CrowdStrike Falcon Twitter URL

Using the Real Time Response service collection

Uber class support Service class support Documentation Version Page Updated Samples Available

This service collection has code examples posted to the repository.

Table of Contents

Operation IDDescription
RTR_AggregateSessions
PEP 8aggregate_sessions
Get aggregates on session data.
BatchActiveResponderCmd
PEP 8batch_active_responder_command
Batch executes a RTR active-responder command across the hosts mapped to the given batch ID.
BatchCmd
PEP 8batch_command
Batch executes a RTR read-only command across the hosts mapped to the given batch ID.
BatchGetCmdStatus
PEP 8batch_get_command_status
Retrieves the status of the specified batch get command. Will return successful files when they are finished processing.
BatchGetCmd
PEP 8batch_get_command
Batch executes get command across hosts to retrieve files. After this call is made BatchGetCmdStatusis used to query for the results.
BatchInitSessions
PEP 8batch_init_sessions
Batch initialize a RTR session on multiple hosts. Before any RTR commands can be used, an active session is needed on the host.
BatchRefreshSessions
PEP 8batch_refresh_sessions
Batch refresh a RTR session on multiple hosts. RTR sessions will expire after 10 minutes unless refreshed.
RTR_CheckActiveResponderCommandStatus
PEP 8check_active_responder_command_status
Get status of an executed active-responder command on a single host.
RTR_ExecuteActiveResponderCommand
PEP 8execute_active_responder_command
Execute an active responder command on a single host.
RTR_CheckCommandStatus
PEP 8check_command_status
Get status of an executed command on a single host.
RTR_ExecuteCommand
PEP 8execute_command
Execute a command on a single host.
RTR_GetExtractedFileContents
PEP 8get_extracted_file_contents
Get RTR extracted file contents for specified session and sha256.
RTR_ListFiles
PEP 8list_files
Get a list of files for the specified RTR session.
RTR_ListFilesV2
PEP 8list_files_v2
Get a list of files for the specified RTR session.
(Expanded output detail.)
RTR_DeleteFile
PEP 8delete_file
Delete a RTR session file.
RTR_DeleteFileV2
PEP 8delete_file_v2
Delete a RTR session file.
(Expanded output detail, use with RTR_ListFilesV2.)
RTR_ListQueuedSessions
PEP 8list_queued_sessions
Get queued session metadata by session ID.
RTR_DeleteQueuedSession
PEP 8delete_queued_session
Delete a queued session command
RTR_PulseSession
PEP 8pulse_session
Refresh a session timeout on a single host.
RTR_ListSessions
PEP 8list_sessions
Get session metadata by session id.
RTR_InitSession
PEP 8init_session
Initialize a new session with the RTR cloud.
RTR_DeleteSession
PEP 8delete_session
Delete a session.
RTR_ListAllSessions
PEP 8list_all_sessions
Get a list of session_ids.

Passing credentials

WARNING

client_id and client_secret are input variables that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

RTR_AggregateSessions

Get aggregates on session data.

PEP8 method name

aggregate_sessions

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format.
date_ranges
Service Class Support

Uber Class Support
bodylist of dictionaries
field
Service Class Support

Uber Class Support
bodystring
filter
Service Class Support

Uber Class Support
bodystringFQL syntax
interval
Service Class Support

Uber Class Support
bodystring
min_doc_count
Service Class Support

Uber Class Support
bodyintegerMinimum number of documents required to match.
missing
Service Class Support

Uber Class Support
bodystring
name
Service Class Support

Uber Class Support
bodystring
q
Service Class Support

Uber Class Support
bodystringFQL syntax
ranges
Service Class Support

Uber Class Support
bodylist of dictionaries
size
Service Class Support

Uber Class Support
bodyinteger
sort
Service Class Support

Uber Class Support
bodystringFQL syntax
time_zone
Service Class Support

Uber Class Support
bodystring
type
Service Class Support

Uber Class Support
bodystring

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.aggregate_sessions(date_ranges=date_ranges,
                                     field="string",
                                     filter="string",
                                     interval="string",
                                     min_doc_count=integer,
                                     missing="string",
                                     name="string",
                                     q="string",
                                     ranges=ranges,
                                     size=integer,
                                     sort="string",
                                     time_zone="string",
                                     type="string"
                                     )

print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.RTR_AggregateSessions(date_ranges=date_ranges,
                                        field="string",
                                        filter="string",
                                        interval="string",
                                        min_doc_count=integer,
                                        missing="string",
                                        name="string",
                                        q="string",
                                        ranges=ranges,
                                        size=integer,
                                        sort="string",
                                        time_zone="string",
                                        type="string"
                                        )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )
date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

BODY = {
    "date_ranges": date_ranges,
    "field": "string",
    "filter": "string",
    "interval": "string",
    "min_doc_count": 0,
    "missing": "string",
    "name": "string",
    "q": "string",
    "ranges": ranges,
    "size": 0,
    "sort": "string",
    "time_zone": "string",
    "type": "string"
}

response = falcon.command("RTR_AggregateSessions", body=BODY)
print(response)

BatchActiveResponderCmd

Batch executes a RTR active-responder command across the hosts mapped to the given batch ID.

PEP8 method name

batch_active_responder_command

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format.
base_command
Service Class Support

Uber Class Support
bodystringActive Responder base command to perform. For example: get or cp. Refer to this list for a complete listing of available commands.
batch_id
Service Class Support

Uber Class Support
bodystringRTR Batch ID to execute the command against. Received from batch_init_session.
command_string
Service Class Support

Uber Class Support
bodystringFull command line of the command to execute. Example: get some_file.txt.
host_timeout_duration
Service Class Support

Uber Class Support
bodystringTimeout duration for how long a host has time to complete processing. Default value is a bit less than the overall timeout value. It cannot be greater than the overall request timeout. Maximum is < 10 minutes. Example, 10s. Valid units: ns, us, ms, s, m, h.
optional_hosts
Service Class Support

Uber Class Support
bodystring or list of stringsList of the subset of hosts we want to impact by this command. Allows for filtering of hosts from execution within the same batch.
persist_all
Service Class Support

Uber Class Support
bodybooleanFlag indicating if this command should be executed when the host returns to service.
timeout
Service Class Support

Uber Class Support
queryintegerTimeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 10 minutes.
timeout_duration
Service Class Support

Uber Class Support
querystringTimeout duration for for how long to wait for the request in duration syntax. Example, 10s. Valid units: ns, us, ms, s, m, h. Maximum is 10 minutes.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
Available base commands
Command Description Operating System
catView file contentsAll supported
cdChange directoryAll supported
clearClear the screenAll supported
cpCopy a fileAll supported
encryptEncrypt a fileAll supported
envDisplay environment variablesAll supported
eventlogInspect the event log.

Subcommands:
  • list
  • view
  • export
  • backup
eventlog backup is the recommended solution as opposed to eventlog export, as this method is faster and follows industry-standard file format.
Windows
filehashCalculate a file hash (MD5 or SHA256)All supported
getRetrieve a fileAll supported
getsidRetrieve the current SIDWindows MacOS
helpAccess help for a specific command or sub-commandAll supported
historyReview command history for the current userAll supported
ipconfigReview TCP configurationWindows
killKill a running processAll supported
lsList the contents of a directoryAll supported
mapMap a UNC (SMB) path to a drive letterWindows
memdumpDump memory of a running processWindows
mkdirCreate a directoryAll supported
mountMount a file system (MacOS, Linux) or list available drives (Windows)All supported
mvMove a fileAll supported
netstatRetrieve network connection detailAll supported
psList running processesAll supported
regRegistry operations.

Subcommands:
  • query - Query the registry
  • set - Set a registry key or value
  • delete - Delete a registry key or value
  • load - Load a registry hive
  • unload - Unload a registry hive
Windows
restartRestart the systemAll supported
rmRemove a fileAll supported
runscriptRun a scriptAll supported
shutdownShutdown the systemAll supported
unmapUnmap a UNC (SMB) path from a drive letterWindows
updateInstall patches through Windows Update.

Subcommands:
  • history - Check update history for this host
  • install - Installs a patch by specifying the KB ID. 'Optional' KBs are not available.
  • list - show all available updates for this host
  • query - Show metadata about a specific KB
Windows
xmemdumpDump complete memory (kernel) for the systemWindows
zipCreate a zip archiveAll supported

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

target_hosts = ["ID1", "ID2", "ID3"]

response = falcon.batch_active_responder_command(base_command="string",
                                                 batch_id="string",
                                                 command_string="string",
                                                 optional_hosts=target_hosts,
                                                 persist_all=boolean,
                                                 timeout=integer,
                                                 timeout_duration="string"
                                                 )
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

target_hosts = ["ID1", "ID2", "ID3"]

response = falcon.BatchActiveResponderCmd(base_command="string",
                                          batch_id="string",
                                          command_string="string",
                                          optional_hosts=target_hosts,
                                          persist_all=boolean,
                                          timeout=integer,
                                          timeout_duration="string"
                                          )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

target_hosts = ["ID1", "ID2", "ID3"]

BODY = {
    "base_command": "string",
    "batch_id": "string",
    "command_string": "string",
    "optional_hosts": target_hosts,
    "persist_all": boolean
}

response = falcon.command("BatchActiveResponderCmd",
                          timeout=integer,
                          timeout_duration="string",
                          body=BODY
                          )
print(response)

BatchCmd

Batch executes a RTR read-only command across the hosts mapped to the given batch ID.

PEP8 method name

batch_command

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format.
base_command
Service Class Support

Uber Class Support
bodystringActive Responder base command to perform. For example: get or cp. Refer to this list for a complete listing of available commands.
batch_id
Service Class Support

Uber Class Support
bodystringRTR Batch ID to execute the command against. Received from batch_init_session.
command_string
Service Class Support

Uber Class Support
bodystringFull command line of the command to execute. Example: cat some_file.txt.
host_timeout_duration
Service Class Support

Uber Class Support
bodystringTimeout duration for how long a host has time to complete processing. Default value is a bit less than the overall timeout value. It cannot be greater than the overall request timeout. Maximum is < 10 minutes. Example, 10s. Valid units: ns, us, ms, s, m, h.
optional_hosts
Service Class Support

Uber Class Support
bodystring or list of stringsList of the subset of hosts we want to impact by this command. Allows for filtering of hosts from execution within the same batch.
persist_all
Service Class Support

Uber Class Support
bodybooleanFlag indicating if this command should be executed when the host returns to service.
timeout
Service Class Support

Uber Class Support
queryintegerTimeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 10 minutes.
timeout_duration
Service Class Support

Uber Class Support
querystringTimeout duration for for how long to wait for the request in duration syntax. Example, 10s. Valid units: ns, us, ms, s, m, h. Maximum is 10 minutes.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
Available base commands (Read only)
Command Description Operating System
catView file contentsAll supported
cdChange directoryAll supported
clearClear the screenAll supported
csrutilGet system integrity protection statusMacOS
envDisplay environment variablesAll supported
eventlogInspect the event log.

Subcommands:
  • list
  • view
Windows
filehashCalculate a file hash (MD5 or SHA256)All supported
getsidRetrieve the current SIDWindows MacOS
helpAccess help for a specific command or sub-commandAll supported
historyReview command history for the current userAll supported
ipconfigReview TCP configurationWindows
lsList the contents of a directoryAll supported
mountMount a file system (MacOS, Linux) or list available drives (Windows)All supported
netstatRetrieve network connection detailAll supported
psList running processesAll supported
regRegistry operations.

Subcommands:
  • query - Query the registry
Windows

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

target_hosts = ["ID1", "ID2", "ID3"]

response = falcon.batch_command(base_command="string",
                                batch_id="string",
                                command_string="string",
                                optional_hosts=target_hosts,
                                persist_all=boolean,
                                timeout=integer,
                                timeout_duration="string"
                                )
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

target_hosts = ["ID1", "ID2", "ID3"]

response = falcon.BatchCmd(base_command="string",
                           batch_id="string",
                           command_string="string",
                           optional_hosts=target_hosts,
                           persist_all=boolean,
                           timeout=integer,
                           timeout_duration="string"
                           )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

target_hosts = ["ID1", "ID2", "ID3"]

BODY = {
    "base_command": "string",
    "batch_id": "string",
    "command_string": "string",
    "optional_hosts": target_hosts,
    "persist_all": boolean
}

response = falcon.command("BatchCmd",
                          timeout=integer,
                          timeout_duration="string",
                          body=BODY
                          )
print(response)

BatchGetCmdStatus

Retrieves the status of the specified batch get command. Will return successful files when they are finished processing.

PEP8 method name

batch_get_command_status

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
batch_get_cmd_req_id
Service Class Support

Uber Class Support
querystringBatch Get Command Request ID (usually retrieved when making a call to BatchGetCmd).
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
timeout
Service Class Support

Uber Class Support
queryintegerTimeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 10 minutes.
timeout_duration
Service Class Support

Uber Class Support
querystringTimeout duration for for how long to wait for the request in duration syntax. Example, 10s. Valid units: ns, us, ms, s, m, h. Maximum is 10 minutes.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.batch_get_command_status(timeout=integer,
                                           timeout_duration="string",
                                           batch_get_cmd_req_id="string"
                                           )
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.BatchGetCmdStatus(timeout=integer,
                                    timeout_duration="string",
                                    batch_get_cmd_req_id="string"
                                    )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("BatchGetCmdStatus",
                          timeout=integer,
                          timeout_duration="string",
                          batch_get_cmd_req_id="string"
                          )
print(response)

BatchGetCmd

Batch executes a get command across hosts to retrieve files. After this call is made BatchGetCmdStatus is used to query for the results.

PEP8 method name

batch_get_command

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format.
batch_id
Service Class Support

Uber Class Support
bodystringRTR Batch ID to execute the get command against. Received from batch_init_session.
file_path
Service Class Support

Uber Class Support
bodystringFull path to the file that is to be retrieved from each host in the batch.
host_timeout_duration
Service Class Support

Uber Class Support
bodystringTimeout duration for how long a host has time to complete processing. Default value is a bit less than the overall timeout value. It cannot be greater than the overall request timeout. Maximum is < 10 minutes. Example, 10s. Valid units: ns, us, ms, s, m, h.
optional_hosts
Service Class Support

Uber Class Support
bodystring or list of stringsList of the subset of hosts we want to impact by this command. Allows for filtering of hosts from execution within the same batch.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
timeout
Service Class Support

Uber Class Support
queryintegerTimeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 10 minutes.
timeout_duration
Service Class Support

Uber Class Support
querystringTimeout duration for for how long to wait for the request in duration syntax. Example, 10s. Valid units: ns, us, ms, s, m, h. Maximum is 10 minutes.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

target_hosts = ["ID1", "ID2", "ID3"]

response = falcon.batch_get_command(batch_id="string",
                                    file_path="string",
                                    optional_hosts=target_hosts,
                                    timeout=integer,
                                    timeout_duration="string"
                                    )
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

target_hosts = ["ID1", "ID2", "ID3"]

response = falcon.BatchGetCmd(batch_id="string",
                              file_path="string",
                              optional_hosts=target_hosts,
                              timeout=integer,
                              timeout_duration="string"
                              )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

target_hosts = ["ID1", "ID2", "ID3"]

BODY = {
    "batch_id": "string",
    "file_path": "string",
    "optional_hosts": target_hosts
}

response = falcon.command("BatchGetCmd",
                          timeout=integer,
                          timeout_duration="string",
                          body=BODY
                          )
print(response)

BatchInitSessions

Batch initialize a RTR session on multiple hosts. Before any RTR commands can be used, an active session is needed on the host.

PEP8 method name

batch_init_sessions

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format.
existing_batch_id
Service Class Support

Uber Class Support
bodystringOptional existing RTR batch ID. Use this to initialize new hosts and add them to the existing batch.
host_ids
Service Class Support

Uber Class Support
bodystring or list of stringsList of host agent IDs to initialize a RTR session on.
host_timeout_duration
Service Class Support

Uber Class Support
bodystringTimeout duration for how long a host has time to complete processing. Default value is a bit less than the overall timeout value. It cannot be greater than the overall request timeout. Maximum is < 10 minutes. Example, 10s. Valid units: ns, us, ms, s, m, h.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
queue_offline
Service Class Support

Uber Class Support
bodybooleanFlag indicating if the command should be queued for execution when the host returns to service.
timeout
Service Class Support

Uber Class Support
queryintegerTimeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 10 minutes.
timeout_duration
Service Class Support

Uber Class Support
querystringTimeout duration for for how long to wait for the request in duration syntax. Example, 10s. Valid units: ns, us, ms, s, m, h. Maximum is 10 minutes.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

target_hosts = ["ID1", "ID2", "ID3"]

response = falcon.batch_init_sessions(existing_batch_id="string",
                                      host_ids=target_hosts,
                                      queue_offline=boolean,
                                      timeout=integer,
                                      timeout_duration="string"
                                      )
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

target_hosts = ["ID1", "ID2", "ID3"]

response = falcon.BatchInitSessions(existing_batch_id="string",
                                    host_ids=target_hosts,
                                    queue_offline=boolean,
                                    timeout=integer,
                                    timeout_duration="string"
                                    )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

target_hosts = ["ID1", "ID2", "ID3"]

BODY = {
    "existing_batch_id": "string",
    "host_ids": target_hosts,
    "queue_offline": boolean
}

response = falcon.command("BatchInitSessions",
                          timeout=integer,
                          timeout_duration="string"
                          body=BODY
                          )
print(response)

BatchRefreshSessions

Batch refresh a RTR session on multiple hosts. RTR sessions will expire after 10 minutes unless refreshed.

PEP8 method name

batch_refresh_sessions

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format.
batch_id
Service Class Support

Uber Class Support
bodystringExisting RTR batch ID to refresh.
host_to_remove
Service Class Support

Uber Class Support
bodystring or list of stringsList of host agent IDs to remove from the batch.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
timeout
Service Class Support

Uber Class Support
queryintegerTimeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 10 minutes.
timeout_duration
Service Class Support

Uber Class Support
querystringTimeout duration for for how long to wait for the request in duration syntax. Example, 10s. Valid units: ns, us, ms, s, m, h. Maximum is 10 minutes.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

remove_hosts = ["ID1", "ID2", "ID3"]

response = falcon.batch_refresh_sessions(batch_id="string",
                                         hosts_to_remove=remove_hosts,
                                         timeout=integer,
                                         timeout_duration="string"
                                         )
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

remove_hosts = ["ID1", "ID2", "ID3"]

response = falcon.BatchRefreshSessions(batch_id="string",
                                       hosts_to_remove=remove_hosts,
                                       timeout=integer,
                                       timeout_duration="string"
                                       )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

remove_hosts = ["ID1", "ID2", "ID3"]

BODY = {
    "batch_id": "string",
    "hosts_to_remove": remove_hosts
}

response = falcon.command("BatchRefreshSessions",
                          timeout=integer,
                          timeout_duration="string",
                          body=BODY
                          )
print(response)

RTR_CheckActiveResponderCommandStatus

Get status of an executed active-responder command on a single host.

PEP8 method name

check_active_responder_command_status

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
cloud_request_id
Service Class Support

Uber Class Support
querystringCloud Request ID of the executed command to query.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
sequence_id
Service Class Support

Uber Class Support
queryintegerSequence ID that we want to retrieve. Command responses are chunked across sequences.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.check_active_responder_command_status(cloud_request_id="string",
                                                        sequence_id=integer
                                                        )
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_CheckActiveResponderCommandStatus(cloud_request_id="string",
                                                        sequence_id=integer
                                                        )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("RTR_CheckActiveResponderCommandStatus",
                          cloud_request_id="string",
                          sequence_id=integer
                          )
print(response)

RTR_ExecuteActiveResponderCommand

Execute an active responder command on a single host.

PEP8 method name

execute_active_responder_command

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format.
base_command
Service Class Support

Uber Class Support
bodystringActive Responder base command to perform. For example: get or cp. Refer to this list for a complete listing of available commands.
command_string
Service Class Support

Uber Class Support
bodystringFull command line of the command to execute. Example: get some_file.txt.
persist
Service Class Support

Uber Class Support
bodybooleanFlag indicating if this command should be executed when the host returns to service. Unused
session_id
Service Class Support

Uber Class Support
bodystringRTR Session ID.
Available base commands
Command Description Operating System
catView file contentsAll supported
cdChange directoryAll supported
clearClear the screenAll supported
cpCopy a fileAll supported
encryptEncrypt a fileAll supported
envDisplay environment variablesAll supported
eventlogInspect the event log.

Subcommands:
  • list
  • view
  • export
  • backup
eventlog backup is the recommended solution as opposed to eventlog export, as this method is faster and follows industry-standard file format.
Windows
filehashCalculate a file hash (MD5 or SHA256)All supported
getRetrieve a fileAll supported
getsidRetrieve the current SIDWindows MacOS
helpAccess help for a specific command or sub-commandAll supported
historyReview command history for the current userAll supported
ipconfigReview TCP configurationWindows
killKill a running processAll supported
lsList the contents of a directoryAll supported
mapMap a UNC (SMB) path to a drive letterWindows
memdumpDump memory of a running processWindows
mkdirCreate a directoryAll supported
mountMount a file system (MacOS, Linux) or list available drives (Windows)All supported
mvMove a fileAll supported
netstatRetrieve network connection detailAll supported
psList running processesAll supported
regRegistry operations.

Subcommands:
  • query - Query the registry
  • set - Set a registry key or value
  • delete - Delete a registry key or value
  • load - Load a registry hive
  • unload - Unload a registry hive
Windows
restartRestart the systemAll supported
rmRemove a fileAll supported
runscriptRun a scriptAll supported
shutdownShutdown the systemAll supported
unmapUnmap a UNC (SMB) path from a drive letterWindows
updateInstall patches through Windows Update.

Subcommands:
  • history - Check update history for this host
  • install - Installs a patch by specifying the KB ID. 'Optional' KBs are not available.
  • list - show all available updates for this host
  • query - Show metadata about a specific KB
Windows
xmemdumpDump complete memory (kernel) for the systemWindows
zipCreate a zip archiveAll supported

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.execute_active_responder_command(base_command="string",
                                                   command_string="string",
                                                   persist=boolean,
                                                   session_id="string",
                                                   timeout=integer,
                                                   timeout_duraction="string"
                                                   )
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_ExecuteActiveResponderCommand(base_command="string",
                                                    command_string="string",
                                                    persist=boolean,
                                                    session_id="string",
                                                    timeout=integer,
                                                    timeout_duraction="string"
                                                    )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

BODY = {
    "base_command": "string",
    "command_string": "string",
    "persist": boolean,
    "session_id": "string"
}

response = falcon.command("RTR_ExecuteActiveResponderCommand",
                          timeout=integer,
                          timeout_duration="string",
                          body=BODY
                          )
print(response)

RTR_CheckCommandStatus

Get status of an executed command on a single host.

PEP8 method name

check_command_status

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
cloud_request_id
Service Class Support

Uber Class Support
querystringCloud Request ID of the executed command to query.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
sequence_id
Service Class Support

Uber Class Support
queryintegerSequence ID that we want to retrieve. Command responses are chunked across sequences.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.check_command_status(cloud_request_id="string", sequence_id=integer)
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_CheckCommandStatus(cloud_request_id="string", sequence_id=integer)
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("RTR_CheckCommandStatus",
                          cloud_request_id="string",
                          sequence_id=integer
                          )
print(response)

RTR_ExecuteCommand

Execute a command on a single host.

PEP8 method name

execute_command

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format.
base_command
Service Class Support

Uber Class Support
bodystringRead-only base command to perform. For example: ls or ps. Refer to this list for a complete listing of available commands.
command_string
Service Class Support

Uber Class Support
bodystringFull command line of the command to execute. Example: cat some_file.txt.
persist
Service Class Support

Uber Class Support
bodybooleanFlag indicating if this command should be executed when the host returns to service.
session_id
Service Class Support

Uber Class Support
bodystringRTR Session ID to execute the command against.
Available base commands (Read only)
Command Description Operating System
catView file contentsAll supported
cdChange directoryAll supported
clearClear the screenAll supported
csrutilGet system integrity protection statusMacOS
envDisplay environment variablesAll supported
eventlogInspect the event log.

Subcommands:
  • list
  • view
Windows
filehashCalculate a file hash (MD5 or SHA256)All supported
getsidRetrieve the current SIDWindows MacOS
helpAccess help for a specific command or sub-commandAll supported
historyReview command history for the current userAll supported
ipconfigReview TCP configurationWindows
lsList the contents of a directoryAll supported
mountMount a file system (MacOS, Linux) or list available drives (Windows)All supported
netstatRetrieve network connection detailAll supported
psList running processesAll supported
regRegistry operations.

Subcommands:
  • query - Query the registry
Windows

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.execute_command(base_command="string",
                                  command_string="string",
                                  persist=boolean,
                                  session_id="string",
                                  )
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_ExecuteCommand(base_command="string",
                                     command_string="string",
                                     persist=boolean,
                                     session_id="string",
                                     )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

BODY = {
  "base_command": "string",
  "command_string": "string",
  "persist": true,
  "session_id": "string"
}

response = falcon.command("RTR_ExecuteCommand", body=BODY)
print(response)

RTR_GetExtractedFileContents

Get RTR extracted file contents for specified session and sha256.

PEP8 method name

get_extracted_file_contents

Content-Type

  • Produces: application/x-7z-compressed

Keyword Arguments

NameServiceUberTypeData typeDescription
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
filename
Service Class Support

Uber Class Support
querystringFilename to use for the archive name and the file within the archive.
session_id
Service Class Support

Uber Class Support
querystringRTR Session ID.
sha256
Service Class Support

Uber Class Support
querystringExtracted SHA256.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

save_file = "some_file.7z"

response = falcon.get_extracted_file_contents(session_id="string",
                                              sha256="string",
                                              filename="string"
                                              )
open(save_file, 'wb').write(response)
Service class example (Operation ID syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

save_file = "some_file.7z"

response = falcon.RTR_GetExtractedFileContents(session_id="string",
                                               sha256="string",
                                               filename="string"
                                               )
open(save_file, 'wb').write(response)
Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

save_file = "some_file.7z"

response = falcon.command("RTR_GetExtractedFileContents",
                          session_id="string",
                          sha256="string",
                          filename="string"
                          )

open(save_file, 'wb').write(response)

RTR_ListFiles

Get a list of files for the specified RTR session.

PEP8 method name

list_files

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
session_id
Service Class Support

Uber Class Support
querystringRTR Session ID.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.list_files(session_id="string")
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_ListFiles(session_id="string")
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("RTR_ListFiles", session_id="string")
print(response)

RTR_ListFilesV2

Get a list of files for the specified RTR session.

PEP8 method name

list_files_v2

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
session_id
Service Class Support

Uber Class Support
querystringRTR Session ID.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.list_files_v2(session_id="string")
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_ListFilesV2(session_id="string")
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("RTR_ListFilesV2", session_id="string")
print(response)

RTR_DeleteFile

Delete a RTR session file.

PEP8 method name

delete_file

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
ids
Service Class Support

Uber Class Support
querystringRTR Session file ID (SHA256).
session_id
Service Class Support

Uber Class Support
querystringRTR Session ID.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.delete_file(session_id="string", ids="string")
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_DeleteFile(session_id="string", ids="string")
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("RTR_DeleteFile", session_id="string", ids="string")
print(response)

RTR_DeleteFileV2

Delete a RTR session file.

PEP8 method name

delete_file_v2

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
ids
Service Class Support

Uber Class Support
querystringRTR Session file ID (SHA256).
session_id
Service Class Support

Uber Class Support
querystringRTR Session ID.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.delete_file_v2(session_id="string", ids="string")
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_DeleteFileV2(session_id="string", ids="string")
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("RTR_DeleteFileV2", session_id="string", ids="string")
print(response)

RTR_ListQueuedSessions

Get queued session metadata by session ID.

PEP8 method name

list_queued_sessions

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format.
ids
Service Class Support

Uber Class Support
bodystring or list of stringsList of RTR sessions to retrieve. Will only return sessions created by the calling user.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = "ID1,ID2,ID3"  # Can also use a list here ['ID1','ID2','ID3']

response = falcon.list_queued_sessions(ids=id_list)
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = "ID1,ID2,ID3"  # Can also use a list here ['ID1','ID2','ID3']

response = falcon.RTR_ListQueuedSessions(ids=id_list)
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

id_list = ['ID1','ID2','ID3']

BODY = {
  "ids": id_list
}

response = falcon.command("RTR_ListQueuedSessions", body=BODY)
print(response)

RTR_DeleteQueuedSession

Delete a queued session command

PEP8 method name

delete_queued_session

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
cloud_request_id
Service Class Support

Uber Class Support
querystringCloud Request ID of the executed command to query.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
session_id
Service Class Support

Uber Class Support
querystringRTR Session ID.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.delete_queued_session(session_id="string", cloud_request_id="string")
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_DeleteQueuedSession(session_id="string", cloud_request_id="string")
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("RTR_DeleteQueuedSession",
                          session_id="string",
                          cloud_request_id="string"
                          )
print(response)

RTR_PulseSession

Refresh a session timeout on a single host.

PEP8 method name

pulse_session

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format.
device_id
Service Class Support

Uber Class Support
bodystringThe host agent ID to refresh the RTR session on. RTR will retrieve an existing session for the calling user on this host.
origin
Service Class Support

Uber Class Support
bodystringOrigin of the request.
queue_offline
Service Class Support

Uber Class Support
bodybooleanFlag indicating if this should be queued to pulse after the host returns to service.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.pulse_session(device_id="string",
                                origin="string",
                                queue_offline=boolean
                                )
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_PulseSession(device_id="string",
                                   origin="string",
                                   queue_offline=boolean
                                   )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

BODY = {
  "device_id": "string",
  "origin": "string",
  "queue_offline": boolean
}

response = falcon.command("RTR_PulseSession", body=BODY)
print(response)

RTR_ListSessions

Get session metadata by session id.

PEP8 method name

list_sessions

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format.
ids
Service Class Support

Uber Class Support
bodystring or list of stringsList of RTR sessions to retrieve. Will only return sessions created by the calling user.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = "ID1,ID2,ID3"  # Can also use a list here ['ID1','ID2','ID3']

response = falcon.list_sessions(ids=id_list)
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = "ID1,ID2,ID3"  # Can also use a list here ['ID1','ID2','ID3']

response = falcon.RTR_ListSessions(ids=id_list)
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

id_list = ['ID1','ID2','ID3']

BODY = {
  "ids": id_list
}

response = falcon.command("RTR_ListSessions", body=BODY)
print(response)

RTR_InitSession

Initialize a new session with the RTR cloud.

PEP8 method name

init_session

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format.
device_id
Service Class Support

Uber Class Support
bodystringThe host agent ID to refresh the RTR session on. RTR will retrieve an existing session for the calling user on this host.
origin
Service Class Support

Uber Class Support
bodystringOrigin of the request.
queue_offline
Service Class Support

Uber Class Support
bodybooleanFlag indicating if this should be queued to pulse after the host returns to service.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.init_session(device_id="string",
                               origin="string",
                               queue_offline=boolean
                               )
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_InitSession(device_id="string",
                                  origin="string",
                                  queue_offline=boolean
                                  )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

BODY = {
  "device_id": "string",
  "origin": "string",
  "queue_offline": boolean
}

response = falcon.command("RTR_InitSession", body=BODY)
print(response)

RTR_DeleteSession

Delete a session.

PEP8 method name

delete_session

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
session_id
Service Class Support

Uber Class Support
querystringRTR Session ID.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.delete_session(session_id="string")
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_DeleteSession(session_id="string")
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("RTR_DeleteSession", session_id="string")
print(response)

RTR_ListAllSessions

Get a list of session_ids.

You will only be able to retrieve sessions that were created using the same API credentials.

PEP8 method name

list_all_sessions

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filter
Service Class Support

Uber Class Support
querystringFQL query expression that should be used to limit the results.

user_id can accept a special value ‘@me’ which will restrict results to records with current user’s ID.
limit
Service Class Support

Uber Class Support
queryintegerMaximum number of records to return. Max: 5000.
offset
Service Class Support

Uber Class Support
querystringStarting index of overall result set from which to return ids.
sort
Service Class Support

Uber Class Support
querystringThe property to sort by.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.list_all_sessions(offset="string",
                                    limit=integer,
                                    sort="string",
                                    filter="string"
                                    )
print(response)

Service class example (Operation ID syntax)
from falconpy import RealTimeResponse

# Do not hardcode API credentials!
falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_ListAllSessions(offset="string",
                                      limit=integer,
                                      sort="string",
                                      filter="string"
                                      )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("RTR_ListAllSessions",
                          offset="string",
                          limit=integer,
                          sort="string",
                          filter="string"
                          )
print(response)