Using the Discover service collection

This service collection has code examples posted to the repository.

Table of Contents

Passing credentials

WARNING

client_id and client_secret are keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

combined_applications

Search for applications in your environment by providing a FQL (Falcon Query Language) filter and paging details. Returns details on applications which match the filter criteria.

PEP8 method name

query_combined_applications

Endpoint

Method	Route
	/discover/combined/applications/v1

Required Scope

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
facet			query	string	Select various details blocks to be returned for each application entity. Supported values: browser_extension host_info install_usage
filter			query	string	Filter applications using a FQL query. A list of available filters can be found here.
limit			query	integer	The number of account IDs to return in this response (Max: 1000, Default: 100). Use with the after parameter to manage pagination of results.
after			query	string	A pagination token used with the limit parameter to manage pagination of results. On your first request, don't provide an after token. On subsequent requests, provide the after token from the previous response to continue from that place in the results.
parameters			query	dictionary	Full query string parameters payload in JSON format.
sort			query	string	Sort accounts by their properties. A single sort field is allowed. Common sort options include: username|asc last_failed_login_timestamp|desc

Available filters

The following properties can be using for filtering and sorting.

Usage

Service class example (PEP8 syntax)

from falconpy import Discover

# Do not hardcode API credentials!
falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_combined_applications(after="string",
                                              limit=integer,
                                              sort="string",
                                              filter="string",
                                              facet="string"
                                              )
print(response)

Service class example (Operation ID syntax)

from falconpy import Discover

# Do not hardcode API credentials!
falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.combined_applications(after="string",
                                        limit=integer,
                                        sort="string",
                                        filter="string",
                                        facet="string"
                                        )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("combined_applications",
                          after="string",
                          limit=integer,
                          sort="string",
                          filter="string",
                          facet="string"
                          )
print(response)

combined_hosts

Search for assets in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns details on assets which match the filter criteria.

PEP8 method name

query_combined_hosts

Endpoint

Method	Route
	/discover/combined/hosts/v1

Required Scope

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
filter			query	string	Filter assets using a FQL query. A complete list of available filters can be found here.
limit			query	integer	The number of asset IDs to return in this response (Max: 1000, Default: 100). Use with the after parameter to manage pagination of results.
after			query	string	A pagination token used with the limit parameter to manage pagination of results. On your first request, don't provide an after token. On subsequent requests, provide the after token from the previous response to continue from that place in the results.
parameters			query	dictionary	Full query string parameters payload in JSON format.
sort			query	string	Sort assets by their properties. A single sort field is allowed. Common sort options include: hostname|asc product_type_desc|desc

Available FQL Filters

Available filter fields that support exact match: id, aid, entity_type, country, city, platform_name, os_version, kernel_version, product_type_desc, tags, groups, agent_version, system_product_name, system_manufacturer, system_serial_number, bios_manufacturer, bios_version, ou, machine_domain, site_name, external_ip, hostname, local_ips_count, network_interfaces.local_ip, network_interfaces.mac_address, network_interfaces.interface_alias, network_interfaces.interface_description, network_interfaces.network_prefix, last_discoverer_aid, discoverer_count, discoverer_aids, discoverer_tags, discoverer_platform_names, discoverer_product_type_descs, confidence, internet_exposure, os_is_eol, data_providers, data_providers_count, mac_addresses, local_ip_addresses, reduced_functionality_mode, number_of_disk_drives, processor_package_count, physical_core_count, logical_core_count, total_disk_space, disk_sizes.disk_name, disk_sizes.disk_space, cpu_processor_name, total_memory, encryption_status, encrypted_drives, encrypted_drives_count, unencrypted_drives, unencrypted_drives_count, os_security.secure_boot_requested_status, os_security.device_guard_status, os_security.device_guard_status, os_security.device_guard_status, os_security.system_guard_status, os_security.credential_guard_status, os_security.iommu_protection_status, os_security.secure_boot_enabled_status, os_security.uefi_memory_protection_status, os_security.virtualization_based_security_status, os_security.kernel_dma_protection_status, total_bios_files, bios_hashes_data.sha256_hash, bios_hashes_data.measurement_type, bios_id, average_processor_usage, average_memory_usage, average_memory_usage_pct, max_processor_usage, max_memory_usage, max_memory_usage_pct, used_disk_space, used_disk_space_pct, available_disk_space, available_disk_space_pct, mount_storage_info.mount_path, mount_storage_info.used_space, mount_storage_info.available_space, form_factor, servicenow_id, owned_by, managed_by, assigned_to, department, fqdn, used_for, object_guid, object_sid, ad_user_account_control, account_enabled, creation_timestamp, email, os_service_pack, location, state, cpu_manufacturer, discovering_by

Available filter fields that supports wildcard (*): id, aid, entity_type, country, city, platform_name, os_version, kernel_version, product_type_desc, tags, groups, agent_version, system_product_name, system_manufacturer, system_serial_number, bios_manufacturer, bios_version, ou, machine_domain, site_name, external_ip, hostname, network_interfaces.local_ip, network_interfaces.mac_address, network_interfaces.interface_alias, network_interfaces.interface_description, network_interfaces.network_prefix, last_discoverer_aid, discoverer_aids, discoverer_tags, discoverer_platform_names, discoverer_product_type_descs, confidence, internet_exposure, os_is_eol, data_providers, mac_addresses, local_ip_addresses, reduced_functionality_mode, disk_sizes.disk_name, cpu_processor_name, encryption_status, encrypted_drives, unencrypted_drives, os_security.secure_boot_requested_status, os_security.device_guard_status, os_security.device_guard_status, os_security.device_guard_status, os_security.system_guard_status, os_security.credential_guard_status, os_security.iommu_protection_status, os_security.secure_boot_enabled_status, os_security.uefi_memory_protection_status, os_security.virtualization_based_security_status, os_security.kernel_dma_protection_status, bios_hashes_data.sha256_hash, bios_hashes_data.measurement_type, bios_id, mount_storage_info.mount_path, form_factor, servicenow_id, owned_by, managed_by, assigned_to, department, fqdn, used_for, object_guid, object_sid, account_enabled, email, os_service_pack, location, state, cpu_manufacturer, discovering_by

Available filter fields that supports range comparisons (>, <, >=, <=): first_seen_timestamp, last_seen_timestamp, local_ips_count, discoverer_count, confidence, number_of_disk_drives, processor_package_count, physical_core_count, data_providers_count, logical_core_count, total_disk_space, disk_sizes.disk_space, total_memory, encrypted_drives_count, unencrypted_drives_count, total_bios_files, average_processor_usage, average_memory_usage, average_memory_usage_pct, max_processor_usage, max_memory_usage, max_memory_usage_pct, used_disk_space, used_disk_space_pct, available_disk_space, available_disk_space_pct, mount_storage_info.used_space, mount_storage_info.available_space, ad_user_account_control, creation_timestamp

All filter fields and operations supports negation (!).

Usage

Service class example (PEP8 syntax)

from falconpy import Discover

# Do not hardcode API credentials!
falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_combined_hosts(after="string",
                                       limit=integer,
                                       sort="string",
                                       filter="string"
                                       )
print(response)

Service class example (Operation ID syntax)

from falconpy import Discover

# Do not hardcode API credentials!
falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.combined_hosts(after="string",
                                 limit=integer,
                                 sort="string",
                                 filter="string"
                                 )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("combined_hosts",
                          after="string",
                          limit=integer,
                          sort="string",
                          filter="string"
                          )
print(response)

get_accounts

Get details on assets by providing one or more IDs.

PEP8 method name

get_accounts

Endpoint

Method	Route
	/discover/entities/accounts/v1

Required Scope

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
ids			query	string or list of strings	One or more account IDs. (Max: 100) Find account IDs with query_accounts.
parameters			query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import Discover

# Do not hardcode API credentials!
falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_accounts(ids=id_list)
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_accounts", ids=id_list)
print(response)

get_applications

Get details on applications by providing one or more IDs.

PEP8 method name

get_applications

Endpoint

Method	Route
	/discover/entities/applications/v1

Required Scope

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
ids			query	string or list of strings	One or more account IDs. (Max: 100) Find account IDs with query_accounts.
parameters			query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import Discover

# Do not hardcode API credentials!
falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_applications(ids=id_list)
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_applications", ids=id_list)
print(response)

get_hosts

Get details on assets by providing one or more IDs.

PEP8 method name

get_hosts

Endpoint

Method	Route
	/discover/entities/hosts/v1

Required Scope

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
ids			query	string or list of strings	One or more asset IDs. (Max: 100) Find asset IDs with query_hosts.
parameters			query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import Discover

# Do not hardcode API credentials!
falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_hosts(ids=id_list)
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_hosts", ids=id_list)
print(response)

get_iot_hosts

Get details on assets by providing one or more IDs.

PEP8 method name

get_iot_hosts

Endpoint

Method	Route
	/discover/entities/iot-hosts/v1

Required Scope

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
ids			query	string or list of strings	One or more IoT asset IDs. (Max: 100) Find asset IDs with query_iot_hosts.
parameters			query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import Discover

# Do not hardcode API credentials!
falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_iot_hosts(ids=id_list)

print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_iot_hosts", ids=id_list)

print(response)

get_logins

Get details on assets by providing one or more IDs.

PEP8 method name

get_logins

Endpoint

Method	Route
	/discover/entities/logins/v1

Required Scope

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
ids			query	string or list of strings	One or more login IDs. (Max: 100) Find login IDs with query_logins.
parameters			query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import Discover

# Do not hardcode API credentials!
falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_logins(ids=id_list)
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_logins", ids=id_list)
print(response)

query_accounts

Search for accounts in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.

PEP8 method name

query_accounts

Endpoint

Method	Route
	/discover/queries/accounts/v1

Required Scope

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
filter			query	string	Filter accounts using a FQL query. A complete list of available filters can be found here.
limit			query	integer	The number of account IDs to return in this response (Max: 100, Default: 100). Use with the offset parameter to manage pagination of results.
offset			query	string	An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide an offset. On subsequent requests, provide the offset from the previous response to continue from that place in the results.
parameters			query	dictionary	Full query string parameters payload in JSON format.
sort			query	string	Sort accounts by their properties. A single sort field is allowed. Common sort options include: username|asc last_failed_login_timestamp|desc

Available FQL Filters

Common filters include:

• account_type:'Local'
• admin_privileges:'Yes'
• first_seen_timestamp:<'now-7d'
• last_successful_login_type:'Terminal server'

The following table lists acceptable values for the filter keyword described above.

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import Discover

# Do not hardcode API credentials!
falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_accounts(offset=integer,
                              limit=integer,
                              sort="string",
                              filter="string"
                              )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("query_accounts",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string"
                          )
print(response)

query_applications

Search for applications in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of application IDs which match the filter criteria.

PEP8 method name

query_applications

Endpoint

Method	Route
	/discover/queries/applications/v1

Required Scope

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
filter			query	string	Filter applications using a FQL query. A list of available filters can be found here.
limit			query	integer	The number of account IDs to return in this response (Max: 100, Default: 100). Use with the offset parameter to manage pagination of results.
offset			query	string	An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide an offset. On subsequent requests, provide the offset from the previous response to continue from that place in the results.
parameters			query	dictionary	Full query string parameters payload in JSON format.
sort			query	string	Sort accounts by their properties. A single sort field is allowed. Common sort options include: username|asc last_failed_login_timestamp|desc

Available filters

The following properties can be using for filtering and sorting.

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import Discover

# Do not hardcode API credentials!
falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_applications(offset=integer,
                                     limit=integer,
                                     sort="string",
                                     filter="string"
                                     )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("query_applications",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string"
                          )
print(response)

query_hosts

Search for assets in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.

PEP8 method name

query_hosts

Endpoint

Method	Route
	/discover/queries/hosts/v1

Required Scope

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
filter			query	string	Filter assets using a FQL query. A complete list of available filters can be found here.
limit			query	integer	The number of asset IDs to return in this response (Max: 100, Default: 100). Use with the offset parameter to manage pagination of results.
offset			query	string	An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide an offset. On subsequent requests, provide the offset from the previous response to continue from that place in the results.
parameters			query	dictionary	Full query string parameters payload in JSON format.
sort			query	string	Sort assets by their properties. A single sort field is allowed. Common sort options include: hostname|asc product_type_desc|desc

Available FQL Filters

The following table lists acceptable values for the filter keyword described above.

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import Discover

# Do not hardcode API credentials!
falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_hosts(offset=integer,
                              limit=integer,
                              sort="string",
                              filter="string"
                              )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("query_hosts",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string"
                          )
print(response)

query_iot_hosts

Search for IoT assets in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.

PEP8 method name

query_iot_hosts

Endpoint

Method	Route
	/discover/queries/iot-hosts/v1

Required Scope

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
filter			query	string	Filter assets using a FQL query. A complete list of available filters can be found here.
limit			query	integer	The number of IoT asset IDs to return in this response (Max: 100, Default: 100). Use with the offset parameter to manage pagination of results.
offset			query	string	An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide an offset. On subsequent requests, provide the offset from the previous response to continue from that place in the results.
parameters			query	dictionary	Full query string parameters payload in JSON format.
sort			query	string	Sort IoT assets by their properties. A single sort field is allowed. Common sort options include: hostname|asc product_type_desc|desc

Available FQL Filters

The following table lists acceptable values for the filter keyword described above.

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import Discover

# Do not hardcode API credentials!
falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_iot_hosts(offset=integer,
                                  limit=integer,
                                  sort="string",
                                  filter="string"
                                  )

print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("query_iot_hosts",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string"
                          )

print(response)

query_logins

Search for accounts in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.

PEP8 method name

query_logins

Endpoint

Method	Route
	/discover/queries/logins/v1

Required Scope

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
filter			query	string	Filter logins using a FQL query. A complete list of available filters can be found here.
limit			query	integer	The number of login IDs to return in this response (Max: 100, Default: 100). Use with the offset parameter to manage pagination of results.
offset			query	string	An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide an offset. On subsequent requests, provide the offset from the previous response to continue from that place in the results.
parameters			query	dictionary	Full query string parameters payload in JSON format.
sort			query	string	Sort logins by their properties. A single sort field is allowed. Common sort options include: account_name|asc login_timestamp|desc

Available FQL Filters

Common filters include:

• account_type:'Local'
• login_type:'Interactive'
• first_seen_timestamp:<'now-7d'
• admin_privileges:'No'

The following table lists acceptable values for the filter keyword described above.

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import Discover

# Do not hardcode API credentials!
falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_logins(offset=integer,
                              limit=integer,
                              sort="string",
                              filter="string"
                              )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("query_logins",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string"
                          )
print(response)

query_iot_hostsV2

Search for IoT assets in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.

PEP8 method name

query_iot_hosts_v2

Endpoint

Method	Route
	/discover/queries/iot-hosts/v2

Required Scope

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
filter			query	string	Filter assets using a FQL query. A complete list of available filters can be found here.
limit			query	integer	The number of IoT asset IDs to return in this response (Max: 100, Default: 100). Use with the offset parameter to manage pagination of results.
offset			query	string	An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide an offset. On subsequent requests, provide the offset from the previous response to continue from that place in the results.
parameters			query	dictionary	Full query string parameters payload in JSON format.
sort			query	string	Sort IoT assets by their properties. A single sort field is allowed. Common sort options include: hostname|asc product_type_desc|desc

Available FQL Filters

The following table lists acceptable values for the filter keyword described above.

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import Discover

# Do not hardcode API credentials!
falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_iot_hosts_v2(offset=integer,
                                     limit=integer,
                                     sort="string",
                                     filter="string"
                                     )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("query_iot_hosts_v2",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string"
                          )
print(response)