CrowdStrike Falcon CrowdStrike Subreddit

Using the Workflows service collection

Uber class support Service class support Documentation Version Page Updated

Table of Contents

Operation IDDescription
WorkflowExecute
PEP8execute
Executes an on-demand Workflow, the body is JSON used to trigger the execution, the response the execution ID(s)
WorkflowExecutionsAction
PEP8execution_action
Allows a user to resume/retry a failed workflow execution.
WorkflowExecutionResults
PEP8execution_results
Get execution result of a given execution
WorkflowSystemDefinitionsDeProvision
PEP8deprovision
Deprovisions a system definition that was previously provisioned on the target CID
WorkflowSystemDefinitionsPromote
PEP8promote
Promote a version of a system definition
WorkflowSystemDefinitionsProvision
PEP8provision
Provisions a system definition onto the target CID by using the template and provided parameters

Passing credentials

WARNING

client_id and client_secret are keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

WorkflowExecute

Execute an on-demand workflow. Response will contain the execution ID.

PEP8 method name

execute

Endpoint

MethodRoute
POST/workflows/entities/execute/v1

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
definition_id
Service Class Support

Uber Class Support
querystring or list of stringsDefinition ID to execute, either a name or an ID can be specified.
name
Service Class Support

Uber Class Support
querystringWorkflow name to execute, either a name or an ID can be specified.
key
Service Class Support

Uber Class Support
querystringKey used to help deduplicate executions, if unset a new UUID is used
depth
Service Class Support

Uber Class Support
queryintegerUsed to record the execution depth to help limit execution loops when a workflow triggers another. The maximum depth is 4.
parametersService Class SupportUber Class SupportquerydictionaryFull query string parameters payload in JSON format.
source_event_url
Service Class Support

Uber Class Support
querystringUsed to record a URL to the source that led to triggering this workflow
body
Service Class Support

Uber Class Support
bodystringFull body payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy.workflows import Workflows

falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

workflow_schema = {
    "schema details": "go here"
}

response = falcon.execute(definition_id=["string", "string"],
                          name="string",
                          key="string",
                          depth=integer,
                          source_event_url="string",
                          body=workflow_schema
                          )

print(response)
Service class example (Operation ID syntax)
from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

workflow_schema = {
    "schema details": "go here"
}

response = falcon.WorkflowExecute(definition_id=["string", "string"],
                                  name="string",
                                  key="string",
                                  depth=integer,
                                  source_event_url="string",
                                  body=workflow_schema
                                  )

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

workflow_schema = {
    "schema details": "go here"
}

response = falcon.command("WorkflowExecute",
                          definition_id=["string", "string"],
                          name="string",
                          key="string",
                          depth=integer,
                          source_event_url="string",
                          body=workflow_schema
                          )

print(response)

WorkflowExecutionsAction

Allows a user to resume/retry a failed workflow execution.

PEP8 method name

execution_action

Endpoint

MethodRoute
POST/workflows/entities/execution-actions/v1

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
action_name
Service Class Support

Uber Class Support
querystringSpecify one of these actions: - resume: resume/retry the workflow execution(s) specified in ids
action_parameters
Service Class Support

Uber Class Support
bodylist of dictionariesList of actions to perform.
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format. Not required when using other keywords.
ids
Service Class Support

Uber Class Support
bodystring or list of stringsExecution IDs.
name
Service Class Support

Uber Class Support
body (action_parameters)stringAction parameter name.
value
Service Class Support

Uber Class Support
body (action_parameters)stringAction parameter value.

Usage

Service class example (PEP8 syntax)
from falconpy.workflows import Workflows

falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

response = falcon.execution_action(action_name="string",
                                   ids="string",
                                   name="string",
                                   value="string"
                                   )

print(response)
Service class example (Operation ID syntax)
from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

response = falcon.WorkflowExecutionsAction(action_name="string",
                                           ids="string",
                                           name="string",
                                           value="string"
                                           )

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

body_payload = {
    "action_parameters": [
        {
            "name": "string",
            "value": "string"
        }
    ],
    "ids": [
        "string"
    ]
}

response = falcon.command("WorkflowExecutionsAction", action_name="string", body=body_payload)

print(response)

WorkflowExecutionResults

Get execution result of a given execution

PEP8 method name

execution_results

Endpoint

MethodRoute
GET/workflows/entities/execution-results/v1

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
ids
Service Class Support

Uber Class Support
querystring or list of stringsWorkflow execution ID to return results for.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy.workflows import Workflows

falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.execution_results(ids=id_list)

print(response)
Service class example (Operation ID syntax)
from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.WorkflowExecutionResults(ids=id_list)

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("WorkflowExecutionResults", ids=id_list)

print(response)

WorkflowSystemDefinitionsDeProvision

Deprovisions a system definition that was previously provisioned on the target CID.

PEP8 method name

deprovision

Endpoint

MethodRoute
POST/workflows/system-definitions/deprovision/v1

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format. Not required when using other keywords.
definition_id
Service Class Support

Uber Class Support
bodystringWorkflow definition ID.
deprovision_all
Service Class Support

Uber Class Support
bodybooleanFlag indicating if all workflows should be deprovisioned.
template_id
Service Class Support

Uber Class Support
bodystringTemplate ID.
template_name
Service Class Support

Uber Class Support
bodystringTemplate name.

Usage

Service class example (PEP8 syntax)
from falconpy.workflows import Workflows

falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

response = falcon.deprovision(definition_id="string",
                              deprovision_all=boolean,
                              template_id="string",
                              template_name="string",
                              )

print(response)
Service class example (Operation ID syntax)
from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

response = falcon.WorkflowSystemDefinitionsDeProvision(definition_id="string",
                                                       deprovision_all=boolean,
                                                       template_id="string",
                                                       template_name="string",
                                                       )

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

body_payload = {
    "definition_id": "string",
    "deprovision_all": boolean,
    "template_id": "string",
    "template_name": "string"
}

response = falcon.command("WorkflowSystemDefinitionsDeProvision", body=body_payload)

print(response)

WorkflowSystemDefinitionsPromote

Promote a version of a system definition.

Tenant must be already provisioned. This allows the caller to apply an updated template version on a CID and expects all parameters to be supplied. If the template supports multi-instance, the customer scope definition ID must be supplied to determine which customer workflow should be update.

PEP8 method name

promote

Endpoint

MethodRoute
POST/workflows/system-definitions/promote/v1

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
activities
Service Class Support

Uber Class Support
bodydictionaryDictionary of workflow activities.
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format. Not required when using other keywords.
conditions
Service Class Support

Uber Class Support
bodylist of dictionariesList of workflow conditions.
customer_definition_id
Service Class Support

Uber Class Support
bodystringCustomer definition ID.
name
Service Class Support

Uber Class Support
bodystringName of the workflow.
parameters
Service Class Support

Uber Class Support
bodydictionaryOverrides specified activities, conditions and trigger keywords.
template_id
Service Class Support

Uber Class Support
bodystringTemplate ID.
template_name
Service Class Support

Uber Class Support
bodystringTemplate name.
template_version
Service Class Support

Uber Class Support
bodystringTemplate version.
trigger
Service Class Support

Uber Class Support
bodydictionaryWorkflow trigger definition.

Usage

Service class example (PEP8 syntax)
from falconpy.workflows import Workflows

falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

activities = {
    "configuration": [
        {
            "node_id": "string",
            "properties": {}
        }
    ],
    "selection": [
        {
            "id": "string",
            "properties": {},
            "source": "string"
        }
    ]
}
conditions = [
    {
        "fields": [
            {
                "name": "string",
                "operator": "string"
            }
        ],
        "node_id": "string"
    }
]
trigger = {
    "fields": {},
    "node_id": "string"
}

response = falcon.promote(activities=activities,
                          conditions=conditions,
                          customer_definition_id="string",
                          name="string",
                          template_id="string",
                          template_name="string",
                          template_version="string",
                          trigger=trigger
                          )

print(response)
Service class example (Operation ID syntax)
from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

activities = {
    "configuration": [
        {
            "node_id": "string",
            "properties": {}
        }
    ],
    "selection": [
        {
            "id": "string",
            "properties": {},
            "source": "string"
        }
    ]
}
conditions = [
    {
        "fields": [
            {
                "name": "string",
                "operator": "string"
            }
        ],
        "node_id": "string"
    }
]
trigger = {
    "fields": {},
    "node_id": "string"
}

response = falcon.WorkflowSystemDefinitionsPromote(activities=activities,
                                                   conditions=conditions,
                                                   customer_definition_id="string",
                                                   name="string",
                                                   template_id="string",
                                                   template_name="string",
                                                   template_version="string",
                                                   trigger=trigger
                                                   )

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

activities = {
    "configuration": [
        {
            "node_id": "string",
            "properties": {}
        }
    ],
    "selection": [
        {
            "id": "string",
            "properties": {},
            "source": "string"
        }
    ]
}
conditions = [
    {
        "fields": [
            {
                "name": "string",
                "operator": "string"
            }
        ],
        "node_id": "string"
    }
]
trigger = {
    "fields": {},
    "node_id": "string"
}
body_payload = {
    "customer_definition_id": "string",
    "name": "string",
    "parameters": {
        "activities": activities,
        "conditions": conditions,
        "trigger": trigger
    },
    "template_id": "string",
    "template_name": "string",
    "template_version": "string"
}

response = falcon.command("WorkflowSystemDefinitionsPromote", body=body_payload)

print(response)

WorkflowSystemDefinitionsProvision

Provisions a system definition onto the target CID by using the template and provided parameters.

PEP8 method name

provision

Endpoint

MethodRoute
POST/workflows/system-definitions/provision/v1

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
activities
Service Class Support

Uber Class Support
bodydictionaryDictionary of workflow activities.
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format. Not required when using other keywords.
conditions
Service Class Support

Uber Class Support
bodylist of dictionariesList of workflow conditions.
customer_definition_id
Service Class Support

Uber Class Support
bodystringCustomer definition ID.
name
Service Class Support

Uber Class Support
bodystringWorkflow name.
parameters
Service Class Support

Uber Class Support
bodydictionaryOverrides specified activities, conditions and trigger keywords.
template_id
Service Class Support

Uber Class Support
bodystringTemplate ID.
template_name
Service Class Support

Uber Class Support
bodystringTemplate name.
template_version
Service Class Support

Uber Class Support
bodystringTemplate version.
trigger
Service Class Support

Uber Class Support
bodydictionaryWorkflow trigger definition.

Usage

Service class example (PEP8 syntax)
from falconpy.workflows import Workflows

falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

activities = {
    "configuration": [
        {
            "node_id": "string",
            "properties": {}
        }
    ],
    "selection": [
        {
            "id": "string",
            "properties": {},
            "source": "string"
        }
    ]
}
conditions = [
    {
        "fields": [
            {
                "name": "string",
                "operator": "string"
            }
        ],
        "node_id": "string"
    }
]
trigger = {
    "fields": {},
    "node_id": "string"
}

response = falcon.provision(activities=activities,
                            conditions=conditions,
                            customer_definition_id="string",
                            name="string",
                            template_id="string",
                            template_name="string",
                            template_version="string",
                            trigger=trigger
                            )

print(response)
Service class example (Operation ID syntax)
from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

activities = {
    "configuration": [
        {
            "node_id": "string",
            "properties": {}
        }
    ],
    "selection": [
        {
            "id": "string",
            "properties": {},
            "source": "string"
        }
    ]
}
conditions = [
    {
        "fields": [
            {
                "name": "string",
                "operator": "string"
            }
        ],
        "node_id": "string"
    }
]
trigger = {
    "fields": {},
    "node_id": "string"
}

response = falcon.WorkflowSystemDefinitionsProvision(activities=activities,
                                                     conditions=conditions,
                                                     customer_definition_id="string",
                                                     name="string",
                                                     template_id="string",
                                                     template_name="string",
                                                     template_version="string",
                                                     trigger=trigger
                                                     )

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

activities = {
    "configuration": [
        {
            "node_id": "string",
            "properties": {}
        }
    ],
    "selection": [
        {
            "id": "string",
            "properties": {},
            "source": "string"
        }
    ]
}
conditions = [
    {
        "fields": [
            {
                "name": "string",
                "operator": "string"
            }
        ],
        "node_id": "string"
    }
]
trigger = {
    "fields": {},
    "node_id": "string"
}
body_payload = {
    "customer_definition_id": "string",
    "name": "string",
    "parameters": {
        "activities": activities,
        "conditions": conditions,
        "trigger": trigger
    },
    "template_id": "string",
    "template_name": "string",
    "template_version": "string"
}

response = falcon.command("WorkflowSystemDefinitionsProvision", body=body_payload)

print(response)