CrowdStrike Falcon CrowdStrike Subreddit

Using the Cloud Snapshots service collection

Uber class support Service class support Documentation Version Page Updated

Table of Contents

Operation IDDescription
GetCredentialsMixin0
PEP 8get_credentials
Gets the registry credentials.
CreateInventory
PEP 8create_inventory
Create inventory from data received from snapshot.
RegisterCspmSnapshotAccount
PEP 8register_account
Register a cloud account for snapshot scanning.

Passing credentials

WARNING

client_id and client_secret are keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

GetCredentialsMixin0

Gets the registry credentials

PEP8 method name

get_credentials

Endpoint

MethodRoute
GET/snapshots/entities/image-registry-credentials/v1

Content-Type

  • Produces: application/json

Keyword Arguments

No keywords or arguments accepted.

Usage

Service class example (PEP8 syntax)
from falconpy import FalconContainer

# Do not hardcode API credentials!
falcon = FalconContainer(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_credentials()
print(response)

Service class example (Operation ID syntax)
from falconpy import FalconContainer

# Do not hardcode API credentials!
falcon = FalconContainer(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.GetCredentialsMixin0()
print(response)

Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetCredentialsMixin0")
print(response)

CreateInventory

Create inventory from data received from a snapshot.

PEP8 method name

create_inventory

Endpoint

MethodRoute
POST/snapshots/entities/inventories/v1

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodylist of dictionariesFull body payload in JSON format.
cloud_provider
Service Class Support

Uber Class Support
bodystringName of the cloud provider. Overriden if job_metadata keyword is provided.
instance_id
Service Class Support

Uber Class Support
bodystringID of the instance. Overriden if job_metadata keyword is provided.
job_end_time
Service Class Support

Uber Class Support
bodystringEnd time for the job. UTC date format. Overriden if job_metadata keyword is provided.
job_id
Service Class Support

Uber Class Support
bodystringJob ID. Overriden if job_metadata keyword is provided.
job_start_time
Service Class Support

Uber Class Support
bodystringStart time for the job. UTC date format. Overriden if job_metadata keyword is provided.
message
Service Class Support

Uber Class Support
bodystringMessage received upon job completion. Overriden if job_metadata keyword is provided.
scanner_version
Service Class Support

Uber Class Support
bodystringVersion identifier for the scanner used. Overriden if job_metadata keyword is provided.
status
Service Class Support

Uber Class Support
bodystringJob completion status. Overriden if job_metadata keyword is provided.
results
Service Class Support

Uber Class Support
bodydictionaryFull results payload.
os_version
Service Class Support

Uber Class Support
bodystringOperating system version. Overriden if results keyword is specified.
applications
Service Class Support

Uber Class Support
bodylist of dictionariesComplete application list. Overriden if results keyword is specified.
major_version
Service Class Support

Uber Class Support
bodystringApplication major version. Overriden if results or applications keywords are specified.
package_hash
Service Class Support

Uber Class Support
bodystringPackage hash. Overriden if results or applications keywords are specified.
package_provider
Service Class Support

Uber Class Support
bodystringPackage provider. Overriden if results or applications keywords are specified.
path
Service Class Support

Uber Class Support
bodystringApplication path. Overriden if results or applications keywords are specified.
product
Service Class Support

Uber Class Support
bodystringApplication product name. Overriden if results or applications keywords are specified.
software_architecture
Service Class Support

Uber Class Support
bodystringRunning architecture for the application. Overriden if results or applications keywords are specified.
type
Service Class Support

Uber Class Support
bodystringApplication type. Overriden if results or applications keywords are specified.
vendor
Service Class Support

Uber Class Support
bodystringApplication vendor. Overriden if results or applications keywords are specified.
job_metadata
Service Class Support

Uber Class Support
bodydictionaryComplete job metadata.

Usage

Service class example (PEP8 syntax)
from falconpy.filevantage import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.create_inventory(cloud_provider="string",
                                   instance_id="string",
                                   job_end_time="string",
                                   job_id="string",
                                   job_start_time="string",
                                   message="string",
                                   scanner_version="string",
                                   status="string",
                                   os_version="string",
                                   major_version="string",
                                   package_hash="string",
                                   package_provider="string",
                                   path="string",
                                   product="string",
                                   software_architecture="string",
                                   type="string",
                                   vendor="string"
                                   )
print(response)
Service class example (Operation ID syntax)
from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.CreateInventory(cloud_provider="string",
                                  instance_id="string",
                                  job_end_time="string",
                                  job_id="string",
                                  job_start_time="string",
                                  message="string",
                                  scanner_version="string",
                                  status="string",
                                  os_version="string",
                                  major_version="string",
                                  package_hash="string",
                                  package_provider="string",
                                  path="string",
                                  product="string",
                                  software_architecture="string",
                                  type="string",
                                  vendor="string"
                                  )
print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "job_metadata": {
        "cloud_provider": "string",
        "instance_id": "string",
        "job_end_time": "string",
        "job_id": "string",
        "job_start_time": "string",
        "message": "string",
        "scanner_version": "string",
        "status": "string"
    },
    "results": {
        "applications": [
            {
                "major_version": "string",
                "package_hash": "string",
                "package_provider": "string",
                "package_source": "string",
                "path": "string",
                "product": "string",
                "software_architecture": "string",
                "type": "string",
                "vendor": "string"
            }
        ],
        "os_version": "string"
    }
}

response = falcon.command("updateScheduledExclusions", body=body_payload)

print(response)

RegisterCspmSnapshotAccount

Register a cloud account for snapshot scanning.

PEP8 method name

register_account

Endpoint

MethodRoute
POST/snapshots/entities/accounts/v1

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodylist of dictionariesFull body payload in JSON format.
aws_accounts
Service Class Support

Uber Class Support
bodylist of dictionariesComplete list of AWS accounts to register.
account_number
Service Class Support

Uber Class Support
bodystringAWS account number. Overriden if aws_accounts keyword is provided.
batch_regions
Service Class Support

Uber Class Support
bodystringRegion the batch is executed within. Overriden if aws_accounts keyword is provided.
iam_external_id
Service Class Support

Uber Class Support
bodystringThe external ID of the IAM account used. Overriden if aws_accounts keyword is provided.
iam_role_arn
Service Class Support

Uber Class Support
bodystringThe AWS ARN for the IAM account used. Overriden if aws_accounts keyword is provided.
kms_alias
Service Class Support

Uber Class Support
bodystringThe KMS alias for the IAM account used. Overriden if aws_accounts keyword is provided.
processing_account
Service Class Support

Uber Class Support
bodystringThe ID of the processing account. Overriden if aws_accounts keyword is provided.

Usage

Service class example (PEP8 syntax)
from falconpy.filevantage import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.register_account(account_number="string",
                                   batch_regions="string",
                                   iam_external_id="string",
                                   iam_role_arn="string",
                                   kms_alias="string",
                                   processing_account="string"
                                   )
print(response)
Service class example (Operation ID syntax)
from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.RegisterCspmSnapshotAccount(account_number="string",
                                              batch_regions="string",
                                              iam_external_id="string",
                                              iam_role_arn="string",
                                              kms_alias="string",
                                              processing_account="string"
                                              )
print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "aws_accounts": [
        {
            "account_number": "string",
            "batch_regions": [
                {
                    "job_definition_name": "string",
                    "job_queue": "string",
                    "region": "string"
                }
            ],
            "iam_external_id": "string",
            "iam_role_arn": "string",
            "kms_alias": "string",
            "processing_account": "string"
        }
    ]
}

response = falcon.command("RegisterCspmSnapshotAccount", body=body_payload)

print(response)