CrowdStrike Falcon CrowdStrike Subreddit

Using the Real Time Response Admin service collection

Uber class support Service class support Documentation Version Page Updated Samples Available

This service collection has code examples posted to the repository.

Table of Contents

Operation IDDescription
BatchAdminCmd
PEP 8batch_admin_command
Batch executes a RTR administrator command across the hosts mapped to the given batch ID.
RTR_CheckAdminCommandStatus
PEP 8check_admin_command_status
Get status of an executed RTR administrator command on a single host.
RTR_ExecuteAdminCommand
PEP 8execute_admin_command
Execute a RTR administrator command on a single host.
RTR_GetFalconScripts
PEP8get_falcon_scripts
Get Falcon scripts with metadata and content of script
RTR_GetPut_Files
PEP 8get_put_files
Get put-files based on the ID's given. These are used for the RTR put command.
RTR_GetPut_FilesV2
PEP 8get_put_files_v2
Get put-files based on the ID's given. These are used for the RTR put command.
RTR_CreatePut_Files
PEP 8create_put_files
Upload a new put-file to use for the RTR put command.
RTR_DeletePut_Files
PEP 8delete_put_files
Delete a put-file based on the ID given. Can only delete one file at a time.
RTR_GetScripts
PEP 8get_scripts
Get custom-scripts based on the ID's given. These are used for the RTR runscript command.
RTR_GetScriptsV2
PEP 8get_scripts_v2
Get custom-scripts based on the ID's given. These are used for the RTR runscript command.
RTR_ListFalconScripts
PEP8list_falcon_scripts
Get a list of Falcon script IDs available to the user to run
RTR_CreateScripts
PEP 8create_scripts
Upload a new custom-script to use for the RTR runscript command.
RTR_DeleteScripts
PEP 8delete_scripts
Delete a custom-script based on the ID given. Can only delete one script at a time.
RTR_UpdateScripts
PEP 8update_scripts
Upload a new scripts to replace an existing one.
RTR_ListPut_Files
PEP 8list_put_files
Get a list of put-file ID's that are available to the user for the put command.
RTR_ListScripts
PEP 8list_scripts
Get a list of custom-script ID's that are available to the user for the runscript command.

Passing credentials

WARNING

client_id and client_secret are keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

BatchAdminCmd

Batch executes a RTR administrator command across the hosts mapped to the given batch ID.

PEP8 method name

batch_admin_command

Endpoint

MethodRoute
POST/real-time-response/combined/batch-admin-command/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format.
base_command
Service Class Support

Uber Class Support
bodystringActive Responder base command to perform. For example: get or cp. Refer to this list for a complete listing of available commands.
batch_id
Service Class Support

Uber Class Support
bodystringRTR Batch ID to execute the command against. Received from batch_init_session.
command_string
Service Class Support

Uber Class Support
bodystringFull command line of the command to execute. Example: get some_file.txt.
host_timeout_duration
Service Class Support

Uber Class Support
querystringTimeout duration for for how long a host has to complete processing in duration syntax. Example, 10s. Valid units: ns, us, ms, s, m, h. Maximum is 10 minutes.
optional_hosts
Service Class Support

Uber Class Support
bodystring or list of stringsList of the subset of hosts we want to impact by this command. Allows for filtering of hosts from execution within the same batch.
persist_all
Service Class Support

Uber Class Support
bodybooleanFlag indicating if this command should be executed when the host returns to service.
timeout
Service Class Support

Uber Class Support
queryintegerTimeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 10 minutes.
timeout_duration
Service Class Support

Uber Class Support
querystringTimeout duration for for how long to wait for the request in duration syntax. Example, 10s. Valid units: ns, us, ms, s, m, h. Maximum is 10 minutes.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
Available base commands
Command Description Operating System
catView file contentsAll supported
cdChange directoryAll supported
clearClear the screenAll supported
cpCopy a fileAll supported
csrutilGet system integrity protection statusMacOS
encryptEncrypt a fileAll supported
envDisplay environment variablesAll supported
eventlogInspect the event log.

Subcommands:
  • list
  • view
  • export
  • backup
eventlog backup is the recommended solution as opposed to eventlog export, as this method is faster and follows industry-standard file format.
Windows
filehashCalculate a file hash (MD5 or SHA256)All supported
getRetrieve a fileAll supported
getsidRetrieve the current SIDWindows MacOS
helpAccess help for a specific command or sub-commandAll supported
historyReview command history for the current userAll supported
ifconfigReview TCP configurationLinux MacOS
ipconfigReview TCP configurationWindows
killKill a running processAll supported
lsList the contents of a directoryAll supported
mapMap a UNC (SMB) path to a drive letterWindows
memdumpDump memory of a running processWindows
mkdirCreate a directoryAll supported
mountMount a file system (MacOS, Linux) or list available drives (Windows)All supported
mvMove a fileAll supported
netstatRetrieve network connection detailAll supported
psList running processesAll supported
putPut a file onto a remote hostWindows MacOS
put-and-runPut a file onto a remote host and then execute it. The put-and-run command reduces the potential for user error in file selection by ensuring that the file ‘put’ on the host is the same file that is ‘run’ on the host.Windows Linux MacOS
regRegistry operations.

Subcommands:
  • query - Query the registry
  • set - Set a registry key or value
  • delete - Delete a registry key or value
  • load - Load a registry hive
  • unload - Unload a registry hive
Windows
restartRestart the systemAll supported
rmRemove a fileAll supported
runRun an executableAll supported
runscriptRun a scriptAll supported
shutdownShutdown the systemAll supported
tarCompress a file or directory into a tar fileLinux
unmapUnmap a UNC (SMB) path from a drive letterWindows
unmountUnmount a file systemLinux MacOS
updateInstall patches through Windows Update.

Subcommands:
  • history - Check update history for this host
  • install - Installs a patch by specifying the KB ID. 'Optional' KBs are not available.
  • list - show all available updates for this host
  • query - Show metadata about a specific KB
Windows
usersGet details about local usersLinux MacOS
xmemdumpDump complete memory (kernel) for the systemWindows
zipCreate a zip archiveAll supported

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

target_hosts = ["ID1", "ID2", "ID3"]

response = falcon.batch_admin_command(base_command="string",
                                      batch_id="string",
                                      command_string="string",
                                      optional_hosts=target_hosts,
                                      persist_all=boolean,
                                      timeout=integer,
                                      timeout_duration="string"
                                      )
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

target_hosts = ["ID1", "ID2", "ID3"]

response = falcon.BatchAdminCmd(base_command="string",
                                batch_id="string",
                                command_string="string",
                                optional_hosts=target_hosts,
                                persist_all=boolean,
                                timeout=integer,
                                timeout_duration="string"
                                )
print(response)

Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

target_hosts = ["ID1", "ID2", "ID3"]

BODY = {
  "base_command": "string",
  "batch_id": "string",
  "command_string": "string",
  "optional_hosts": target_hosts,
  "persist_all": true
}

response = falcon.command("BatchAdminCmd",
                          timeout=integer,
                          timeout_duration="string",
                          body=BODY
                          )
print(response)

Back to Table of Contents

RTR_CheckAdminCommandStatus

Get status of an executed RTR administrator command on a single host.

PEP8 method name

check_admin_command_status

Endpoint

MethodRoute
GET/real-time-response/entities/admin-command/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
cloud_request_id
Service Class Support

Uber Class Support
querystringCloud Request ID of the executed command to query.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
sequence_id
Service Class Support

Uber Class Support
queryintegerSequence ID that we want to retrieve. Command responses are chunked across sequences.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.check_admin_command_status(cloud_request_id="string", sequence_id=integer)
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.RTR_CheckAdminCommandStatus(cloud_request_id="string", sequence_id=integer)
print(response)

Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_CheckAdminCommandStatus",
                          cloud_request_id="string",
                          sequence_id=integer
                          )
print(response)

Back to Table of Contents

RTR_ExecuteAdminCommand

Execute a RTR administrator command on a single host.

PEP8 method name

execute_admin_command

Endpoint

MethodRoute
POST/real-time-response/entities/admin-command/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format.
base_command
Service Class Support

Uber Class Support
bodystringActive Responder base command to perform. For example: get or cp. Refer to this list for a complete listing of available commands.
session_id
Service Class Support

Uber Class Support
bodystringRTR Session ID to execute the command against. Received from init_session.
command_string
Service Class Support

Uber Class Support
bodystringFull command line of the command to execute. Example: get some_file.txt.
persist
Service Class Support

Uber Class Support
bodybooleanFlag indicating if this command should be executed when the host returns to service.
Available base commands
Command Description Operating System
catView file contentsAll supported
cdChange directoryAll supported
clearClear the screenAll supported
cpCopy a fileAll supported
csrutilGet system integrity protection statusMacOS
encryptEncrypt a fileAll supported
envDisplay environment variablesAll supported
eventlogInspect the event log.

Subcommands:
  • list
  • view
  • export
  • backup
eventlog backup is the recommended solution as opposed to eventlog export, as this method is faster and follows industry-standard file format.
Windows
filehashCalculate a file hash (MD5 or SHA256)All supported
getRetrieve a fileAll supported
getsidRetrieve the current SIDWindows MacOS
helpAccess help for a specific command or sub-commandAll supported
historyReview command history for the current userAll supported
ifconfigReview TCP configurationLinux MacOS
ipconfigReview TCP configurationWindows
killKill a running processAll supported
lsList the contents of a directoryAll supported
mapMap a UNC (SMB) path to a drive letterWindows
memdumpDump memory of a running processWindows
mkdirCreate a directoryAll supported
mountMount a file system (MacOS, Linux) or list available drives (Windows)All supported
mvMove a fileAll supported
netstatRetrieve network connection detailAll supported
psList running processesAll supported
put-and-runPut a file onto a remote host and then execute it. The put-and-run command reduces the potential for user error in file selection by ensuring that the file ‘put’ on the host is the same file that is ‘run’ on the host.Windows Linux MacOS
regRegistry operations.

Subcommands:
  • query - Query the registry
  • set - Set a registry key or value
  • delete - Delete a registry key or value
  • load - Load a registry hive
  • unload - Unload a registry hive
Windows
restartRestart the systemAll supported
rmRemove a fileAll supported
runRun an executableAll supported
runscriptRun a scriptAll supported
shutdownShutdown the systemAll supported
tarCompress a file or directory into a tar fileLinux
unmapUnmap a UNC (SMB) path from a drive letterWindows
unmountUnmount a file systemLinux MacOS
updateInstall patches through Windows Update.

Subcommands:
  • history - Check update history for this host
  • install - Installs a patch by specifying the KB ID. 'Optional' KBs are not available.
  • list - show all available updates for this host
  • query - Show metadata about a specific KB
Windows
usersGet details about local usersLinux MacOS
xmemdumpDump complete memory (kernel) for the systemWindows
zipCreate a zip archiveAll supported

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.execute_admin_command(base_command="string",
                                        session_id="string",
                                        command_string="string",
                                        persist=boolean
                                        )
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.RTR_ExecuteAdminCommand(base_command="string",
                                          session_id="string",
                                          command_string="string",
                                          persist=boolean
                                          )
print(response)

Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

target_hosts = ["ID1", "ID2", "ID3"]

BODY = {
  "base_command": "string",
  "command_string": "string",
  "persist": true,
  "session_id": "string"
}

response = falcon.command("RTR_ExecuteAdminCommand", body=BODY)
print(response)

Back to Table of Contents

RTR_GetFalconScripts

Get Falcon scripts with metadata and content of script

PEP8 method name

get_falcon_scripts

Endpoint

MethodRoute
GET/real-time-response/entities/falcon-scripts/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
ids
Service Class Support

Uber Class Support
queryarray (string)IDs of the Falcon scripts you want to retrieve

Usage

Service class example (PEP8 syntax)
from falconpy.real_time_response_admin import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_falcon_scripts(ids=id_list)

print(response)
Service class example (Operation ID syntax)
from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RTR_GetFalconScripts(ids=id_list)

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("RTR_GetFalconScripts", ids=id_list)

print(response)

Back to Table of Contents

RTR_GetPut_Files

Get put-files based on the ID's given. These are used for the RTR put command.

PEP8 method name

get_put_files

Endpoint

MethodRoute
GET/real-time-response/entities/put-files/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
ids
Service Class Support

Uber Class Support
querystring or list of stringsFile IDs.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_put_files(ids=id_list)
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RTR_GetPut_Files(ids=id_list)
print(response)

Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("RTR_GetPut_Files", ids=id_list)
print(response)

Back to Table of Contents

RTR_GetPut_FilesV2

Get put-files based on the ID's given. These are used for the RTR put command.

PEP8 method name

get_put_files_v2

Endpoint

MethodRoute
GET/real-time-response/entities/put-files/v2

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
ids
Service Class Support

Uber Class Support
querystring or list of stringsFile IDs.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_put_files_v2(ids=id_list)
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RTR_GetPut_FilesV2(ids=id_list)
print(response)

Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("RTR_GetPut_FilesV2", ids=id_list)
print(response)

Back to Table of Contents

RTR_CreatePut_Files

Upload a new put-file to use for the RTR put command.

PEP8 method name

create_put_files

Endpoint

MethodRoute
POST/real-time-response/entities/put-files/v1

Content-Type

  • Consumes: multipart/form-data
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
comments_for_audit_log
Service Class Support

Uber Class Support
formDatastringA descriptive comment for the audit log.
data
Service Class Support

Uber Class Support
formDatafileFull formData payload in JSON format.
description
Service Class Support

Uber Class Support
formDatastringFile description.
name
Service Class Support

Uber Class Support
formDatastringFile name (if different than actual file name).
files
Service Class Support

Uber Class Support
querylist of tuplesFile(s) to be uploaded.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

filename = "somefile.ext"
with open(filename, "rb") as upload_file:
    file_upload = [('file', ('MyPutFile', upload_file.read(), 'application/octet-stream'))]

response = falcon.create_put_files(comments_for_audit_log="string",
                                   description="string",
                                   name="string",
                                   files=file_upload
                                   )
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

filename = "somefile.ext"
with open(filename, "rb") as upload_file:
    file_upload = [('file', ('MyPutFile', upload_file.read(), 'application/octet-stream'))]

response = falcon.RTR_CreatePut_Files(comments_for_audit_log="string",
                                      description="string",
                                      name="string",
                                      files=file_upload
                                      )
print(response)

Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

PAYLOAD = {
    "description": "string",
    "name": "string",
    "comments_for_audit_log": "string"
}

filename = "somefile.ext"
with open(filename, "rb") as upload_file:
    file_upload = [('file', ('MyPutFile', upload_file.read(), 'application/octet-stream'))]

response = falcon.command("RTR_CreatePut_Files", data=PAYLOAD, files=file_upload)
print(response)

Back to Table of Contents

RTR_DeletePut_Files

Delete a put-file based on the ID given. Can only delete one file at a time.

PEP8 method name

delete_put_files

Endpoint

MethodRoute
DELETE/real-time-response/entities/put-files/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
ids
Service Class Support

Uber Class Support
querystring or list of stringsFile IDs.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_put_files(ids=id_list)
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RTR_DeletePut_Files(ids=id_list)
print(response)

Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("RTR_DeletePut_Files", ids=id_list)
print(response)

Back to Table of Contents

RTR_GetScripts

Get custom-scripts based on the ID's given. These are used for the RTR runscript command.

PEP8 method name

get_scripts

Endpoint

MethodRoute
GET/real-time-response/entities/scripts/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
ids
Service Class Support

Uber Class Support
querystring or list of stringsFile IDs.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_scripts(ids=id_list)
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RTR_GetScripts(ids=id_list)
print(response)

Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("RTR_GetScripts", ids=id_list)
print(response)

Back to Table of Contents

RTR_GetScriptsV2

Get custom-scripts based on the ID's given. These are used for the RTR runscript command.

PEP8 method name

get_scripts_v2

Endpoint

MethodRoute
GET/real-time-response/entities/scripts/v2

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
ids
Service Class Support

Uber Class Support
querystring or list of stringsFile IDs.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_scripts_v2(ids=id_list)
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RTR_GetScriptsV2(ids=id_list)
print(response)

Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("RTR_GetScriptsV2", ids=id_list)
print(response)

Back to Table of Contents

RTR_CreateScripts

Upload a new custom-script to use for the RTR runscript command.

PEP8 method name

create_scripts

Endpoint

MethodRoute
POST/real-time-response/entities/scripts/v1

Content-Type

  • Consumes: multipart/form-data
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
comments_for_audit_log
Service Class Support

Uber Class Support
formDatastringA descriptive comment for the audit log.
content
Service Class Support

Uber Class Support
formDatastringThe text contents you want to use for the script. Takes place of a file upload.
data
Service Class Support

Uber Class Support
formDatafileFull formData payload in JSON format.
description
Service Class Support

Uber Class Support
formDatastringFile description.
name
Service Class Support

Uber Class Support
formDatastringFile name (if different than actual file name).
permission_type
Service Class Support

Uber Class Support
formDatastringPermissions for the custom-script. Valid permission values include:
  • private - usable only by the user who upload it
  • group - usable by all RTR admins
  • public - usable by all active-responders and RTR admins
platform
Service Class Support

Uber Class Support
formDatalist of stringsPlatform for the script. Currently supports windows, mac, and linux. If no platform is provided, windows is assumed.
files
Service Class Support

Uber Class Support
querylist of tuplesFile(s) to be uploaded.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

filename = "somefile.ext"
with open(filename, "rb") as upload_file:
    file_upload = [('file', ('MyScript', upload_file.read(), 'application/script'))]

response = falcon.create_scripts(comments_for_audit_log="string",
                                 description="string",
                                 name="string",
                                 files=file_upload,
                                 platform=["string"],
                                 permission_type="string",
                                 content="string"
                                 )
print(response)
Service class example (Operation ID syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

filename = "somefile.ext"
with open(filename, "rb") as upload_file:
    file_upload = [('file', ('MyScript', upload_file.read(), 'application/script'))]

response = falcon.RTR_CreateScripts(comments_for_audit_log="string",
                                    description="string",
                                    name="string",
                                    files=file_upload,
                                    platform=["string"],
                                    permission_type="string",
                                    content="string"
                                    )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

PAYLOAD = {
    "description": "string",
    "name": "string",
    "comments_for_audit_log": "string",
    "permission_type": "string",
    "content": "string",
    "platform": [
       "string",
       "string"
    ]
}

filename = "somefile.ext"
with open(filename, "rb") as upload_file:
    file_upload = [('file', ('MyScript', upload_file.read(), 'application/script'))]

response = falcon.command("RTR_CreateScripts", data=PAYLOAD, files=file_upload)
print(response)

Back to Table of Contents

RTR_DeleteScripts

Delete a custom-script based on the ID given. Can only delete one script at a time.

PEP8 method name

delete_scripts

Endpoint

MethodRoute
DELETE/real-time-response/entities/scripts/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
ids
Service Class Support

Uber Class Support
querystring or list of stringsFile IDs.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_scripts(ids=id_list)
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RTR_DeleteScripts(ids=id_list)
print(response)

Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("RTR_DeleteScripts", ids=id_list)
print(response)

Back to Table of Contents

RTR_UpdateScripts

Upload a new scripts to replace an existing one.

PEP8 method name

update_scripts

Endpoint

MethodRoute
PATCH/real-time-response/entities/scripts/v1

Content-Type

  • Consumes: multipart/form-data
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
comments_for_audit_log
Service Class Support

Uber Class Support
formDatastringA descriptive comment for the audit log.
content
Service Class Support

Uber Class Support
formDatastringThe text contents you want to use for the script. Takes place of a file upload.
data
Service Class Support

Uber Class Support
formDatafileFull formData payload in JSON format.
description
Service Class Support

Uber Class Support
formDatastringFile description.
id
Service Class Support

Uber Class Support
formDatastringThe ID of the script to be updated.
name
Service Class Support

Uber Class Support
formDatastringFile name (if different than actual file name).
permission_type
Service Class Support

Uber Class Support
formDatastringPermissions for the custom-script. Valid permission values include:
  • private - usable only by the user who upload it
  • group - usable by all RTR admins
  • public - usable by all active-responders and RTR admins
platform
Service Class Support

Uber Class Support
formDatalist of stringsPlatform for the script. Currently supports windows, mac, and linux. If no platform is provided, windows is assumed.
files
Service Class Support

Uber Class Support
querylist of tuplesFile(s) to be uploaded.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

file_upload = [('file', ('file.ext', open('file.ext','rb').read(), 'application/script'))]

response = falcon.update_scripts(comments_for_audit_log="string",
                                 description="string",
                                 id="string",
                                 name="string",
                                 files=file_upload,
                                 platform=["string"],
                                 permission_type="string",
                                 content="string"
                                 )
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

file_upload = [('file', ('file.ext', open('file.ext','rb').read(), 'application/script'))]

response = falcon.RTR_UpdateScripts(comments_for_audit_log="string",
                                    description="string",
                                    id="string",
                                    name="string",
                                    files=file_upload,
                                    platform=["string"],
                                    permission_type="string",
                                    content="string"
                                    )
print(response)

Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

PAYLOAD = {
    "id": "string",
    "description": "string",
    "name": "string",
    "comments_for_audit_log": "string",
    "permission_type": "string",
    "content": "string",
    "platform": [
       "string",
       "string"
    ]
}

file_upload = [('file', ('file.ext', open('file.ext','rb').read(), 'application/script'))]

response = falcon.command("RTR_UpdateScripts", data=PAYLOAD, files=file_upload)
print(response)

Back to Table of Contents

RTR_ListFalconScripts

Get a list of Falcon script IDs available to the user to run

PEP8 method name

list_falcon_scripts

Endpoint

MethodRoute
GET/real-time-response/queries/falcon-scripts/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filter
Service Class Support

Uber Class Support
querystringOptional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
offset
Service Class Support

Uber Class Support
queryintegerStarting index of overall result set from which to return ids.
limit
Service Class Support

Uber Class Support
queryintegerNumber of ids to return.
sort
Service Class Support

Uber Class Support
querystringSort by spec. Ex: 'created_at

Usage

Service class example (PEP8 syntax)
from falconpy.real_time_response_admin import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.list_falcon_scripts(filter="string",
                                      offset=integer,
                                      limit=integer,
                                      sort="string"
                                      )
print(response)
Service class example (Operation ID syntax)
from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.RTR_ListFalconScripts(filter="string",
                                        offset=integer,
                                        limit=integer,
                                        sort="string"
                                        )
print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_ListFalconScripts",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string"
                          )
print(response)

Back to Table of Contents

RTR_ListPut_Files

Get a list of put-file ID's that are available to the user for the put command.

PEP8 method name

list_put_files

Endpoint

MethodRoute
GET/real-time-response/queries/put-files/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filter
Service Class Support

Uber Class Support
querystringFQL query expression that should be used to limit the results.

user_id can accept a special value ‘@me’ which will restrict results to records with current user’s ID.
limit
Service Class Support

Uber Class Support
queryintegerMaximum number of records to return.
offset
Service Class Support

Uber Class Support
querystringStarting index of overall result set from which to return ids.
sort
Service Class Support

Uber Class Support
querystringThe property to sort by.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.list_put_files(filter="string",
                                 offset="string",
                                 limit=integer,
                                 sort="string"
                                 )
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.RTR_ListPut_Files(filter="string",
                                    offset="string",
                                    limit=integer,
                                    sort="string"
                                    )
print(response)

Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_ListPut_Files",
                          filter="string",
                          offset="string",
                          limit=integer,
                          sort="string"
                          )
print(response)

Back to Table of Contents

RTR_ListScripts

Get a list of custom-script ID's that are available to the user for the runscript command.

PEP8 method name

list_scripts

Endpoint

MethodRoute
GET/real-time-response/queries/scripts/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filter
Service Class Support

Uber Class Support
querystringFQL query expression that should be used to limit the results.

user_id can accept a special value ‘@me’ which will restrict results to records with current user’s ID.
limit
Service Class Support

Uber Class Support
queryintegerMaximum number of records to return.
offset
Service Class Support

Uber Class Support
querystringStarting index of overall result set from which to return ids.
sort
Service Class Support

Uber Class Support
querystringThe property to sort by.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.list_scripts(filter="string",
                               offset="string",
                               limit=integer,
                               sort="string"
                               )
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponseAdmin

# Do not hardcode API credentials!
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.RTR_ListScripts(filter="string",
                                  offset="string",
                                  limit=integer,
                                  sort="string"
                                  )
print(response)

Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_ListScripts",
                          filter="string",
                          offset="string",
                          limit=integer,
                          sort="string"
                          )
print(response)

Back to Table of Contents