Admission Control Policies

The Admission Control Policies service collection provides operations for managing Kubernetes admission control policies. Create, update, delete, and query policies, manage host groups and rule groups, set policy and rule group precedence, and manage custom Rego rules within rule groups.

Language	Last Update
Python	v1.5.5
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

Table of Contents

Operation	Description
admission_control_get_policies get_policies	Get admission control policies.
admission_control_create_policy create_policy	Create an admission control policy.
admission_control_update_policy update_policy	Update an admission control policy.
admission_control_delete_policies delete_policies	Delete an admission control policy.
admission_control_add_host_groups add_host_groups	Add one or more host groups to an admission control policy.
admission_control_remove_host_groups remove_host_groups	Remove one or more host groups from an admission control policy.
admission_control_update_policy_precedence update_policy_precedence	Update admission control policy precedence.
admission_control_add_rule_group_custom_rule add_custom_rules	Add one or more custom Rego rules to a rule group in an admission control policy.
admission_control_remove_rule_group_custom_rule delete_custom_rules	Delete one or more custom Rego rules from all rule groups in an admission control policy.
admission_control_set_rule_group_precedence set_rule_group_precedence	Change precedence of rule groups within an admission control policy.
admission_control_replace_rule_group_selectors replace_rule_group_selectors	Replace labels and/or namespaces of a rule group within an admission control policy.
admission_control_create_rule_groups create_rule_groups	Create one or more rule groups and add them to an existing admission control policy.
admission_control_update_rule_groups update_rule_groups	Update a rule group.
admission_control_delete_rule_groups delete_rule_groups	Delete rule groups.
admission_control_query_policies query_policies	Search admission control policies.

---

admission_control_get_policies

Get admission control policies.

GET /admission-control-policies/entities/policies/v1

Scope Falcon Container Policies: READ Consumes · Produces application/json

PEP 8 get_policies

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The list of policies to return (maximum 100 IDs allowed).
parameters	query	dictionary	Full set of query string parameters in a JSON formatted dictionary.

Code Examples

Python

PEP 8

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_policies(ids=id_list)
print(response)

Operation ID

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.admission_control_get_policies(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("admission_control_get_policies",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/admission_control_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.AdmissionControlPolicies.AdmissionControlGetPolicies(
    &admission_control_policies.AdmissionControlGetPoliciesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.admissionControlPolicies.admissionControlGetPolicies(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AdmissionControlPolicies.new

response = api.admission_control_get_policies(['ID1', 'ID2', 'ID3'])

puts response

---

admission_control_create_policy

Create an admission control policy.

POST /admission-control-policies/entities/policies/v1

Scope Falcon Container Policies: WRITE Consumes · Produces application/json

PEP 8 create_policy

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload as JSON formatted dictionary.
description	body	string	Policy description.
name	body	string	Policy name.

Code Examples

Python

PEP 8

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.create_policy(description="string", name="string")
print(response)

Operation ID

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.admission_control_create_policy(description="string",
                                                  name="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "name": "string"
}

response = falcon.command("admission_control_create_policy", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/admission_control_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  name := "string"

  response, err := client.AdmissionControlPolicies.AdmissionControlCreatePolicy(
    &admission_control_policies.AdmissionControlCreatePolicyParams{
      Body: &models.ModelsCreatePolicyRequest{
        Description: &description,
        Name: &name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.admissionControlPolicies.admissionControlCreatePolicy(
  {
    description: "string",
    name: "string"
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AdmissionControlPolicies.new

body = Falcon::ModelsCreatePolicyRequest.new(
  description: 'string',
  name: 'string'
)

response = api.admission_control_create_policy(body)

puts response

---

admission_control_update_policy

Update an admission control policy.

PATCH /admission-control-policies/entities/policies/v1

Scope Falcon Container Policies: WRITE Consumes · Produces application/json

PEP 8 update_policy

Parameters

Name	Type	Data type	Description
ids	query	string	The id of the admission control policy to update.
body	body	dictionary	Full body payload as JSON formatted dictionary.
description	body	string	Policy description.
is_enabled	body	boolean	Flag indicating if the policy is enabled.
name	body	string	Policy name.
parameters	query	dictionary	Full set of query string parameters in a JSON formatted dictionary.

Code Examples

Python

PEP 8

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_policy(ids=id_list,
                                description="string",
                                is_enabled=boolean,
                                name="string")
print(response)

Operation ID

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.admission_control_update_policy(ids=id_list,
                                                  description="string",
                                                  is_enabled=boolean,
                                                  name="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "description": "string",
    "is_enabled": boolean,
    "name": "string"
}

response = falcon.command("admission_control_update_policy",
                          ids="string",
                          body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/admission_control_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  is_enabled := boolean
  name := "string"

  response, err := client.AdmissionControlPolicies.AdmissionControlUpdatePolicy(
    &admission_control_policies.AdmissionControlUpdatePolicyParams{
      Body: &models.ModelsUpdatePolicyRequest{
        Description: &description,
        IsEnabled: &is_enabled,
        Name: &name,
      },
      Ids: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.admissionControlPolicies.admissionControlUpdatePolicy(
  "string",  // ids
  {  // body
      description: "string",
      isEnabled: boolean,
      name: "string"
  }
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AdmissionControlPolicies.new

body = Falcon::ModelsUpdatePolicyRequest.new(
  description: 'string',
  is_enabled: boolean,
  name: 'string'
)

response = api.admission_control_update_policy(body, 'string')

puts response

---

admission_control_delete_policies

Delete an admission control policy.

DELETE /admission-control-policies/entities/policies/v1

Scope Falcon Container Policies: WRITE Consumes · Produces application/json

PEP 8 delete_policies

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The ids of the policies to delete (maximum 100 IDs allowed).
parameters	query	dictionary	Full set of query string parameters in a JSON formatted dictionary.

Code Examples

Python

PEP 8

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_policies(ids=id_list)
print(response)

Operation ID

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.admission_control_delete_policies(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("admission_control_delete_policies",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/admission_control_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.AdmissionControlPolicies.AdmissionControlDeletePolicies(
    &admission_control_policies.AdmissionControlDeletePoliciesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.admissionControlPolicies.admissionControlDeletePolicies(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AdmissionControlPolicies.new

response = api.admission_control_delete_policies(['ID1', 'ID2', 'ID3'])

puts response

---

admission_control_add_host_groups

Add one or more host groups to an admission control policy.

POST /admission-control-policies/entities/policy-host-groups/v1

Scope Falcon Container Policies: WRITE Consumes · Produces application/json

PEP 8 add_host_groups

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload as JSON formatted dictionary.
host_groups	body	string or list of strings	Host group IDs to add.
id	body	string	The policy ID to modify.

Code Examples

Python

PEP 8

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.add_host_groups(host_groups=id_list, id="string")
print(response)

Operation ID

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.admission_control_add_host_groups(host_groups=id_list,
                                                    id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "host_groups": ["string"],
    "id": "string"
}

response = falcon.command("admission_control_add_host_groups", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/admission_control_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  id := "string"

  response, err := client.AdmissionControlPolicies.AdmissionControlAddHostGroups(
    &admission_control_policies.AdmissionControlAddHostGroupsParams{
      Body: &models.ModelsAddHostGroupRequest{
        HostGroups: []string{"string"},
        ID: &id,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.admissionControlPolicies.admissionControlAddHostGroups(
  {
    hostGroups: [],
    id: "string"
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AdmissionControlPolicies.new

body = Falcon::ModelsAddHostGroupRequest.new(
  host_groups: [],
  id: 'string'
)

response = api.admission_control_add_host_groups(body)

puts response

---

admission_control_remove_host_groups

Remove one or more host groups from an admission control policy.

DELETE /admission-control-policies/entities/policy-host-groups/v1

Scope Falcon Container Policies: WRITE Consumes · Produces application/json

PEP 8 remove_host_groups

Parameters

Name	Type	Data type	Description
policy_id	query	string	The id of the policy to modify.
host_group_ids	query	string or list of strings	The ids of the host groups to remove (maximum 100 IDs allowed).
parameters	query	dictionary	Full set of query string parameters in a JSON formatted dictionary.

Code Examples

Python

PEP 8

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.remove_host_groups(policy_id="string", host_group_ids=id_list)
print(response)

Operation ID

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.admission_control_remove_host_groups(policy_id="string",
                                                       host_group_ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("admission_control_remove_host_groups",
                          policy_id="string",
                          host_group_ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/admission_control_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.AdmissionControlPolicies.AdmissionControlRemoveHostGroups(
    &admission_control_policies.AdmissionControlRemoveHostGroupsParams{
      PolicyID: "string",
      HostGroupIds: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.admissionControlPolicies.admissionControlRemoveHostGroups(
  "string",  // policyId
  ["ID1", "ID2", "ID3"]  // hostGroupIds
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AdmissionControlPolicies.new

response = api.admission_control_remove_host_groups('string', ['ID1', 'ID2', 'ID3'])

puts response

---

admission_control_update_policy_precedence

Update admission control policy precedence.

PATCH /admission-control-policies/entities/policy-precedence/v1

Scope Falcon Container Policies: WRITE Consumes · Produces application/json

PEP 8 update_policy_precedence

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload as JSON formatted dictionary.
id	body	string	Policy ID.
precedence	body	integer	Policy precedence.

Code Examples

Python

PEP 8

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.update_policy_precedence(id="string", precedence=integer)
print(response)

Operation ID

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.admission_control_update_policy_precedence(id="string",
                                                             precedence=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "id": "string",
    "precedence": integer
}

response = falcon.command("admission_control_update_policy_precedence", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/admission_control_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  id := "string"
  precedence := integer

  response, err := client.AdmissionControlPolicies.AdmissionControlUpdatePolicyPrecedence(
    &admission_control_policies.AdmissionControlUpdatePolicyPrecedenceParams{
      Body: &models.ModelsUpdatePolicyPrecedenceRequest{
        ID: &id,
        Precedence: &precedence,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.admissionControlPolicies.admissionControlUpdatePolicyPrecedence(
  {
    id: "string",
    precedence: integer
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AdmissionControlPolicies.new

body = Falcon::ModelsUpdatePolicyPrecedenceRequest.new(
  id: 'string',
  precedence: integer
)

response = api.admission_control_update_policy_precedence(body)

puts response

---

admission_control_add_rule_group_custom_rule

Add one or more custom Rego rules to a rule group in an admission control policy. The requested custom rules are also added to all other unspecified rule groups in the policy with action ‘Disabled’.

POST /admission-control-policies/entities/policy-rule-group-custom-rules/v1

Scope Falcon Container Policies: WRITE Consumes · Produces application/json

PEP 8 add_custom_rules

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload as JSON formatted dictionary.
id	body	string	Policy ID.
rule_groups	body	list of dictionaries	Rule groups containing custom rules to add.

Code Examples

Python

PEP 8

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

rule_groups = [
    {
        "custom_rules": [
            {
                "action": "string",
                "id": "string"
            }
        ],
        "id": "string"
    }
]

response = falcon.add_custom_rules(id="string", rule_groups=rule_groups)
print(response)

Operation ID

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

rule_groups = [
    {
        "custom_rules": [
            {
                "action": "string",
                "id": "string"
            }
        ],
        "id": "string"
    }
]

response = falcon.admission_control_add_rule_group_custom_rule(id="string",
                                                               rule_groups=rule_groups)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "id": "string",
    "rule_groups": [
        {
            "custom_rules": [
                {
                    "action": "string",
                    "id": "string"
                }
            ],
            "id": "string"
        }
    ]
}

response = falcon.command("admission_control_add_rule_group_custom_rule", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/admission_control_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  id := "string"
  action := "string"

  response, err := client.AdmissionControlPolicies.AdmissionControlAddRuleGroupCustomRule(
    &admission_control_policies.AdmissionControlAddRuleGroupCustomRuleParams{
      Body: &models.ModelsAddPolicyRuleGroupCustomRuleRequest{
        ID: &id,
        RuleGroups: []interface{}{
          {
          CustomRules: []interface{}{
            {
            Action: &action,
            ID: &id,
            },
          },
          ID: &id,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.admissionControlPolicies.admissionControlAddRuleGroupCustomRule(
  {
    id: "string",
    ruleGroups: [{
        customRules: [{
            action: "string",
            id: "string"
          }],
        id: "string"
      }]
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AdmissionControlPolicies.new

body = Falcon::ModelsAddPolicyRuleGroupCustomRuleRequest.new(
  id: 'string',
  rule_groups: [{
      custom_rules: [{
          action: 'string',
          id: 'string'
        }],
      id: 'string'
    }]
)

response = api.admission_control_add_rule_group_custom_rule(body)

puts response

---

admission_control_remove_rule_group_custom_rule

Delete one or more custom Rego rules from all rule groups in an admission control policy.

DELETE /admission-control-policies/entities/policy-rule-group-custom-rules/v1

Scope Falcon Container Policies: WRITE Consumes · Produces application/json

PEP 8 delete_custom_rules

Parameters

Name	Type	Data type	Description
policy_id	query	string	The id of the policy to modify.
custom_rule_ids	query	string or list of strings	The ids of the custom Rego rules to delete (maximum 100 IDs allowed).
parameters	query	dictionary	Full set of query string parameters in a JSON formatted dictionary.

Code Examples

Python

PEP 8

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_custom_rules(policy_id="string",
                                      custom_rule_ids=id_list)
print(response)

Operation ID

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.admission_control_remove_rule_group_custom_rule(policy_id="string",
                                                                  custom_rule_ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("admission_control_remove_rule_group_custom_rule",
                          policy_id="string",
                          custom_rule_ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/admission_control_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.AdmissionControlPolicies.AdmissionControlRemoveRuleGroupCustomRule(
    &admission_control_policies.AdmissionControlRemoveRuleGroupCustomRuleParams{
      PolicyID: "string",
      CustomRuleIds: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.admissionControlPolicies.admissionControlRemoveRuleGroupCustomRule(
  "string",  // policyId
  ["ID1", "ID2", "ID3"]  // customRuleIds
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AdmissionControlPolicies.new

response = api.admission_control_remove_rule_group_custom_rule('string', ['ID1', 'ID2', 'ID3'])

puts response

---

admission_control_set_rule_group_precedence

Change precedence of rule groups within an admission control policy.

PUT /admission-control-policies/entities/policy-rule-group-precedence/v1

Scope Falcon Container Policies: WRITE Consumes · Produces application/json

PEP 8 set_rule_group_precedence

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload as JSON formatted dictionary.
id	body	string	Policy ID.
rule_groups	body	list of dictionaries	List of rule groups in precedence order.

Code Examples

Python

PEP 8

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

rule_groups = [
    {
        "id": "string"
    }
]

response = falcon.set_rule_group_precedence(id="string",
                                            rule_groups=rule_groups)
print(response)

Operation ID

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

rule_groups = [
    {
        "id": "string"
    }
]

response = falcon.admission_control_set_rule_group_precedence(id="string",
                                                              rule_groups=rule_groups)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "id": "string",
    "rule_groups": [
        {
            "id": "string"
        }
    ]
}

response = falcon.command("admission_control_set_rule_group_precedence", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/admission_control_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  id := "string"

  response, err := client.AdmissionControlPolicies.AdmissionControlSetRuleGroupPrecedence(
    &admission_control_policies.AdmissionControlSetRuleGroupPrecedenceParams{
      Body: &models.ModelsChangePolicyRuleGroupPrecedenceRequest{
        ID: &id,
        RuleGroups: []interface{}{
          {
          ID: &id,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.admissionControlPolicies.admissionControlSetRuleGroupPrecedence(
  {
    id: "string",
    ruleGroups: [{
        id: "string"
      }]
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AdmissionControlPolicies.new

body = Falcon::ModelsChangePolicyRuleGroupPrecedenceRequest.new(
  id: 'string',
  rule_groups: [{
      id: 'string'
    }]
)

response = api.admission_control_set_rule_group_precedence(body)

puts response

---

admission_control_replace_rule_group_selectors

Replace labels and/or namespaces of a rule group within an admission control policy.

PUT /admission-control-policies/entities/policy-rule-group-selectors/v1

Scope Falcon Container Policies: WRITE Consumes · Produces application/json

PEP 8 replace_rule_group_selectors

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload as JSON formatted dictionary.
id	body	string	Policy ID.
rule_groups	body	list of dictionaries	Rule groups with labels and/or namespaces to replace.

Code Examples

Python

PEP 8

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

rule_groups = [
    {
        "id": "string",
        "labels": [
            {
                "key": "string",
                "operator": "string",
                "value": "string"
            }
        ],
        "namespaces": [
            {
                "value": "string"
            }
        ]
    }
]

response = falcon.replace_rule_group_selectors(id="string",
                                               rule_groups=rule_groups)
print(response)

Operation ID

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

rule_groups = [
    {
        "id": "string",
        "labels": [
            {
                "key": "string",
                "operator": "string",
                "value": "string"
            }
        ],
        "namespaces": [
            {
                "value": "string"
            }
        ]
    }
]

response = falcon.admission_control_replace_rule_group_selectors(id="string",
                                                                 rule_groups=rule_groups)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "id": "string",
    "rule_groups": [
        {
            "id": "string",
            "labels": [
                {
                    "key": "string",
                    "operator": "string",
                    "value": "string"
                }
            ],
            "namespaces": [
                {
                    "value": "string"
                }
            ]
        }
    ]
}

response = falcon.command("admission_control_replace_rule_group_selectors", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/admission_control_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  id := "string"
  key := "string"
  operator := "string"
  value := "string"

  response, err := client.AdmissionControlPolicies.AdmissionControlReplaceRuleGroupSelectors(
    &admission_control_policies.AdmissionControlReplaceRuleGroupSelectorsParams{
      Body: &models.ModelsReplacePolicyRuleGroupSelectorsRequest{
        ID: &id,
        RuleGroups: []interface{}{
          {
          ID: &id,
          Labels: []interface{}{
            {
            Key: &key,
            Operator: &operator,
            Value: &value,
            },
          },
          Namespaces: []interface{}{
            {
            Value: &value,
            },
          },
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.admissionControlPolicies.admissionControlReplaceRuleGroupSelectors(
  {
    id: "string",
    ruleGroups: [{
        id: "string",
        labels: [{
            key: "string",
            operator: "string",
            value: "string"
          }],
        namespaces: [{
            value: "string"
          }]
      }]
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AdmissionControlPolicies.new

body = Falcon::ModelsReplacePolicyRuleGroupSelectorsRequest.new(
  id: 'string',
  rule_groups: [{
      id: 'string',
      labels: [{
          key: 'string',
          operator: 'string',
          value: 'string'
        }],
      namespaces: [{
          value: 'string'
        }]
    }]
)

response = api.admission_control_replace_rule_group_selectors(body)

puts response

---

admission_control_create_rule_groups

Create one or more rule groups and add them to an existing admission control policy.

POST /admission-control-policies/entities/policy-rule-groups/v1

Scope Falcon Container Policies: WRITE Consumes · Produces application/json

PEP 8 create_rule_groups

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload as JSON formatted dictionary.
id	body	string	Policy ID.
rule_groups	body	list of dictionaries	Rule groups to create.

Code Examples

Python

PEP 8

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

rule_groups = [
    {
        "description": "string",
        "name": "string"
    }
]

response = falcon.create_rule_groups(id="string", rule_groups=rule_groups)
print(response)

Operation ID

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

rule_groups = [
    {
        "description": "string",
        "name": "string"
    }
]

response = falcon.admission_control_create_rule_groups(id="string",
                                                       rule_groups=rule_groups)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "id": "string",
    "rule_groups": [
        {
            "description": "string",
            "name": "string"
        }
    ]
}

response = falcon.command("admission_control_create_rule_groups", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/admission_control_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  id := "string"
  description := "string"
  name := "string"

  response, err := client.AdmissionControlPolicies.AdmissionControlCreateRuleGroups(
    &admission_control_policies.AdmissionControlCreateRuleGroupsParams{
      Body: &models.ModelsCreatePolicyRuleGroupRequest{
        ID: &id,
        RuleGroups: []interface{}{
          {
          Description: &description,
          Name: &name,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.admissionControlPolicies.admissionControlCreateRuleGroups(
  {
    id: "string",
    ruleGroups: [{
        description: "string",
        name: "string"
      }]
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AdmissionControlPolicies.new

body = Falcon::ModelsCreatePolicyRuleGroupRequest.new(
  id: 'string',
  rule_groups: [{
      description: 'string',
      name: 'string'
    }]
)

response = api.admission_control_create_rule_groups(body)

puts response

---

admission_control_update_rule_groups

Update a rule group. Change rule group name, description, deny on error, Image Assessment settings, default rule actions, and custom rule actions.

PATCH /admission-control-policies/entities/policy-rule-groups/v1

Scope Falcon Container Policies: WRITE Consumes · Produces application/json

PEP 8 update_rule_groups

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload as JSON formatted dictionary. Valid rule action values: Disabled, Prevent, Alert. Valid image assessment unassessed handling values: Prevent, Alert, Allow Without Alert.
id	body	string	Policy ID.
rule_groups	body	list of dictionaries	Rule groups to update.

Code Examples

Python

PEP 8

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

rule_groups = [
    {
        "custom_rules": [
            {
                "action": "string",
                "id": "string"
            }
        ],
        "default_rules": [
            {
                "action": "string",
                "code": "string"
            }
        ],
        "deny_on_error": {
            "deny": true
        },
        "description": "string",
        "id": "string",
        "image_assessment": {
            "enabled": true,
            "unassessed_handling": "string"
        },
        "name": "string"
    }
]

response = falcon.update_rule_groups(id="string", rule_groups=rule_groups)
print(response)

Operation ID

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

rule_groups = [
    {
        "custom_rules": [
            {
                "action": "string",
                "id": "string"
            }
        ],
        "default_rules": [
            {
                "action": "string",
                "code": "string"
            }
        ],
        "deny_on_error": {
            "deny": true
        },
        "description": "string",
        "id": "string",
        "image_assessment": {
            "enabled": true,
            "unassessed_handling": "string"
        },
        "name": "string"
    }
]

response = falcon.admission_control_update_rule_groups(id="string",
                                                       rule_groups=rule_groups)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "id": "string",
    "rule_groups": [
        {
            "custom_rules": [
                {
                    "action": "string",
                    "id": "string"
                }
            ],
            "default_rules": [
                {
                    "action": "string",
                    "code": "string"
                }
            ],
            "deny_on_error": {
                "deny": boolean
            },
            "description": "string",
            "id": "string",
            "image_assessment": {
                "enabled": boolean,
                "unassessed_handling": "string"
            },
            "name": "string"
        }
    ]
}

response = falcon.command("admission_control_update_rule_groups", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/admission_control_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  id := "string"
  action := "string"
  code := "string"
  description := "string"
  name := "string"

  response, err := client.AdmissionControlPolicies.AdmissionControlUpdateRuleGroups(
    &admission_control_policies.AdmissionControlUpdateRuleGroupsParams{
      Body: &models.ModelsUpdatePolicyRuleGroupRequest{
        ID: &id,
        RuleGroups: []interface{}{
          {
          CustomRules: []interface{}{
            {
            Action: &action,
            ID: &id,
            },
          },
          DefaultRules: []interface{}{
            {
            Action: &action,
            Code: &code,
            },
          },
          DenyOnError: &struct{}{},
          Description: &description,
          ID: &id,
          ImageAssessment: &struct{}{},
          Name: &name,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.admissionControlPolicies.admissionControlUpdateRuleGroups(
  {
    id: "string",
    ruleGroups: [{
        customRules: [{
            action: "string",
            id: "string"
          }],
        defaultRules: [{
            action: "string",
            code: "string"
          }],
        denyOnError: {
          deny: boolean
        },
        description: "string",
        id: "string",
        imageAssessment: {
          enabled: boolean,
          unassessedHandling: "string"
        },
        name: "string"
      }]
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AdmissionControlPolicies.new

body = {
  id: 'string',
  rule_groups: [{
      custom_rules: [{
          action: 'string',
          id: 'string'
        }],
      default_rules: [{
          action: 'string',
          code: 'string'
        }],
      deny_on_error: {
        deny: boolean
      },
      description: 'string',
      id: 'string',
      image_assessment: {
        enabled: boolean,
        unassessed_handling: 'string'
      },
      name: 'string'
    }]
}

response = api.admission_control_update_rule_groups(body)

puts response

---

admission_control_delete_rule_groups

Delete rule groups.

DELETE /admission-control-policies/entities/policy-rule-groups/v1

Scope Falcon Container Policies: WRITE Consumes · Produces application/json

PEP 8 delete_rule_groups

Parameters

Name	Type	Data type	Description
policy_id	query	string	The id of the policy to modify.
rule_group_ids	query	string or list of strings	The ids of the rule groups to delete (maximum 100 IDs allowed).
parameters	query	dictionary	Full set of query string parameters in a JSON formatted dictionary.

Code Examples

Python

PEP 8

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_rule_groups(policy_id="string", rule_group_ids=id_list)
print(response)

Operation ID

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.admission_control_delete_rule_groups(policy_id="string",
                                                       rule_group_ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("admission_control_delete_rule_groups",
                          policy_id="string",
                          rule_group_ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/admission_control_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.AdmissionControlPolicies.AdmissionControlDeleteRuleGroups(
    &admission_control_policies.AdmissionControlDeleteRuleGroupsParams{
      PolicyID: "string",
      RuleGroupIds: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.admissionControlPolicies.admissionControlDeleteRuleGroups(
  "string",  // policyId
  ["ID1", "ID2", "ID3"]  // ruleGroupIds
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AdmissionControlPolicies.new

response = api.admission_control_delete_rule_groups('string', ['ID1', 'ID2', 'ID3'])

puts response

---

admission_control_query_policies

Search admission control policies.

GET /admission-control-policies/queries/policies/v1

Scope Falcon Container Policies: READ Consumes · Produces application/json

PEP 8 query_policies

Parameters

Name	Type	Data type	Description
filter	query	string	FQL filter. Allowed properties: precedence, created_timestamp, modified_timestamp, name, description.
limit	query	integer	The maximum number of resources to return. The maximum allowed is 500. [Default: 100]
offset	query	integer	The number of results to skip before starting to return results. [Default: 0]
sort	query	string	Field to sort on. Sortable fields: precedence, created_timestamp, modified_timestamp. Use the |asc or |desc suffix to specify sort direction.
parameters	query	dictionary	Full set of query string parameters in a JSON formatted dictionary.

Code Examples

Python

PEP 8

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.query_policies(filter="string",
                                 limit=integer,
                                 offset=integer,
                                 sort="string")
print(response)

Operation ID

from falconpy import AdmissionControlPolicies

falcon = AdmissionControlPolicies(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.admission_control_query_policies(filter="string",
                                                   limit=integer,
                                                   offset=integer,
                                                   sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("admission_control_query_policies",
                          filter="string",
                          limit=integer,
                          offset=integer,
                          sort="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/admission_control_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)
  sort := "string"

  response, err := client.AdmissionControlPolicies.AdmissionControlQueryPolicies(
    &admission_control_policies.AdmissionControlQueryPoliciesParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.admissionControlPolicies.admissionControlQueryPolicies(
  "string",  // filter
  integer,  // limit
  integer,  // offset
  "string"  // sort
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AdmissionControlPolicies.new

response = api.admission_control_query_policies(filter: 'string',
                                                limit: integer,
                                                offset: integer,
                                                sort: 'string')

puts response