Uber Class Support
queryintegerStarting record position.
organization_ids
Service Class Support

Uber Class Support
querystring or list of stringsAWS Organization ID(s).
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
scan_type
Service Class Support

Uber Class Support
querystringType of scan to perform, dry or full.
status
Service Class Support

Uber Class Support
querystringAccount status to filter results by.

Usage

Service class example (PEP8 syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

orgs = 'ORG1,ORG2,ORG3'  # Can also pass a list here: ['ORG1', 'ORG2', 'ORG3']

response = falcon.get_aws_account(scan_type="string",
                                  organization_ids=orgs,
                                  status="string",
                                  limit=integer,
                                  offset=integer,
                                  group_by="string",
                                  ids=id_list
                                  )
print(response)

Service class example (Operation ID syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

orgs = 'ORG1,ORG2,ORG3'  # Can also pass a list here: ['ORG1', 'ORG2', 'ORG3']

response = falcon.GetCSPMAwsAccount(scan_type="string",
                                    organization_ids=orgs,
                                    status="string",
                                    limit=integer,
                                    offset=integer,
                                    group_by="string",
                                    ids=id_list
                                    )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

orgs = 'ORG1,ORG2,ORG3'  # Can also pass a list here: ['ORG1', 'ORG2', 'ORG3']

response = falcon.command("GetCSPMAwsAccount",
                          scan_type="string",
                          organization_ids=orgs,
                          status="string",
                          limit=integer,
                          offset=integer,
                          group_by="string",
                          ids=id_list
                          )
print(response)

CreateCSPMAwsAccount

Creates a new account in our system for a customer and generates a script for them to run in their AWS cloud environment to grant us access.

PEP8 method name

create_aws_account

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
account_id
Service Class Support

Uber Class Support
bodystringAWS Account ID.
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format.
cloudtrail_region
Service Class Support

Uber Class Support
bodystringAWS Cloudtrail Region.
organization_id
Service Class Support

Uber Class Support
bodystringAWS Organization ID.

Usage

Service class example (PEP8 syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.create_aws_account(account_id="string",
                                     cloudtrail_region="string",
                                     organization_id="string"
                                     )
print(response)

Service class example (Operation ID syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.CreateCSPMAwsAccount(account_id="string",
                                       cloudtrail_region="string",
                                       organization_id="string"
                                       )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

BODY = {
    "resources": [
        {
            "account_id": "string",
            "cloudtrail_region": "string",
            "organization_id": "string"
        }
    ]
}

response = falcon.command("CreateCSPMAwsAccount", body=BODY)
print(response)

DeleteCSPMAwsAccount

Deletes an existing AWS account or organization in our system.

PEP8 method name

delete_aws_account

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
ids
Service Class Support

Uber Class Support
querystring or list of stringsThe AWS account IDs to remove.
organization_ids
Service Class Support

Uber Class Support
querystring or list of stringsThe AWS organization ID(s) to delete.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

orgs = 'ORG1,ORG2,ORG3'  # Can also pass a list here: ['ORG1', 'ORG2', 'ORG3']

response = falcon.delete_aws_account(organization_ids=orgs, ids=id_list)
print(response)

Service class example (Operation ID syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

orgs = 'ORG1,ORG2,ORG3'  # Can also pass a list here: ['ORG1', 'ORG2', 'ORG3']

response = falcon.DeleteCSPMAwsAccount(organization_ids=orgs, ids=id_list)
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

PARAMS = {
    "organization-ids": [
       "string",
       "string"
    ]
}

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

orgs = 'ORG1,ORG2,ORG3'  # Can also pass a list here: ['ORG1', 'ORG2', 'ORG3']

response = falcon.command("DeleteCSPMAwsAccount", organization_ids=orgs, ids=id_list)
print(response)

PatchCSPMAwsAccount

Patches a existing account in our system for a customer.

PEP8 method name

update_aws_account

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
account_id
Service Class Support

Uber Class Support
bodystringAWS Account ID.
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format.
cloudtrail_region
Service Class Support

Uber Class Support
bodystringAWS Cloudtrail Region.

Usage

Service class example (PEP8 syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.update_aws_account(account_id="string", cloudtrail_region="string")
print(response)

Service class example (Operation ID syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.PatchCSPMAwsAccount(account_id="string", cloudtrail_region="string")
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

BODY = {
    "resources": [
        {
            "account_id": "string",
            "cloudtrail_region": "string"
        }
    ]
}

response = falcon.command("PatchCSPMAwsAccount", body=BODY)
print(response)

GetCSPMAwsConsoleSetupURLs

Return a URL for customer to visit in their cloud environment to grant us access to their AWS environment.

PEP8 method name

get_aws_console_setup_urls

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

No keywords or arguments are accepted.

Usage

Service class example (PEP8 syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.get_aws_console_setup_urls()
print(response)

Service class example (Operation ID syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.GetCSPMAwsConsoleSetupURLs()
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("GetCSPMAwsConsoleSetupURLs")
print(response)

GetCSPMAwsAccountScriptsAttachment

Return a script for customer to run in their cloud environment to grant us access to their AWS environment as a downloadable attachment.

PEP8 method name

get_aws_account_scripts_attachment

Content-Type

  • Produces: application/json

Keyword Arguments

No keywords or arguments are accepted.

Usage

Service class example (PEP8 syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.get_aws_account_scripts_attachment()
print(response)

Service class example (Operation ID syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.GetCSPMAwsAccountScriptsAttachment()
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("GetCSPMAwsAccountScriptsAttachment")
print(response)

GetCSPMAzureAccount

Return information about Azure account registration

PEP8 method name

get_azure_account

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
ids
Service Class Support

Uber Class Support
querystring or list of stringsSubscription ID(s). When empty, all accounts are returned.
limit
Service Class Support

Uber Class Support
queryintegerMaximum number of results to return. (Default: 100)
offset
Service Class Support

Uber Class Support
queryintegerStarting record position.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
scan_type
Service Class Support

Uber Class Support
querystringType of scan to perform, dry or full.
status
Service Class Support

Uber Class Support
querystringAccount status to filter results by.

Usage

Service class example (PEP8 syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_azure_account(scan_type="string",
                                    status="string",
                                    limit=integer,
                                    offset=integer,
                                    ids=id_list
                                    )
print(response)

Service class example (Operation ID syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetCSPMAzureAccount(scan_type="string",
                                      status="string",
                                      limit=integer,
                                      offset=integer,
                                      ids=id_list
                                      )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetCSPMAzureAccount",
                          scan_type="string",
                          status="string",
                          limit=integer,
                          offset=integer,
                          ids=id_list
                          )
print(response)

CreateCSPMAzureAccount

Creates a new account in our system for a customer and generates a script for them to run in their cloud environment to grant us access.

PEP8 method name

create_azure_account

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format.
subscription_id
Service Class Support

Uber Class Support
bodystringAzure Subscription ID.
tenant_id
Service Class Support

Uber Class Support
bodystringAzure tenant ID.

Usage

Service class example (PEP8 syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.create_azure_account(subscription_id="string", tenant_id="string")
print(response)

Service class example (Operation ID syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.CreateCSPMAzureAccount(subscription_id="string", tenant_id="string")
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

BODY = {
    "resources": [
        {
            "tenant_id": "string",
            "subscription_id": "string"
        }
    ]
}

response = falcon.command("CreateCSPMAzureAccount", body=BODY)
print(response)

DeleteCSPMAzureAccount

Deletes an Azure subscription from the system.

PEP8 method name

delete_azure_account

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
ids
Service Class Support

Uber Class Support
querystring or list of stringsAzure subscription IDs to remove.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_azure_account(ids=id_list)
print(response)

Service class example (Operation ID syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteCSPMAzureAccount(ids=id_list)
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteCSPMAzureAccount", ids=id_list)
print(response)

UpdateCSPMAzureAccountClientID

Update an Azure service account in our system by with the user-created client_id created with the public key we've provided

PEP8 method name

update_azure_account_client_id

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodystringThis field is not used. Ignore.
id
Service Class Support

Uber Class Support
querystring or list of stringsThe Azure Client ID to use for the Service Principal associated with the Azure account.
tenant_id
Service Class Support

Uber Class Support
querystring or list of stringsThe Azure tenant ID to update the Client ID for. Required if multiple tenants are registered.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.update_azure_account_client_id(id="string", tenant_id="string")
print(response)

Service class example (Operation ID syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.UpdateCSPMAzureAccountClientID(id="string", tenant_id="string")
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("UpdateCSPMAzureAccountClientID", id="string", tenant_id="string")
print(response)

UpdateCSPMAzureTenantDefaultSubscriptionID

Update an Azure default subscription_id in our system for given tenant_id

PEP8 method name

update_azure_tenant_default_subscription_id

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodystringThis field is not used. Ignore.
subscription_id
Service Class Support

Uber Class Support
querystring or list of stringsThe Azure subscription ID to use as a default for all subscriptions within the tenant.
tenant_id
Service Class Support

Uber Class Support
querystring or list of stringsThe Azure tenant ID to update the Client ID for. Required if multiple tenants are registered.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.update_azure_tenant_default_subscription_id(tenant_id="string",
                                                              subscription_id="string"
                                                              )
print(response)

Service class example (Operation ID syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.UpdateCSPMAzureTenantDefaultSubscriptionID(tenant_id="string",
                                                             subscription_id="string"
                                                             )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("UpdateCSPMAzureTenantDefaultSubscriptionID",
                          tenant_id="string",
                          subscription_id="string"
                          )
print(response)

AzureDownloadCertificate

Returns JSON object(s) that contain the base64 encoded certificate for a service principal.

PEP8 method name

azure_download_certificate

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
refresh
Service Class Support

Uber Class Support
querybooleanForce a refresh of the certificate. Defaults to False.
tenant_id
Service Class Support

Uber Class Support
querystring or list of stringsThe Azure Client ID to generate script for. Defaults to the most recently registered tenant.

Usage

Service class example (PEP8 syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.azure_download_certificate(refresh=boolean, tenant_id="string")
print(response)

Service class example (Operation ID syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.AzureDownloadCertificate(refresh=boolean, tenant_id="string")
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("AzureDownloadCertificate", refresh=boolean, tenant_id="string")
print(response)

GetCSPMAzureUserScriptsAttachment

Return a script for customer to run in their cloud environment to grant us access to their Azure environment as a downloadable attachment

PEP8 method name

get_azure_user_scripts_attachment

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
tenant_id
Service Class Support

Uber Class Support
querystring or list of stringsThe Azure tenant ID.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.get_azure_user_scripts_attachment(tenant_id="string")
print(response)

Service class example (Operation ID syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.GetCSPMAzureUserScriptsAttachment(tenant_id="string")
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("GetCSPMAzureUserScriptsAttachment", tenant_id="string")
print(response)

GetBehaviorDetections

Retrieve list of detected behaviors.

PEP8 method name

get_behavior_detections

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
account_id
Service Class Support

Uber Class Support
querystringCloud account ID (e.g.: AWS AccountID, Azure SubscriptionID).
aws_account_id
Service Class Support

Uber Class Support
querystringAWS Account ID.
azure_subscription_id
Service Class Support

Uber Class Support
querystringAzure Subscription ID.
azure_tenant_id
Service Class Support

Uber Class Support
querystringAzure Tenant ID.
cloud_provider
Service Class Support

Uber Class Support
querystringCloud Provider (azure, aws, gcp).
date_time_since
Service Class Support

Uber Class Support
querystringFilter to retrieve all events after specified date. RFC3339 format.
Example: 2006-01-01T12:00:01Z07:00.
limit
Service Class Support

Uber Class Support
queryintegerMaximum number of results to return. (Max: 500)
next_token
Service Class Support

Uber Class Support
querystringString to get next page of results, associated with the previous execution. Must include all filters from previous execution.
service
Service Class Support

Uber Class Support
querystringFilter by Cloud Service. A list of available services can be found here.
severity
Service Class Support

Uber Class Support
querystringFilter by severity.
Example: High, Medium or Informational.
state
Service Class Support

Uber Class Support
querystringFilter by state.
Example: open or closed.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
Available Services
ACMIdentity
ACRKMS
AnyKeyVault
App EngineKinesis
BigQueryKubernetes
Cloud Load BalancingLambda
Cloud LoggingLoadBalancer
Cloud SQLMonitor
Cloud StorageNLB/ALB
CloudFormationNetworkSecurityGroup
CloudTrailPostgreSQL
CloudWatch LogsRDS
CloudfrontRedshift
Compute EngineS3
ConfigSES
DiskSNS
DynamoDBSQLDatabase
EBSSQLServer
EC2SQS
ECRSSM
EFSServerless Application Repository
EKSStorageAccount
ELBSubscriptions
EMRVPC
ElasticacheVirtualMachine
GuardDutyVirtualNetwork
IAM 

Usage

Service class example (PEP8 syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.get_behavior_detections(account_id="string",
                                          aws_account_id="string",
                                          azure_subscription_id="string",
                                          azure_tenant_id="string",
                                          cloud_provider="string",
                                          date_time_since="string",
                                          limit=integer,
                                          next_token="string",
                                          service="string",
                                          severity="string",
                                          state="string"
                                          )
print(response)

Service class example (Operation ID syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.GetBehaviorDetections(account_id="string",
                                        aws_account_id="string",
                                        azure_subscription_id="string",
                                        azure_tenant_id="string",
                                        cloud_provider="string",
                                        date_time_since="string",
                                        limit=integer,
                                        next_token="string",
                                        service="string",
                                        severity="string",
                                        state="string"
                                        )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("GetBehaviorDetections",
                          account_id="string",
                          aws_account_id="string",
                          azure_subscription_id="string",
                          azure_tenant_id="string",
                          cloud_provider="string",
                          date_time_since="string",
                          limit=integer,
                          next_token="string",
                          service="string",
                          severity="string",
                          state="string"
                          )
print(response)

GetConfigurationDetections

Retrieve list of detected behaviors.

PEP8 method name

get_configuration_detections

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
account_id
Service Class Support

Uber Class Support
querystringCloud account ID (e.g.: AWS AccountID, Azure SubscriptionID).
aws_account_id
Service Class Support

Uber Class Support
querystringAWS Account ID.
azure_subscription_id
Service Class Support

Uber Class Support
querystringAzure Subscription ID.
azure_tenant_id
Service Class Support

Uber Class Support
querystringAzure Tenant ID.
cloud_provider
Service Class Support

Uber Class Support
querystringCloud Provider (azure, aws, gcp).
limit
Service Class Support

Uber Class Support
queryintegerMaximum number of results to return. (Max: 500)
next_token
Service Class Support

Uber Class Support
querystringString to get next page of results, associated with the previous execution. Must include all filters from previous execution.
region
Service Class Support

Uber Class Support
querystringCloud Provider Region.
Example: us-east-1.
service
Service Class Support

Uber Class Support
querystringFilter by Cloud Service. A list of available services can be found here.
severity
Service Class Support

Uber Class Support
querystringFilter by severity.
Example: High, Medium or Informational.
status
Service Class Support

Uber Class Support
querystringFilter by status.
Example: new, reoccurring or all.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
Available Services
ACMIdentity
ACRKMS
AnyKeyVault
App EngineKinesis
BigQueryKubernetes
Cloud Load BalancingLambda
Cloud LoggingLoadBalancer
Cloud SQLMonitor
Cloud StorageNLB/ALB
CloudFormationNetworkSecurityGroup
CloudTrailPostgreSQL
CloudWatch LogsRDS
CloudfrontRedshift
Compute EngineS3
ConfigSES
DiskSNS
DynamoDBSQLDatabase
EBSSQLServer
EC2SQS
ECRSSM
EFSServerless Application Repository
EKSStorageAccount
ELBSubscriptions
EMRVPC
ElasticacheVirtualMachine
GuardDutyVirtualNetwork
IAM 

Usage

Service class example (PEP8 syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.get_configuration_detections(account_id="string",
                                               aws_account_id="string",
                                               azure_subscription_id="string",
                                               azure_tenant_id="string",
                                               cloud_provider="string",
                                               limit=integer,
                                               next_token="string",
                                               region="string,
                                               service="string",
                                               severity="string",
                                               status="string"
                                               )
print(response)

Service class example (Operation ID syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.GetConfigurationDetections(account_id="string",
                                             aws_account_id="string",
                                             azure_subscription_id="string",
                                             azure_tenant_id="string",
                                             cloud_provider="string",
                                             limit=integer,
                                             next_token="string",
                                             region="string",
                                             service="string",
                                             severity="string",
                                             status="string"
                                             )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("GetConfigurationDetections",
                          account_id="string",
                          aws_account_id="string",
                          azure_subscription_id="string",
                          azure_tenant_id="string",
                          cloud_provider="string",
                          limit=integer,
                          next_token="string",
                          region="string",
                          service="string",
                          severity="string",
                          status="string"
                          )
print(response)

GetIOAEvents

For CSPM IOA events, gets list of IOA events.

PEP8 method name

get_ioa_events

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
account_id
Service Class Support

Uber Class Support
querystringCloud account ID (e.g.: AWS AccountID, Azure SubscriptionID).
aws_account_id
Service Class Support

Uber Class Support
querystringAWS Account ID.
azure_subscription_id
Service Class Support

Uber Class Support
querystringAzure Subscription ID.
azure_tenant_id
Service Class Support

Uber Class Support
querystringAzure Tenant ID.
cloud_provider
Service Class Support

Uber Class Support
querystringCloud Provider (azure, aws, gcp).
limit
Service Class Support

Uber Class Support
queryintegerMaximum number of results to return. (Max: 500)
offset
Service Class Support

Uber Class Support
queryintegerStarting record position.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
policy_id
Service Class Support

Uber Class Support
querystringIOA Policy ID.
state
Service Class Support

Uber Class Support
querystringFilter by account state.
user_ids
Service Class Support

Uber Class Support
querystring or list of stringsUser ID(s).

Usage

Service class example (PEP8 syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_ioa_events(policy_id="string",
                                 cloud_provider="string",
                                 account_id="string",
                                 aws_account_id="string",
                                 azure_subscription_id="string",
                                 azure_tenant_id="string",
                                 user_ids=id_list,
                                 state="string",
                                 offset=integer,
                                 limit=integer
                                 )
print(response)

Service class example (Operation ID syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetIOAEvents(policy_id="string",
                               cloud_provider="string",
                               account_id="string",
                               aws_account_id="string",
                               azure_subscription_id="string",
                               azure_tenant_id="string",
                               user_ids=id_list,
                               state="string",
                               offset=integer,
                               limit=integer
                               )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetIOAEvents",
                          policy_id="string",
                          cloud_provider="string",
                          account_id="string",
                          aws_account_id="string",
                          azure_subscription_id="string",
                          azure_tenant_id="string",
                          user_ids=id_list,
                          state="string",
                          offset=integer,
                          limit=integer
                          )
print(response)

GetIOAUsers

For CSPM IOA users, gets list of IOA users.

PEP8 method name

get_ioa_users

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
account_id
Service Class Support

Uber Class Support
querystringCloud account ID (e.g.: AWS AccountID, Azure SubscriptionID).
aws_account_id
Service Class Support

Uber Class Support
querystringAWS Account ID.
azure_subscription_id
Service Class Support

Uber Class Support
querystringAzure Subscription ID.
azure_tenant_id
Service Class Support

Uber Class Support
querystringAzure Tenant ID.
cloud_provider
Service Class Support

Uber Class Support
querystringCloud Provider (azure, aws, gcp).
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
policy_id
Service Class Support

Uber Class Support
querystringIOA Policy ID.
state
Service Class Support

Uber Class Support
querystringFilter by account state.

Usage

Service class example (PEP8 syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.get_ioa_users(policy_id="string",
                                state="string",
                                cloud_provider="string",
                                account_id="string",
                                aws_account_id="string",
                                azure_subscription_id="string",
                                azure_tenant_id="string"
                                )
print(response)

Service class example (Operation ID syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.GetIOAUsers(policy_id="string",
                              state="string",
                              cloud_provider="string",
                              account_id="string",
                              aws_account_id="string",
                              azure_subscription_id="string",
                              azure_tenant_id="string"
                              )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("GetIOAUsers",
                          policy_id="string",
                          state="string",
                          cloud_provider="string",
                          account_id="string",
                          aws_account_id="string",
                          azure_subscription_id="string",
                          azure_tenant_id="string"
                          )
print(response)

GetCSPMPolicy

Given a policy ID, returns detailed policy information.

PEP8 method name

get_policy

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
ids
Service Class Support

Uber Class Support
querystring or list of stringsPolicy IDs to retrieve.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_policy(ids=id_list)
print(response)

Service class example (Operation ID syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetCSPMPolicy(ids=id_list)
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetCSPMPolicy", ids=id_list)
print(response)

GetCSPMPolicySettings

Returns information about current policy settings.

PEP8 method name

get_policy_settings

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
cloud_platform
Service Class Support

Uber Class Support
querystringCloud Provider (azure, aws, gcp).
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
policy_id
Service Class Support

Uber Class Support
querystringIOA Policy ID.
service
Service Class Support

Uber Class Support
querystringFilter by Service type.

Usage

Service class example (PEP8 syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.get_policy_settings(service="string",
                                      policy_id="string",
                                      cloud_platform="string"
                                      )
print(response)

Service class example (Operation ID syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.GetCSPMPolicySettings(service="string",
                                        policy_id="string",
                                        cloud_platform="string"
                                        )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("GetCSPMPolicySettings",
                          service="string",
                          policy_id="string",
                          cloud_platform="string"
                          )
print(response)

UpdateCSPMPolicySettings

Updates a policy setting - can be used to override policy severity or to disable a policy entirely.

PEP8 method name

update_policy_settings

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
account_id
Service Class Support

Uber Class Support
bodystringCloud Account ID to impact.
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format.
enabled
Service Class Support

Uber Class Support
bodybooleanFlag indicating if this policy is enabled.
policy_id
Service Class Support

Uber Class Support
bodyintegerPolicy ID to be updated.
regions
Service Class Support

Uber Class Support
bodystring or list of stringsList of regions where this policy is enforced.
severity
Service Class Support

Uber Class Support
bodystringPolicy severity value.
tag_excluded
Service Class Support

Uber Class Support
bodybooleanTag exclusion flag.

Usage

Service class example (PEP8 syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

region_list = 'REG1,REG2,REG3'  # Can also pass a list here: ['REG1', 'REG2', 'REG3']

response = falcon.update_policy_settings(account_id="string",
                                         enabled=boolean,
                                         policy_id=integer,
                                         regions=region_list
                                         severity="string",
                                         tag_excluded=boolean
                                         )
print(response)

Service class example (Operation ID syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

region_list = 'REG1,REG2,REG3'  # Can also pass a list here: ['REG1', 'REG2', 'REG3']

response = falcon.UpdateCSPMPolicySettings(account_id="string",
                                           enabled=boolean,
                                           policy_id=integer,
                                           regions=region_list
                                           severity="string",
                                           tag_excluded=boolean
                                           )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

BODY = {
    "resources": [
        {
        "account_id": "string",
        "enabled": boolean,
        "policy_id": integer,
        "regions": [
            "string"
        ],
        "severity": "string",
        "tag_excluded": boolean
        }
    ]
}

response = falcon.command("UpdateCSPMPolicySettings", body=BODY)
print(response)

GetCSPMScanSchedule

Returns scan schedule configuration for one or more cloud platforms.

PEP8 method name

get_scan_schedule

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
cloud_platform
Service Class Support

Uber Class Support
querystring or list of stringsThe Cloud Platform. (Azure, AWS, GCP)
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

clouds = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_scan_schedule(cloud_platform=clouds)
print(response)

Service class example (Operation ID syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

clouds = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetCSPMScanSchedule(cloud_platform=clouds)
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

clouds = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetCSPMScanSchedule", cloud_platform=clouds)
print(response)

UpdateCSPMScanSchedule

Updates scan schedule configuration for one or more cloud platforms.

PEP8 method name

update_scan_schedule

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format.
cloud_platform
Service Class Support

Uber Class Support
bodystringCloud platform (Azure, AWS, GCP).
next_scan_timestamp
Service Class Support

Uber Class Support
bodystringUTC formatted string.
scan_schedule
Service Class Support

Uber Class Support
bodystringScan schedule type.

Usage

Service class example (PEP8 syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.update_scan_schedule(cloud_platform="string",
                                       next_scan_timestampt="string",
                                       scan_schedule="string"
                                       )
print(response)

Service class example (Operation ID syntax)
from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.UpdateCSPMScanSchedule(cloud_platform="string",
                                         next_scan_timestampt="string",
                                         scan_schedule="string"
                                         )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

BODY = {
    "resources": [
        {
            "cloud_platform": "string",
            "next_scan_timestamp": "2021-10-25T05:22:27.365Z",
            "scan_schedule": "string"
        }
    ]
}

response = falcon.command("UpdateCSPMScanSchedule", body=BODY)
print(response)