CrowdStrike Falcon Twitter URL

Using the Firewall Management service collection

Uber class support Service class support Documentation Version Page Updated

Table of Contents

Operation IDDescription
aggregate_events
PEP 8aggregate_events
Aggregate events for customer
aggregate_policy_rules
PEP 8aggregate_policy_rules
Aggregate rules within a policy for customer
aggregate_rule_groups
PEP 8aggregate_rule_groups
Aggregate rule groups for customer
aggregate_rules
PEP 8aggregate_rules
Aggregate rules for customer
get_events
PEP 8get_events
Get events entities by ID and optionally version
get_firewall_fields
PEP 8get_firewall_fields
Get the firewall field specifications by ID
get_platforms
PEP 8get_platforms
Get platforms by ID, e.g., windows or mac or droid
get_policy_containers
PEP 8get_policy_containers
Get policy container entities by policy ID
update_policy_container
PEP 8update_policy_container
Update an identified policy container
get_rule_groups
PEP 8get_rule_groups
Get rule group entities by ID. These groups do not contain their rule entites, just the rule IDs in precedence order.
create_rule_group
PEP 8create_rule_group
Create new rule group on a platform for a customer with a name and description, and return the ID
delete_rule_groups
PEP 8delete_rule_groups
Delete rule group entities by ID
update_rule_group
PEP 8update_rule_group
Update name, description, or enabled status of a rule group, or create, edit, delete, or reorder rules
get_rules
PEP 8get_rules
Get rule entities by ID (64-bit unsigned int as decimal string) or Family ID (32-character hexadecimal string)
query_events
PEP 8query_events
Find all event IDs matching the query with filter
query_firewall_fields
PEP 8query_firewall_fields
Get the firewall field specification IDs for the provided platform
query_platforms
PEP 8query_platforms
Get the list of platform names
query_policy_rules
PEP 8query_policy_rules
Find all firewall rule IDs matching the query with filter, and return them in precedence order
query_rule_groups
PEP 8query_rule_groups
Find all rule group IDs matching the query with filter
query_rules
PEP 8query_rules
Find all rule IDs matching the query with filter

Passing credentials

WARNING

client_id and client_secret are input variables that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

aggregate_events

Aggregate events for customer

PEP8 method name

aggregate_events

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodylist of dictionariesFull body payload in JSON format.
date_ranges
Service Class Support

No Uber Class Support
bodylist of dictionariesApplies to date_range aggregations.

Example:
[
  {
    "from": "2016-05-28T09:00:31Z",
    "to": "2016-05-30T09:00:31Z"
  },
  {
    "from": "2016-06-01T09:00:31Z",
    "to": "2016-06-10T09:00:31Z"
  }
]
field
Service Class Support

No Uber Class Support
bodystringThe field on which to compute the aggregation.
filter
Service Class Support

No Uber Class Support
bodystringFQL syntax formatted string to use to filter the results.
interval
Service Class Support

No Uber Class Support
bodystringTime interval for date histogram aggregations. Valid values include:
  • year
  • month
  • week
  • day
  • hour
  • minute
min_doc_count
Service Class Support

No Uber Class Support
bodyintegerOnly return buckets if values are greater than or equal to the value here.
missing
Service Class Support

No Uber Class Support
bodystringMissing is the value to be used when the aggregation field is missing from the object. In other words, the missing parameter defines how documents that are missing a value should be treated. By default they will be ignored, but it is also possible to treat them as if they had a value.
name
Service Class Support

No Uber Class Support
bodystringName of the aggregate query, as chosen by the user. Used to identify the results returned to you.
q
Service Class Support

No Uber Class Support
bodystringFull text search across all metadata fields.
ranges
Service Class Support

No Uber Class Support
bodylist of dictionariesApplies to range aggregations. Ranges values will depend on field.

For example, if max_severity is used, ranges might look like:
[
  {
    "From": 0,
    "To": 70
  },
  {
    "From": 70,
    "To": 100
  }
]
size
Service Class Support

No Uber Class Support
bodyintegerThe max number of term buckets to be returned.
sub_aggregates
Service Class Support

No Uber Class Support
bodylist of dictionariesA nested aggregation, such as:
[
  {
    "name": "max_first_behavior",
    "type": "max",
    "field": "first_behavior"
  }
]

There is a maximum of 3 nested aggregations per request.
sort
Service Class Support

No Uber Class Support
bodystringFQL syntax string to sort bucket results.
  • _count - sort by document count
  • _term - sort by the string value alphabetically
Supports asc and desc using | format.

Example: _count|desc
time_zone
Service Class Support

No Uber Class Support
bodystringTime zone for bucket results.
type
Service Class Support

No Uber Class Support
bodystringType of aggregation. Valid values include:
  • date_histogram - Aggregates counts on a specified time interval. Requires use of “interval” field.
  • date_range - Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
  • terms - Buckets detections by the value of a specified field. For example, if field used is scenario, then detections will be bucketed by the various detection scenario names.
  • range - Buckets detections by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the detects will be counted by the specified ranges of severity.
  • cardinality - Returns the count of distinct values in a specified field.
  • max - Returns the maximum value of a specified field.
  • min - Returns the minimum value of a specified field.
  • avg - Returns the average value of the specified field.
  • sum - Returns the total sum of all values for the specified field.
  • percentiles - Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.

Usage

Service class example (PEP8 / Operation ID syntax)
from falconpy import FirewallManagement

# Do not hardcode API credentials!
falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.aggregate_events(date_ranges=date_ranges,
                                   field="string",
                                   filter="string",
                                   interval="string",
                                   min_doc_count=integer,
                                   missing="string",
                                   name="string",
                                   q="string",
                                   ranges=ranges,
                                   size=integer,
                                   sort="string",
                                   time_zone="string",
                                   type="string"
                                   )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

BODY = [{
    "date_ranges": date_ranges,
    "field": "string",
    "filter": "string",
    "interval": "string",
    "min_doc_count": 0,
    "missing": "string",
    "name": "string",
    "q": "string",
    "ranges": ranges,
    "size": 0,
    "sort": "string",
    "sub_aggregates": [
        null
    ],
    "time_zone": "string",
    "type": "string"
}]

response = falcon.command("aggregate_events", body=BODY)
print(response)

aggregate_policy_rules

Aggregate rules within a policy for customer

PEP8 method name

aggregate_policy_rules

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodylist of dictionariesFull body payload in JSON format.
date_ranges
Service Class Support

No Uber Class Support
bodylist of dictionariesApplies to date_range aggregations.

Example:
[
  {
    "from": "2016-05-28T09:00:31Z",
    "to": "2016-05-30T09:00:31Z"
  },
  {
    "from": "2016-06-01T09:00:31Z",
    "to": "2016-06-10T09:00:31Z"
  }
]
field
Service Class Support

No Uber Class Support
bodystringThe field on which to compute the aggregation.
filter
Service Class Support

No Uber Class Support
bodystringFQL syntax formatted string to use to filter the results.
interval
Service Class Support

No Uber Class Support
bodystringTime interval for date histogram aggregations. Valid values include:
  • year
  • month
  • week
  • day
  • hour
  • minute
min_doc_count
Service Class Support

No Uber Class Support
bodyintegerOnly return buckets if values are greater than or equal to the value here.
missing
Service Class Support

No Uber Class Support
bodystringMissing is the value to be used when the aggregation field is missing from the object. In other words, the missing parameter defines how documents that are missing a value should be treated. By default they will be ignored, but it is also possible to treat them as if they had a value.
name
Service Class Support

No Uber Class Support
bodystringName of the aggregate query, as chosen by the user. Used to identify the results returned to you.
q
Service Class Support

No Uber Class Support
bodystringFull text search across all metadata fields.
ranges
Service Class Support

No Uber Class Support
bodylist of dictionariesApplies to range aggregations. Ranges values will depend on field.

For example, if max_severity is used, ranges might look like:
[
  {
    "From": 0,
    "To": 70
  },
  {
    "From": 70,
    "To": 100
  }
]
size
Service Class Support

No Uber Class Support
bodyintegerThe max number of term buckets to be returned.
sub_aggregates
Service Class Support

No Uber Class Support
bodylist of dictionariesA nested aggregation, such as:
[
  {
    "name": "max_first_behavior",
    "type": "max",
    "field": "first_behavior"
  }
]

There is a maximum of 3 nested aggregations per request.
sort
Service Class Support

No Uber Class Support
bodystringFQL syntax string to sort bucket results.
  • _count - sort by document count
  • _term - sort by the string value alphabetically
Supports asc and desc using | format.

Example: _count|desc
time_zone
Service Class Support

No Uber Class Support
bodystringTime zone for bucket results.
type
Service Class Support

No Uber Class Support
bodystringType of aggregation. Valid values include:
  • date_histogram - Aggregates counts on a specified time interval. Requires use of “interval” field.
  • date_range - Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
  • terms - Buckets detections by the value of a specified field. For example, if field used is scenario, then detections will be bucketed by the various detection scenario names.
  • range - Buckets detections by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the detects will be counted by the specified ranges of severity.
  • cardinality - Returns the count of distinct values in a specified field.
  • max - Returns the maximum value of a specified field.
  • min - Returns the minimum value of a specified field.
  • avg - Returns the average value of the specified field.
  • sum - Returns the total sum of all values for the specified field.
  • percentiles - Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.

Usage

Service class example (PEP8 / Operation ID syntax)
from falconpy import FirewallManagement

# Do not hardcode API credentials!
falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.aggregate_policy_rules(date_ranges=date_ranges,
                                         field="string",
                                         filter="string",
                                         interval="string",
                                         min_doc_count=integer,
                                         missing="string",
                                         name="string",
                                         q="string",
                                         ranges=ranges,
                                         size=integer,
                                         sort="string",
                                         time_zone="string",
                                         type="string"
                                         )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

BODY = [{
    "date_ranges": date_ranges,
    "field": "string",
    "filter": "string",
    "interval": "string",
    "min_doc_count": 0,
    "missing": "string",
    "name": "string",
    "q": "string",
    "ranges": ranges,
    "size": 0,
    "sort": "string",
    "sub_aggregates": [
        null
    ],
    "time_zone": "string",
    "type": "string"
}]

response = falcon.command("aggregate_policy_rules", body=BODY)
print(response)

aggregate_rule_groups

Aggregate rule groups for customer

PEP8 method name

aggregate_rule_groups

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodylist of dictionariesFull body payload in JSON format.
date_ranges
Service Class Support

No Uber Class Support
bodylist of dictionariesApplies to date_range aggregations.

Example:
[
  {
    "from": "2016-05-28T09:00:31Z",
    "to": "2016-05-30T09:00:31Z"
  },
  {
    "from": "2016-06-01T09:00:31Z",
    "to": "2016-06-10T09:00:31Z"
  }
]
field
Service Class Support

No Uber Class Support
bodystringThe field on which to compute the aggregation.
filter
Service Class Support

No Uber Class Support
bodystringFQL syntax formatted string to use to filter the results.
interval
Service Class Support

No Uber Class Support
bodystringTime interval for date histogram aggregations. Valid values include:
  • year
  • month
  • week
  • day
  • hour
  • minute
min_doc_count
Service Class Support

No Uber Class Support
bodyintegerOnly return buckets if values are greater than or equal to the value here.
missing
Service Class Support

No Uber Class Support
bodystringMissing is the value to be used when the aggregation field is missing from the object. In other words, the missing parameter defines how documents that are missing a value should be treated. By default they will be ignored, but it is also possible to treat them as if they had a value.
name
Service Class Support

No Uber Class Support
bodystringName of the aggregate query, as chosen by the user. Used to identify the results returned to you.
q
Service Class Support

No Uber Class Support
bodystringFull text search across all metadata fields.
ranges
Service Class Support

No Uber Class Support
bodylist of dictionariesApplies to range aggregations. Ranges values will depend on field.

For example, if max_severity is used, ranges might look like:
[
  {
    "From": 0,
    "To": 70
  },
  {
    "From": 70,
    "To": 100
  }
]
size
Service Class Support

No Uber Class Support
bodyintegerThe max number of term buckets to be returned.
sub_aggregates
Service Class Support

No Uber Class Support
bodylist of dictionariesA nested aggregation, such as:
[
  {
    "name": "max_first_behavior",
    "type": "max",
    "field": "first_behavior"
  }
]

There is a maximum of 3 nested aggregations per request.
sort
Service Class Support

No Uber Class Support
bodystringFQL syntax string to sort bucket results.
  • _count - sort by document count
  • _term - sort by the string value alphabetically
Supports asc and desc using | format.

Example: _count|desc
time_zone
Service Class Support

No Uber Class Support
bodystringTime zone for bucket results.
type
Service Class Support

No Uber Class Support
bodystringType of aggregation. Valid values include:
  • date_histogram - Aggregates counts on a specified time interval. Requires use of “interval” field.
  • date_range - Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
  • terms - Buckets detections by the value of a specified field. For example, if field used is scenario, then detections will be bucketed by the various detection scenario names.
  • range - Buckets detections by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the detects will be counted by the specified ranges of severity.
  • cardinality - Returns the count of distinct values in a specified field.
  • max - Returns the maximum value of a specified field.
  • min - Returns the minimum value of a specified field.
  • avg - Returns the average value of the specified field.
  • sum - Returns the total sum of all values for the specified field.
  • percentiles - Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.

Usage

Service class example (PEP8 / Operation ID syntax)
from falconpy import FirewallManagement

# Do not hardcode API credentials!
falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.aggregate_rule_groups(date_ranges=date_ranges,
                                        field="string",
                                        filter="string",
                                        interval="string",
                                        min_doc_count=integer,
                                        missing="string",
                                        name="string",
                                        q="string",
                                        ranges=ranges,
                                        size=integer,
                                        sort="string",
                                        time_zone="string",
                                        type="string"
                                        )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

BODY = [{
    "date_ranges": date_ranges,
    "field": "string",
    "filter": "string",
    "interval": "string",
    "min_doc_count": 0,
    "missing": "string",
    "name": "string",
    "q": "string",
    "ranges": ranges,
    "size": 0,
    "sort": "string",
    "sub_aggregates": [
        null
    ],
    "time_zone": "string",
    "type": "string"
}]

response = falcon.command("aggregate_rule_groups", body=BODY)
print(response)

aggregate_rules

Aggregate rules for customer

PEP8 method name

aggregate_rules

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodylist of dictionariesFull body payload in JSON format.
date_ranges
Service Class Support

No Uber Class Support
bodylist of dictionariesApplies to date_range aggregations.

Example:
[
  {
    "from": "2016-05-28T09:00:31Z",
    "to": "2016-05-30T09:00:31Z"
  },
  {
    "from": "2016-06-01T09:00:31Z",
    "to": "2016-06-10T09:00:31Z"
  }
]
field
Service Class Support

No Uber Class Support
bodystringThe field on which to compute the aggregation.
filter
Service Class Support

No Uber Class Support
bodystringFQL syntax formatted string to use to filter the results.
interval
Service Class Support

No Uber Class Support
bodystringTime interval for date histogram aggregations. Valid values include:
  • year
  • month
  • week
  • day
  • hour
  • minute
min_doc_count
Service Class Support

No Uber Class Support
bodyintegerOnly return buckets if values are greater than or equal to the value here.
missing
Service Class Support

No Uber Class Support
bodystringMissing is the value to be used when the aggregation field is missing from the object. In other words, the missing parameter defines how documents that are missing a value should be treated. By default they will be ignored, but it is also possible to treat them as if they had a value.
name
Service Class Support

No Uber Class Support
bodystringName of the aggregate query, as chosen by the user. Used to identify the results returned to you.
q
Service Class Support

No Uber Class Support
bodystringFull text search across all metadata fields.
ranges
Service Class Support

No Uber Class Support
bodylist of dictionariesApplies to range aggregations. Ranges values will depend on field.

For example, if max_severity is used, ranges might look like:
[
  {
    "From": 0,
    "To": 70
  },
  {
    "From": 70,
    "To": 100
  }
]
size
Service Class Support

No Uber Class Support
bodyintegerThe max number of term buckets to be returned.
sub_aggregates
Service Class Support

No Uber Class Support
bodylist of dictionariesA nested aggregation, such as:
[
  {
    "name": "max_first_behavior",
    "type": "max",
    "field": "first_behavior"
  }
]

There is a maximum of 3 nested aggregations per request.
sort
Service Class Support

No Uber Class Support
bodystringFQL syntax string to sort bucket results.
  • _count - sort by document count
  • _term - sort by the string value alphabetically
Supports asc and desc using | format.

Example: _count|desc
time_zone
Service Class Support

No Uber Class Support
bodystringTime zone for bucket results.
type
Service Class Support

No Uber Class Support
bodystringType of aggregation. Valid values include:
  • date_histogram - Aggregates counts on a specified time interval. Requires use of “interval” field.
  • date_range - Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
  • terms - Buckets detections by the value of a specified field. For example, if field used is scenario, then detections will be bucketed by the various detection scenario names.
  • range - Buckets detections by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the detects will be counted by the specified ranges of severity.
  • cardinality - Returns the count of distinct values in a specified field.
  • max - Returns the maximum value of a specified field.
  • min - Returns the minimum value of a specified field.
  • avg - Returns the average value of the specified field.
  • sum - Returns the total sum of all values for the specified field.
  • percentiles - Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.

Usage

Service class example (PEP8 / Operation ID syntax)
from falconpy import FirewallManagement

# Do not hardcode API credentials!
falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.aggregate_rules(date_ranges=date_ranges,
                                  field="string",
                                  filter="string",
                                  interval="string",
                                  min_doc_count=integer,
                                  missing="string",
                                  name="string",
                                  q="string",
                                  ranges=ranges,
                                  size=integer,
                                  sort="string",
                                  time_zone="string",
                                  type="string"
                                  )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

BODY = [{
    "date_ranges": date_ranges,
    "field": "string",
    "filter": "string",
    "interval": "string",
    "min_doc_count": 0,
    "missing": "string",
    "name": "string",
    "q": "string",
    "ranges": ranges,
    "size": 0,
    "sort": "string",
    "sub_aggregates": [
        null
    ],
    "time_zone": "string",
    "type": "string"
}]

response = falcon.command("aggregate_rules", body=BODY)
print(response)

get_events

Get events entities by ID and optionally version

PEP8 method name

get_events

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
ids
Service Class Support

Uber Class Support
querystring or list of stringsThe events to retrieve, identified by ID.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 / Operation ID syntax)
from falconpy import FirewallManagement

# Do not hardcode API credentials!
falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_events(ids=id_list)
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_events", ids=id_list)
print(response)

get_firewall_fields

Get the firewall field specifications by ID

PEP8 method name

get_firewall_fields

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
ids
Service Class Support

Uber Class Support
querystring or list of stringsThe rule types to retrieve, identified by ID.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 / Operation ID syntax)
from falconpy import FirewallManagement

# Do not hardcode API credentials!
falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_firewall_fields(ids=id_list)
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_firewall_fields", ids=id_list)
print(response)

get_platforms

Get platforms by ID, e.g., windows or mac or droid

PEP8 method name

get_platforms

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
ids
Service Class Support

Uber Class Support
querystring or list of stringsThe platforms to retrieve, identified by ID.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 / Operation ID syntax)
from falconpy import FirewallManagement

# Do not hardcode API credentials!
falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_platforms(ids=id_list)
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_platforms", ids=id_list)
print(response)

get_policy_containers

Get policy container entities by policy ID

PEP8 method name

get_policy_containers

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
ids
Service Class Support

Uber Class Support
querystring or list of stringsThe policy container(s) to retrieve, identified by policy ID.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 / Operation ID syntax)
from falconpy import FirewallManagement

# Do not hardcode API credentials!
falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_policy_containers(ids=id_list)
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_policy_containers", ids=id_list)
print(response)

update_policy_container

Update an identified policy container

PEP8 method name

update_policy_container

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format.
default_inbound
Service Class Support

Uber Class Support
bodystringDefault inbound.
default_outbound
Service Class Support

Uber Class Support
bodystringDefault outbound.
enforce
Service Class Support

Uber Class Support
bodybooleanEnforcement flag.
is_default_policy
Service Class Support

Uber Class Support
bodybooleanDefault policy flag.
platform_id
Service Class Support

Uber Class Support
bodystringID of the platform this policy container.
policy_id
Service Class Support

Uber Class Support
bodystringPolicy ID to apply to this container.
rule_group_ids
Service Class Support

Uber Class Support
bodystring or list of stringsRule group IDs to include in this container.
test_mode
Service Class Support

Uber Class Support
bodybooleanFlag indicating if this container is in test mode.
tracking
Service Class Support

Uber Class Support
bodystringTracking.

Usage

Service class example (PEP8 / Operation ID syntax)
from falconpy import FirewallManagement

# Do not hardcode API credentials!
falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

rule_groups = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_policy_container(default_inbound="string",
                                          default_outbound="string",
                                          enforce=boolean,
                                          is_default_policy=boolean,
                                          platform_id="string",
                                          policy_id="string",
                                          rule_group_ids=rule_groups,
                                          test_mode=boolean,
                                          tracking="string"
                                          )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

rule_groups = ['ID1', 'ID2', 'ID3']

BODY = {
    "default_inbound": "string",
    "default_outbound": "string",
    "enforce": true,
    "is_default_policy": true,
    "platform_id": "string",
    "policy_id": "string",
    "rule_group_ids": rule_groups,
    "test_mode": true,
    "tracking": "string"
}

response = falcon.command("update_policy_container", body=BODY)
print(response)

get_rule_groups

Get rule group entities by ID. These groups do not contain their rule entites, just the rule IDs in precedence order.

PEP8 method name

get_rule_groups

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
ids
Service Class Support

Uber Class Support
querystring or list of stringsThe ID(s) of the rule group to retrieve.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 / Operation ID syntax)
from falconpy import FirewallManagement

# Do not hardcode API credentials!
falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rule_groups(ids=id_list)
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_rule_groups", ids=id_list)
print(response)

create_rule_group

Create new rule group on a platform for a customer with a name and description, and return the ID

PEP8 method name

create_rule_group

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
action
Service Class Support

Uber Class Support
body
rules
stringRule action to perform. String. Overridden if rules keyword is provided.
address_family
Service Class Support

Uber Class Support
body
rules
stringAddress type, String. Either IP4, IP6 or NONE.
Overridden if rules keyword is provided.
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format.
clone_id
Service Class Support

Uber Class Support
querystringA rule group ID from which to copy rules. If this is provided then the 'rules' property of the body is ignored.
comment
Service Class Support

Uber Class Support
querystringComment for this rule group.
description
Service Class Support

Uber Class Support
bodystringRule group description.
direction
Service Class Support

Uber Class Support
body
rules
stringTraffic direction for created rule. String. Either IN, OUT or BOTH.
Overridden if rules keyword is provided.
enabled
Service Class Support

Uber Class Support
bodybooleanFlag indicating if the rule group is enabled.
fields
Service Class Support

Uber Class Support
body
rules
dictionary or list of dictionariesFields to impact. Dictionary or list of dictionaries.
Overridden if rules keyword is provided.
icmp
Service Class Support

Uber Class Support
body
rules
dictionaryICMP protocol options.
Overridden if rules keyword is provided.
library
Service Class Support

Uber Class Support
querystringIf this flag is set to true then the rules will be cloned from the clone_id from the CrowdStrike Firewal Rule Groups Library.
local_address
Service Class Support

Uber Class Support
body
rules
dictionary or list of dictionariesLocal address and netmask detail.
Overridden if rules keyword is provided.
local_port
Service Class Support

Uber Class Support
body
rules
dictionary or list of dictionariesLocal port range.
Overridden if rules keyword is provided.
log
Service Class Support

Uber Class Support
body
rules
booleanLog rule matches.
Overridden if rules keyword is provided.
name
Service Class Support

Uber Class Support
bodystringRule group name.
monitor
Service Class Support

Uber Class Support
body
rules
dictionaryMonitor count / period.
Overridden if rules keyword is provided.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
platform_ids
Service Class Support

Uber Class Support
body
rules
string or list of stringsOS platform(s) covered by rule. Supports comma delimited strings.
Overridden if rules keyword is provided.
protocol
Service Class Support

Uber Class Support
body
rules
integerProtocol specified by rule (Integer identifier).
Overridden if rules keyword is provided.
remote_address
Service Class Support

Uber Class Support
body
rules
dictionary or list of dictionariesRemote address and netmask detail.
Overridden if rules keyword is provided.
remote_port
Service Class Support

Uber Class Support
body
rules
dictionary or list of dictionariesRemote port range.
Overridden if rules keyword is provided.
rule_description
Service Class Support

Uber Class Support
body
rules
stringRule description.
Overridden if rules keyword is provided.
rule_enabled
Service Class Support

Uber Class Support
body
rules
booleanEnablement status for the new rule.
Overridden if rules keyword is provided.
rule_name
Service Class Support

Uber Class Support
body
rules
stringRule name.
Overridden if rules keyword is provided.
rules
Service Class Support

Uber Class Support
bodydictionary or list of dictionariesRule(s) in JSON format.
temp_id
Service Class Support

Uber Class Support
body
rules
stringString to use for temporary rule ID.
Overridden if rules keyword is provided.

Usage

Service class example (PEP8 / Operation ID syntax)
from falconpy import FirewallManagement

# Do not hardcode API credentials!
falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

new_rule = {
    "action": "string",
    "address_family": "string",
    "description": "string",
    "direction": "string",
    "enabled": boolean,
    "fields": [
        {
            "final_value": "string",
            "label": "string",
            "name": "string",
            "type": "string",
            "value": "string",
            "values": [
                "string"
            ]
        }
    ],
    "icmp": {
        "icmp_code": "string",
        "icmp_type": "string"
    },
    "local_address": [
        {
            "address": "string",
            "netmask": integer
        }
    ],
    "local_port": [
        {
            "end": integer,
            "start": integer
        }
    ],
    "log": boolean,
    "monitor": {
        "count": "string",
        "period_ms": "string"
    },
    "name": "string",
    "platform_ids": [
        "string"
    ],
    "protocol": "string",
    "remote_address": [
        {
            "address": "string",
            "netmask": integer
        }
    ],
    "remote_port": [
        {
            "end": integer,
            "start": integer
        }
    ],
    "temp_id": "string"
}

response = falcon.create_rule_group(clone_id="string",
                                    library="string",
                                    comment="string",
                                    description="string",
                                    enabled=boolean,
                                    name="string",
                                    rules=new_rule
                                    )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

new_rule = {
    "action": "string",
    "address_family": "string",
    "description": "string",
    "direction": "string",
    "enabled": boolean,
    "fields": [
        {
            "final_value": "string",
            "label": "string",
            "name": "string",
            "type": "string",
            "value": "string",
            "values": [
                "string"
            ]
        }
    ],
    "icmp": {
        "icmp_code": "string",
        "icmp_type": "string"
    },
    "local_address": [
        {
            "address": "string",
            "netmask": integer
        }
    ],
    "local_port": [
        {
            "end": integer,
            "start": integer
        }
    ],
    "log": boolean,
    "monitor": {
        "count": "string",
        "period_ms": "string"
    },
    "name": "string",
    "platform_ids": [
        "string"
    ],
    "protocol": "string",
    "remote_address": [
        {
            "address": "string",
            "netmask": integer
        }
    ],
    "remote_port": [
        {
            "end": integer,
            "start": integer
        }
    ],
    "temp_id": "string"
}

BODY = {
    "description": "string",
    "enabled": boolean,
    "name": "string",
    "rules": [new_rule]
}

response = falcon.command("create_rule_group",
                          body=BODY,
                          clone_id="string",
                          library="string",
                          comment="string"
                          )
print(response)

delete_rule_groups

Delete rule group entities by ID

PEP8 method name

delete_rule_groups

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
comment
Service Class Support

Uber Class Support
querystring or list of stringsAudit log comment for this operation.
ids
Service Class Support

Uber Class Support
querystring or list of stringsThe rules to retrieve, identified by ID.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 / Operation ID syntax)
from falconpy import FirewallManagement

# Do not hardcode API credentials!
falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_rule_groups(comment="string", ids=id_list)
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("delete_rule_groups", comment="string", ids=id_list)
print(response)

update_rule_group

Update name, description, or enabled status of a rule group, or create, edit, delete, or reorder rules

PEP8 method name

update_rule_group

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format.
comment
Service Class Support

Uber Class Support
querystringAudit log comment for this action.
diff_from
Service Class Support

Uber Class Support
body
diff_operations
stringFrom value for the diff.
Overridden if diff_operations keyword is provided.
diff_op
Service Class Support

Uber Class Support
body
diff_operations
stringOperation for the diff.
Overridden if diff_operations keyword is provided.
diff_operations
Service Class Support

Uber Class Support
bodydictionary or list of dictionariesDifferential operations to perform against the rule group.
diff_path
Service Class Support

Uber Class Support
body
diff_operations
stringPath for the diff.
Overridden if diff_operations keyword is provided.
diff_type
Service Class Support

Uber Class Support
bodystringType of diff to apply.
id
Service Class Support

Uber Class Support
bodystringID of the rule group to update.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
rule_ids
Service Class Support

Uber Class Support
bodylist of stringsRule ID(s) to add to the rule group.
rule_versions
Service Class Support

Uber Class Support
bodylist of integersRule group versions.
tracking
Service Class Support

Uber Class Support
bodystringTracking.

Usage

Service class example (PEP8 / Operation ID syntax)
from falconpy import FirewallManagement

# Do not hardcode API credentials!
falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

rules = ['ID1', 'ID2', 'ID3']
versions = [1, 2, 3]
diffs = {
    "from": "string",
    "op": "string",
    "path": "string"
}

response = falcon.update_rule_group(comment="string",
                                    diff_operations=diffs,
                                    diff_type="string",
                                    id="string",
                                    rule_ids=rules,
                                    rule_versions=versions,
                                    tracking="string"
                                    )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

rules = ['ID1', 'ID2', 'ID3']
versions = [1, 2, 3]
diffs = {
    "from": "string",
    "op": "string",
    "path": "string"
}

BODY = {
    "diff_operations": [diffs],
    "diff_type": "string",
    "id": "string",
    "rule_ids": rules,
    "rule_versions": versions,
    "tracking": "string"
}

response = falcon.command("update_rule_group",
                          comments="string",
                          body=BODY
                          )
print(response)

get_rules

Get rule entities by ID (64-bit unsigned int as decimal string) or Family ID (32-character hexadecimal string)

PEP8 method name

get_rules

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
ids
Service Class Support

Uber Class Support
querystring or list of stringsThe rules to retrieve, identified by ID.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 / Operation ID syntax)
from falconpy import FirewallManagement

# Do not hardcode API credentials!
falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rules(ids=id_list)
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_rules", ids=id_list)
print(response)

query_events

Find all event IDs matching the query with filter

PEP8 method name

query_events

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
after
Service Class Support

Uber Class Support
querystringA pagination token used with the limit parameter to manage pagination of results. On your first request, don't provide an after token. On subsequent requests, provide the after token from the previous response to continue from that place in the results. To access more than 10k indicators, use the after parameter instead of offset.
filter
Service Class Support

Uber Class Support
querystringFQL Syntax formatted filter that should be used to limit the results.
limit
Service Class Support

Uber Class Support
queryintegerMaximum number of results to return.
offset
Service Class Support

Uber Class Support
queryintegerThe offset to start retrieving records from. Offset and After params are mutually exclusive. If none provided then scrolling will be used by default. To access more than 10k iocs, use the after parameter instead of offset.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
q
Service Class Support

Uber Class Support
querystringFree text search across all indexed fields.
sort
Service Class Support

Uber Class Support
querystringFQL Syntax formatted sort filter.

Usage

Service class example (PEP8 / Operation ID syntax)
from falconpy import FirewallManagement

# Do not hardcode API credentials!
falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.query_events(sort="string",
                               filter="string",
                               q="string",
                               offset=integer,
                               after="string",
                               limit=integer
                               )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("query_events",
                          sort="string",
                          filter="string",
                          q="string",
                          offset=integer,
                          after="string",
                          limit=integer
                          )
print(response)

query_firewall_fields

Get the firewall field specification IDs for the provided platform

PEP8 method name

query_firewall_fields

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
limit
Service Class Support

Uber Class Support
queryintegerMaximum number of results to return.
offset
Service Class Support

Uber Class Support
queryintegerThe offset to start retrieving records from. Offset and After params are mutually exclusive. If none provided then scrolling will be used by default. To access more than 10k iocs, use the after parameter instead of offset.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
platform_id
Service Class Support

Uber Class Support
querystringField configurations specific to this platform.

Usage

Service class example (PEP8 / Operation ID syntax)
from falconpy import FirewallManagement

# Do not hardcode API credentials!
falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.query_firewall_fields(platform_id="string",
                                        offset=integer,
                                        limit=integer
                                        )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("query_firewall_fields", 
                          platform_id="string",
                          limit=integer,
                          offset=integer
                          )
print(response)

query_platforms

Get the list of platform names

PEP8 method name

query_platforms

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
limit
Service Class Support

Uber Class Support
queryintegerMaximum number of results to return.
offset
Service Class Support

Uber Class Support
queryintegerThe offset to start retrieving records from. Offset and After params are mutually exclusive. If none provided then scrolling will be used by default. To access more than 10k iocs, use the after parameter instead of offset.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 / Operation ID syntax)
from falconpy import FirewallManagement

# Do not hardcode API credentials!
falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.query_platforms(offset=integer, limit=integer)
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("query_platforms", limit=integer, offset=integer)
print(response)

query_policy_rules

Find all firewall rule IDs matching the query with filter, and return them in precedence order

PEP8 method name

query_policy_rules

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
after
Service Class Support

Uber Class Support
querystringA pagination token used with the limit parameter to manage pagination of results. On your first request, don't provide an after token. On subsequent requests, provide the after token from the previous response to continue from that place in the results. To access more than 10k indicators, use the after parameter instead of offset.
filter
Service Class Support

Uber Class Support
querystringFQL Syntax formatted filter that should be used to limit the results.
id
Service Class Support

Uber Class Support
querystringThe ID of the policy container within which to query.
limit
Service Class Support

Uber Class Support
queryintegerMaximum number of results to return.
offset
Service Class Support

Uber Class Support
queryintegerThe offset to start retrieving records from. Offset and After params are mutually exclusive. If none provided then scrolling will be used by default. To access more than 10k iocs, use the after parameter instead of offset.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
q
Service Class Support

Uber Class Support
querystringFree text search across all indexed fields.
sort
Service Class Support

Uber Class Support
querystringFQL Syntax formatted sort filter.

Usage

Service class example (PEP8 / Operation ID syntax)
from falconpy import FirewallManagement

# Do not hardcode API credentials!
falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.query_policy_rules(id="string",
                                     sort="string",
                                     filter="string",
                                     q="string",
                                     offset=integer,
                                     limit=integer,
                                     after="string"
                                     )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("query_policy_rules",
                          id="string",
                          sort="string",
                          filter="string",
                          q="string",
                          offset=integer,
                          limit=integer,
                          after="string"
                          )
print(response)

query_rule_groups

Find all rule group IDs matching the query with filter

PEP8 method name

query_rule_groups

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
after
Service Class Support

Uber Class Support
querystringA pagination token used with the limit parameter to manage pagination of results. On your first request, don't provide an after token. On subsequent requests, provide the after token from the previous response to continue from that place in the results. To access more than 10k indicators, use the after parameter instead of offset.
filter
Service Class Support

Uber Class Support
querystringFQL Syntax formatted filter that should be used to limit the results.
limit
Service Class Support

Uber Class Support
queryintegerMaximum number of results to return.
offset
Service Class Support

Uber Class Support
queryintegerThe offset to start retrieving records from. Offset and After params are mutually exclusive. If none provided then scrolling will be used by default. To access more than 10k iocs, use the after parameter instead of offset.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
q
Service Class Support

Uber Class Support
querystringFree text search across all indexed fields.
sort
Service Class Support

Uber Class Support
querystringFQL Syntax formatted sort filter.

Usage

Service class example (PEP8 / Operation ID syntax)
from falconpy import FirewallManagement

# Do not hardcode API credentials!
falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.query_rule_groups(sort="string",
                                    filter="string",
                                    q="string",
                                    offset="string",
                                    after="string",
                                    limit=integer
                                    )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("query_rule_groups",
                          sort="string",
                          filter="string",
                          q="string",
                          offset="string",
                          after="string",
                          limit=integer
                          )
print(response)

query_rules

Find all rule IDs matching the query with filter

PEP8 method name

query_rules

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
after
Service Class Support

Uber Class Support
querystringA pagination token used with the limit parameter to manage pagination of results. On your first request, don't provide an after token. On subsequent requests, provide the after token from the previous response to continue from that place in the results. To access more than 10k indicators, use the after parameter instead of offset.
filter
Service Class Support

Uber Class Support
querystringFQL Syntax formatted filter that should be used to limit the results.
limit
Service Class Support

Uber Class Support
queryintegerMaximum number of results to return.
offset
Service Class Support

Uber Class Support
queryintegerThe offset to start retrieving records from. Offset and After params are mutually exclusive. If none provided then scrolling will be used by default. To access more than 10k iocs, use the after parameter instead of offset.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
q
Service Class Support

Uber Class Support
querystringFree text search across all indexed fields.
sort
Service Class Support

Uber Class Support
querystringFQL Syntax formatted sort filter.

Usage

Service class example (PEP8 / Operation ID syntax)
from falconpy import FirewallManagement

# Do not hardcode API credentials!
falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.query_rules(sort="string",
                              filter="string",
                              q="string",
                              offset=integer,
                              after="string",
                              limit=integer
                              )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("query_rules",
                          sort="string",
                          filter="string",
                          q="string",
                          offset=integer,
                          after="string",
                          limit=integer
                          )
print(response)