AIDR

Operations for the AIDR service collection. Also available in FalconPy as Guardian.

Language	Last Update
Python	v1.6.6
PowerShell
Go	v0.24.0
TypeScript	v0.9.0
Rust
Ruby	v1.6.0

Operation	Description
aggregateAgentSessionsV1 `aggregate_aidr_agent_sessions`	Aggregate agent-session counts by product
aggregateAgentsV1 `aggregate_aidr_agents`	Aggregate agent counts by product
aggregateDetectionsV1 `aggregate_aidr_detections`	Max detection severity per agent and product
aggregateSkillsV1 `aggregate_aidr_skills`	Aggregate skill usage counts by name
aggregateSkillUsageV1 `aggregate_aidr_skill_usage`	Aggregate skill invocation counts by name (LogScale)
aggregateToolsV1 `aggregate_aidr_tools`	Aggregate tool usage counts by name
aggregateToolUsageV1 `aggregate_aidr_tool_usage`	Aggregate tool invocation counts by name (LogScale)
entitiesAgentInstallationsV1 `get_aidr_agent_installations`	Get AI agent installation details by IDs
entitiesAgentOSUsersV1 `get_aidr_agent_os_users`	Get an OS user by aid + username
entitiesAgentSessionsV1 `get_aidr_agent_sessions`	Get AI agent session details by IDs
entitiesAgentsV1 `get_aidr_agents`	Get AI agent details by IDs
entitiesClassifiedFileAccessV1 `get_aidr_classified_file_access`	Get FDP classified file access for a process
entitiesExecutionsV1 `get_aidr_executions`	Get AI agent execution detail by session ID
entitiesFileEventsV1 `get_aidr_file_events`	Get file write activity from AI session processes
entitiesModelNamesV1 `get_aidr_model_names`	Get AI model name details by IDs
entitiesNetworkEventsV1 `get_aidr_network_events`	Get outbound network connections from AI session processes
entitiesProcessTreeV1 `get_aidr_process_tree`	Get spawned process tree for an AI session
entitiesSessionActivityV1 `get_aidr_session_activity`	Get ThreatGraph session activity (tools, models, processes)
entitiesSkillsV1 `get_aidr_skills`	Get AI skill frontmatter details by IDs
entitiesToolsV1 `get_aidr_tools`	Get AI tool details by IDs
queryAgentInstallationsV1 `query_aidr_agent_installations`	List AI agent installations
queryAgentOSUsersV1 `query_aidr_agent_os_users`	List OS users that ran AI agents
queryAgentSessionsV1 `query_aidr_agent_sessions`	List AI agent sessions
queryAgentsV1 `query_aidr_agents`	List AI agent instances
queryDetectionsV1 `query_aidr_detections`	List detections involving AI agent processes
queryExecutionsV1 `query_aidr_executions`	List AI agent process executions
queryMcpServerNamesV1 `query_aidr_mcp_server_names`	List MCP server names
queryModelNamesV1 `query_aidr_model_names`	List AI model names
queryPromptsV1 `query_aidr_prompts`	List AI prompt records
querySkillsV1 `query_aidr_skills`	List AI skill frontmatters
querySkillUsageV1 `query_aidr_skill_usage`	List AI skill invocations (LogScale, session-scoped)
queryToolsV1 `query_aidr_tools`	List AI tools
queryToolUsageV1 `query_aidr_tool_usage`	List AI tool invocations (LogScale, session-scoped)

aggregateAgentSessionsV1

Aggregate agent-session counts by product

Method GET

Route /aidr/aggregates/agent-sessions/v1

Scope Aidr Events: READ

PEP 8 aggregate_aidr_agent_sessions

Parameters

limit query · integer

Maximum number of results to return (1-500, default 50)

offset query · integer

Pagination offset (0-1000)

time_range query · string

Lookback period (e.g., 7d, 24h). Max 90d

product query · string

Filter by AI product name (e.g., CLAUDE_CODE, CURSOR)

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.aggregate_aidr_agent_sessions(limit=integer,
                                                offset=integer,
                                                time_range="string",
                                                product="string")
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.aggregateAgentSessionsV1(limit=integer,
                                           offset=integer,
                                           time_range="string",
                                           product="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("aggregateAgentSessionsV1",
                          limit=integer,
                          offset=integer,
                          time_range="string",
                          product="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)
  timeRange := "string"
  product := "string"

  response, err := client.AidrEvents.AggregateAgentSessionsV1(
    &aidr_events.AggregateAgentSessionsV1Params{
      Limit: &limit,
      Offset: &offset,
      TimeRange: &timeRange,
      Product: &product,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.aggregateAgentSessionsV1(
  integer,  // limit
  integer,  // offset
  "string",  // timeRange
  "string"  // product
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.aggregate_agent_sessions_v1(limit: integer,
                                           offset: integer,
                                           time_range: 'string',
                                           product: 'string')

puts response

Responses

[
  {
    "Product": {},
    "ProductName": "string",
    "count": {}
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

aggregateAgentsV1

Aggregate agent counts by product

Method GET

Route /aidr/aggregates/agents/v1

Scope Aidr Events: READ

PEP 8 aggregate_aidr_agents

Parameters

limit query · integer

Maximum number of results to return (1-500, default 50)

offset query · integer

Pagination offset (0-1000)

time_range query · string

Lookback period (e.g., 7d, 24h). Max 90d

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.aggregate_aidr_agents(limit=integer,
                                        offset=integer,
                                        time_range="string")
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.aggregateAgentsV1(limit=integer,
                                    offset=integer,
                                    time_range="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("aggregateAgentsV1",
                          limit=integer,
                          offset=integer,
                          time_range="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)
  timeRange := "string"

  response, err := client.AidrEvents.AggregateAgentsV1(
    &aidr_events.AggregateAgentsV1Params{
      Limit: &limit,
      Offset: &offset,
      TimeRange: &timeRange,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.aggregateAgentsV1(
  integer,  // limit
  integer,  // offset
  "string"  // timeRange
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.aggregate_agents_v1(limit: integer,
                                   offset: integer,
                                   time_range: 'string')

puts response

Responses

[
  {
    "AgentProduct": {},
    "AgentProductName": "string",
    "count": {}
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

aggregateDetectionsV1

Max detection severity per agent and product

Method GET

Route /aidr/aggregates/detections/v1

Scope Aidr Events: READ

PEP 8 aggregate_aidr_detections

Parameters

limit query · integer

Maximum number of results to return (1-500, default 50)

offset query · integer

Pagination offset (0-1000)

time_range query · string

Lookback period (e.g., 7d, 24h). Max 90d

agent_id query · string

Filter by agent ID (see endpoint notes: some use the 64-hex AIAgent.Id, detections use the 32-hex SensorId)

product query · string

Filter by AI product name (e.g., CLAUDE_CODE, CURSOR)

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.aggregate_aidr_detections(limit=integer,
                                            offset=integer,
                                            time_range="string",
                                            agent_id="string",
                                            product="string")
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.aggregateDetectionsV1(limit=integer,
                                        offset=integer,
                                        time_range="string",
                                        agent_id="string",
                                        product="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("aggregateDetectionsV1",
                          limit=integer,
                          offset=integer,
                          time_range="string",
                          agent_id="string",
                          product="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)
  timeRange := "string"
  agentID := "string"
  product := "string"

  response, err := client.AidrEvents.AggregateDetectionsV1(
    &aidr_events.AggregateDetectionsV1Params{
      Limit: &limit,
      Offset: &offset,
      TimeRange: &timeRange,
      AgentID: &agentID,
      Product: &product,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.aggregateDetectionsV1(
  integer,  // limit
  integer,  // offset
  "string",  // timeRange
  "string",  // agentId
  "string"  // product
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.aggregate_detections_v1(limit: integer,
                                       offset: integer,
                                       time_range: 'string',
                                       agent_id: 'string',
                                       product: 'string')

puts response

Responses

[
  {
    "AgentId": "string",
    "AgenticProductTag": {},
    "maxDetectionScore": {}
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

aggregateSkillsV1

Aggregate skill usage counts by name

Method GET

Route /aidr/aggregates/skills/v1

Scope Aidr Events: READ

PEP 8 aggregate_aidr_skills

Parameters

limit query · integer

Maximum number of results to return (1-500, default 50)

offset query · integer

Pagination offset (0-1000)

time_range query · string

Lookback period (e.g., 7d, 24h). Max 90d

name_filter query · string

Filter by name pattern (supports wildcards via like)

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.aggregate_aidr_skills(limit=integer,
                                        offset=integer,
                                        time_range="string",
                                        name_filter="string")
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.aggregateSkillsV1(limit=integer,
                                    offset=integer,
                                    time_range="string",
                                    name_filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("aggregateSkillsV1",
                          limit=integer,
                          offset=integer,
                          time_range="string",
                          name_filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)
  timeRange := "string"
  nameFilter := "string"

  response, err := client.AidrEvents.AggregateSkillsV1(
    &aidr_events.AggregateSkillsV1Params{
      Limit: &limit,
      Offset: &offset,
      TimeRange: &timeRange,
      NameFilter: &nameFilter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.aggregateSkillsV1(
  integer,  // limit
  integer,  // offset
  "string",  // timeRange
  "string"  // nameFilter
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.aggregate_skills_v1(limit: integer,
                                   offset: integer,
                                   time_range: 'string',
                                   name_filter: 'string')

puts response

Responses

[
  {
    "SkillName": "string",
    "count": {}
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

aggregateSkillUsageV1

Aggregate skill invocation counts by name (LogScale)

Method GET

Route /aidr/aggregates/skill-usage/v1

Scope Aidr Events: READ

PEP 8 aggregate_aidr_skill_usage

Parameters

limit query · integer

Maximum number of results to return (1-500, default 50)

offset query · integer

Pagination offset (0-1000)

time_range query · string

Lookback period (e.g., 2h, 24h). Max 7d; defaults to 2h if omitted (LogScale-backed)

session_id query · string

Filter by AgenticSessionId

aid query · string

Filter by sensor ID (aid) — identifies a host, not a single agent

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.aggregate_aidr_skill_usage(limit=integer,
                                             offset=integer,
                                             time_range="string",
                                             session_id="string",
                                             aid="string")
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.aggregateSkillUsageV1(limit=integer,
                                        offset=integer,
                                        time_range="string",
                                        session_id="string",
                                        aid="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("aggregateSkillUsageV1",
                          limit=integer,
                          offset=integer,
                          time_range="string",
                          session_id="string",
                          aid="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)
  timeRange := "string"
  sessionID := "string"
  aid := "string"

  response, err := client.AidrEvents.AggregateSkillUsageV1(
    &aidr_events.AggregateSkillUsageV1Params{
      Limit: &limit,
      Offset: &offset,
      TimeRange: &timeRange,
      SessionID: &sessionID,
      Aid: &aid,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.aggregateSkillUsageV1(
  integer,  // limit
  integer,  // offset
  "string",  // timeRange
  "string",  // sessionId
  "string"  // aid
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.aggregate_skill_usage_v1(limit: integer,
                                        offset: integer,
                                        time_range: 'string',
                                        session_id: 'string',
                                        aid: 'string')

puts response

Responses

[
  {
    "AgenticSkill": "string",
    "count": {}
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

aggregateToolsV1

Aggregate tool usage counts by name

Method GET

Route /aidr/aggregates/tools/v1

Scope Aidr Events: READ

PEP 8 aggregate_aidr_tools

Parameters

limit query · integer

Maximum number of results to return (1-500, default 50)

offset query · integer

Pagination offset (0-1000)

time_range query · string

Lookback period (e.g., 7d, 24h). Max 90d

sensor_id query · string

Filter by sensor ID (32-hex aid / AIAgent.SensorId)

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.aggregate_aidr_tools(limit=integer,
                                       offset=integer,
                                       time_range="string",
                                       sensor_id="string")
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.aggregateToolsV1(limit=integer,
                                   offset=integer,
                                   time_range="string",
                                   sensor_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("aggregateToolsV1",
                          limit=integer,
                          offset=integer,
                          time_range="string",
                          sensor_id="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)
  timeRange := "string"
  sensorID := "string"

  response, err := client.AidrEvents.AggregateToolsV1(
    &aidr_events.AggregateToolsV1Params{
      Limit: &limit,
      Offset: &offset,
      TimeRange: &timeRange,
      SensorID: &sensorID,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.aggregateToolsV1(
  integer,  // limit
  integer,  // offset
  "string",  // timeRange
  "string"  // sensorId
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.aggregate_tools_v1(limit: integer,
                                  offset: integer,
                                  time_range: 'string',
                                  sensor_id: 'string')

puts response

Responses

[
  {
    "Name": "string",
    "count": {}
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

aggregateToolUsageV1

Aggregate tool invocation counts by name (LogScale)

Method GET

Route /aidr/aggregates/tool-usage/v1

Scope Aidr Events: READ

PEP 8 aggregate_aidr_tool_usage

Parameters

limit query · integer

Maximum number of results to return (1-500, default 50)

offset query · integer

Pagination offset (0-1000)

time_range query · string

Lookback period (e.g., 2h, 24h). Max 7d; defaults to 2h if omitted (LogScale-backed)

session_id query · string

Filter by AgenticSessionId

aid query · string

Filter by sensor ID (aid) — identifies a host, not a single agent

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.aggregate_aidr_tool_usage(limit=integer,
                                            offset=integer,
                                            time_range="string",
                                            session_id="string",
                                            aid="string")
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.aggregateToolUsageV1(limit=integer,
                                       offset=integer,
                                       time_range="string",
                                       session_id="string",
                                       aid="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("aggregateToolUsageV1",
                          limit=integer,
                          offset=integer,
                          time_range="string",
                          session_id="string",
                          aid="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)
  timeRange := "string"
  sessionID := "string"
  aid := "string"

  response, err := client.AidrEvents.AggregateToolUsageV1(
    &aidr_events.AggregateToolUsageV1Params{
      Limit: &limit,
      Offset: &offset,
      TimeRange: &timeRange,
      SessionID: &sessionID,
      Aid: &aid,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.aggregateToolUsageV1(
  integer,  // limit
  integer,  // offset
  "string",  // timeRange
  "string",  // sessionId
  "string"  // aid
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.aggregate_tool_usage_v1(limit: integer,
                                       offset: integer,
                                       time_range: 'string',
                                       session_id: 'string',
                                       aid: 'string')

puts response

Responses

[
  {
    "AgenticToolName": "string",
    "count": {}
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

entitiesAgentInstallationsV1

Get AI agent installation details by IDs

Method GET

Route /aidr/entities/agent-installations/v1

Scope Aidr Events: READ

PEP 8 get_aidr_agent_installations

Parameters

ids query · string or list of strings

One or more installation IDs (repeatable). Use the Id value from GET /aidr/queries/agent-installations/v1.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_aidr_agent_installations(ids=id_list)
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entitiesAgentInstallationsV1(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entitiesAgentInstallationsV1",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.AidrEvents.EntitiesAgentInstallationsV1(
    &aidr_events.EntitiesAgentInstallationsV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.entitiesAgentInstallationsV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.entities_agent_installations_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "AgentDeclarationPath": "string",
    "AgentName": "string",
    "AgentProduct": "string",
    "AgentProductName": "string",
    "AgentVersion": "string",
    "BinaryPath": "string",
    "FileSha256": "string",
    "FirstSeen": "string",
    "Hostname": "string",
    "Id": "string",
    "InstallSource": "string",
    "LastExecutionTime": "string",
    "LastInventoryTime": "string",
    "LastSeen": "string",
    "SensorId": "string",
    "SpiffeId": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

entitiesAgentOSUsersV1

Get an OS user by aid + username

Method GET

Route /aidr/entities/agent-os-users/v1

Scope Aidr Events: READ

PEP 8 get_aidr_agent_os_users

Parameters

aid query · string

The OS user’s sensor ID (aid). Required — AIAgentOSUser is keyed on Aid + Username.

username query · string

The OS username. Required — AIAgentOSUser is keyed on Aid + Username.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.get_aidr_agent_os_users(aid="string", username="string")
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.entitiesAgentOSUsersV1(aid="string", username="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("entitiesAgentOSUsersV1",
                          aid="string",
                          username="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.AidrEvents.EntitiesAgentOSUsersV1(
    &aidr_events.EntitiesAgentOSUsersV1Params{
      Aid: "string",
      Username: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.entitiesAgentOSUsersV1(
  "string",  // aid
  "string"  // username
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.entities_agent_os_users_v1('string', 'string')

puts response

Responses

[
  {
    "Aid": "string",
    "FirstSeen": "string",
    "LastSeen": "string",
    "ObjectSid": "string",
    "Username": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

entitiesAgentSessionsV1

Get AI agent session details by IDs

Method GET

Route /aidr/entities/agent-sessions/v1

Scope Aidr Events: READ

PEP 8 get_aidr_agent_sessions

Parameters

ids query · string or list of strings

One or more session IDs (repeatable: ids=A&ids=B). Use the Id value from GET /aidr/queries/agent-sessions/v1. This is the AIAgentSession entity key, not a ThreatGraph vertex key.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_aidr_agent_sessions(ids=id_list)
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entitiesAgentSessionsV1(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entitiesAgentSessionsV1",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.AidrEvents.EntitiesAgentSessionsV1(
    &aidr_events.EntitiesAgentSessionsV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.entitiesAgentSessionsV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.entities_agent_sessions_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "Cim": {},
    "FirstSeen": "string",
    "Id": "string",
    "LastSeen": "string",
    "Name": "string",
    "Product": "string",
    "ProductName": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

entitiesAgentsV1

Get AI agent details by IDs

Method GET

Route /aidr/entities/agents/v1

Scope Aidr Events: READ

PEP 8 get_aidr_agents

Parameters

ids query · string or list of strings

One or more AIAgent IDs (repeatable: ids=A&ids=B). This is the 64-hex content hash from the Id field of GET /aidr/queries/agents/v1 — NOT the 32-hex SensorId.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_aidr_agents(ids=id_list)
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entitiesAgentsV1(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entitiesAgentsV1",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.AidrEvents.EntitiesAgentsV1(
    &aidr_events.EntitiesAgentsV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.entitiesAgentsV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.entities_agents_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "AgentIds": [],
    "AgentName": "string",
    "AgentProduct": "string",
    "AgentProductName": "string",
    "CreatedTime": "string",
    "FirstSeen": "string",
    "Hostname": "string",
    "Id": "string",
    "LastExecutionTime": "string",
    "LastInventoryTime": "string",
    "LastSeen": "string",
    "SensorId": "string",
    "SpiffeId": "string",
    "UpdatedTime": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

entitiesClassifiedFileAccessV1

Get FDP classified file access for a process

Method GET

Route /aidr/entities/classified-file-access/v1

Scope Aidr Events: READ

PEP 8 get_aidr_classified_file_access

Parameters

id query · string

A process vertex ID of the form pid:{aid}:{process_id}. Obtain it from a process node in GET /aidr/entities/process-tree/v1 or /aidr/entities/session-activity/v1 (the process __id). A session ID is NOT accepted here — this endpoint does not resolve it.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_aidr_classified_file_access(id=id_list)
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entitiesClassifiedFileAccessV1(id=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("entitiesClassifiedFileAccessV1",
                          id="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.AidrEvents.EntitiesClassifiedFileAccessV1(
    &aidr_events.EntitiesClassifiedFileAccessV1Params{
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.entitiesClassifiedFileAccessV1("string");  // id

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.entities_classified_file_access_v1('string')

puts response

Responses

[
  {
    "classified_file_accesses": [],
    "command_line": "string",
    "image_file_name": "string",
    "process_id": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

entitiesExecutionsV1

Get AI agent execution detail by session ID

Method GET

Route /aidr/entities/executions/v1

Scope Aidr Events: READ

PEP 8 get_aidr_executions

Parameters

id query · string

A session ID (AgenticSessionId from GET /aidr/queries/executions/v1 or /aidr/queries/agent-sessions/v1). Returns the process invocation(s) for that session; add context_process_id to narrow to a single execution.

context_process_id query · string

Narrow an execution to a single process invocation (ContextProcessId from GET /aidr/queries/executions/v1)

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.get_aidr_executions(id="string", context_process_id="string")
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.entitiesExecutionsV1(id="string", context_process_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("entitiesExecutionsV1",
                          id="string",
                          context_process_id="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  contextProcessID := "string"

  response, err := client.AidrEvents.EntitiesExecutionsV1(
    &aidr_events.EntitiesExecutionsV1Params{
      ID: "string",
      ContextProcessID: &contextProcessID,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.entitiesExecutionsV1(
  "string",  // id
  "string"  // contextProcessId
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.entities_executions_v1('string')

puts response

Responses

[
  {
    "AgenticInputTokens": {},
    "AgenticModel": "string",
    "AgenticOutputTokens": {},
    "AgenticSessionId": "string",
    "AgenticWorkingDirectory": "string",
    "ContextProcessId": "string",
    "ProcessTags": [],
    "aid": "string",
    "timestamp": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

entitiesFileEventsV1

Get file write activity from AI session processes

Method GET

Route /aidr/entities/file-events/v1

Scope Aidr Events: READ

PEP 8 get_aidr_file_events

Parameters

id query · string

A session ID. Accepts either the AgenticSessionId from GET /aidr/queries/executions/v1 (resolved automatically) or a ThreatGraph vertex key aisess:{aid}:{session_id}. This is session-scoped — pass a session ID, not a process ID.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_aidr_file_events(id=id_list)
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entitiesFileEventsV1(id=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("entitiesFileEventsV1",
                          id="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.AidrEvents.EntitiesFileEventsV1(
    &aidr_events.EntitiesFileEventsV1Params{
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.entitiesFileEventsV1("string");  // id

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.entities_file_events_v1('string')

puts response

Responses

[
  {
    "SessionProcessPid": [],
    "__id": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

entitiesModelNamesV1

Get AI model name details by IDs

Method GET

Route /aidr/entities/model-names/v1

Scope Aidr Events: READ

PEP 8 get_aidr_model_names

Parameters

ids query · string or list of strings

One or more AIModelName IDs (repeatable). Use the Id value from GET /aidr/queries/model-names/v1.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_aidr_model_names(ids=id_list)
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entitiesModelNamesV1(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entitiesModelNamesV1",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.AidrEvents.EntitiesModelNamesV1(
    &aidr_events.EntitiesModelNamesV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.entitiesModelNamesV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.entities_model_names_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "Cim": {},
    "FirstSeen": "string",
    "Id": "string",
    "LastInventoryTime": "string",
    "LastSeen": "string",
    "LastUsedTime": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

entitiesNetworkEventsV1

Get outbound network connections from AI session processes

Method GET

Route /aidr/entities/network-events/v1

Scope Aidr Events: READ

PEP 8 get_aidr_network_events

Parameters

id query · string

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_aidr_network_events(id=id_list)
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entitiesNetworkEventsV1(id=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("entitiesNetworkEventsV1",
                          id="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.AidrEvents.EntitiesNetworkEventsV1(
    &aidr_events.EntitiesNetworkEventsV1Params{
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.entitiesNetworkEventsV1("string");  // id

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.entities_network_events_v1('string')

puts response

Responses

[
  {
    "SessionProcessPid": [],
    "__id": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

entitiesProcessTreeV1

Get spawned process tree for an AI session

Method GET

Route /aidr/entities/process-tree/v1

Scope Aidr Events: READ

PEP 8 get_aidr_process_tree

Parameters

id query · string

depth query · integer

Process tree depth (1=direct spawns, 2=grandchildren, 3=max). Default 2

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.get_aidr_process_tree(id="string", depth=integer)
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.entitiesProcessTreeV1(id="string", depth=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("entitiesProcessTreeV1",
                          id="string",
                          depth=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  depth := int64(0)

  response, err := client.AidrEvents.EntitiesProcessTreeV1(
    &aidr_events.EntitiesProcessTreeV1Params{
      ID: "string",
      Depth: &depth,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.entitiesProcessTreeV1(
  "string",  // id
  integer  // depth
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.entities_process_tree_v1('string')

puts response

Responses

[
  {
    "SessionProcessPid": [],
    "__id": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

entitiesSessionActivityV1

Get ThreatGraph session activity (tools, models, processes)

Method GET

Route /aidr/entities/session-activity/v1

Scope Aidr Events: READ

PEP 8 get_aidr_session_activity

Parameters

ids query · string or list of strings

One or more session IDs (repeatable). Accepts either the AgenticSessionId from GET /aidr/queries/executions/v1 (resolved to a graph vertex automatically) or a ThreatGraph vertex key aisess:{aid}:{session_id} (aid = the session’s aid; the sess- prefix is stripped).

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_aidr_session_activity(ids=id_list)
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entitiesSessionActivityV1(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entitiesSessionActivityV1",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.AidrEvents.EntitiesSessionActivityV1(
    &aidr_events.EntitiesSessionActivityV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.entitiesSessionActivityV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.entities_session_activity_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "AgenticProduct": "string",
    "AgenticSessionId": "string",
    "ChildSessionAisess": [],
    "ConnectedMcpMcpsrv": [],
    "DisplayName": "string",
    "InvokesModelAimod": [],
    "LoadedSkillAiskill": [],
    "SessionProcessPid": [],
    "SessionRunByAiagent": [],
    "UsedToolAitool": [],
    "__id": "string",
    "__typename": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

entitiesSkillsV1

Get AI skill frontmatter details by IDs

Method GET

Route /aidr/entities/skills/v1

Scope Aidr Events: READ

PEP 8 get_aidr_skills

Parameters

ids query · string or list of strings

One or more skill frontmatter IDs (repeatable). Use the Id value from GET /aidr/queries/skills/v1.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_aidr_skills(ids=id_list)
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entitiesSkillsV1(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entitiesSkillsV1",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.AidrEvents.EntitiesSkillsV1(
    &aidr_events.EntitiesSkillsV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.entitiesSkillsV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.entities_skills_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "CreatedTime": "string",
    "FirstSeen": "string",
    "Id": "string",
    "LastInventoryTime": "string",
    "LastSeen": "string",
    "SkillDescription": "string",
    "SkillDirectoryHash": "string",
    "SkillName": "string",
    "UpdatedTime": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

entitiesToolsV1

Get AI tool details by IDs

Method GET

Route /aidr/entities/tools/v1

Scope Aidr Events: READ

PEP 8 get_aidr_tools

Parameters

ids query · string or list of strings

One or more AITool IDs (repeatable: ids=A&ids=B). Use the Id value from GET /aidr/queries/tools/v1.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_aidr_tools(ids=id_list)
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entitiesToolsV1(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entitiesToolsV1",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.AidrEvents.EntitiesToolsV1(
    &aidr_events.EntitiesToolsV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.entitiesToolsV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.entities_tools_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "Cim": {},
    "FirstSeen": "string",
    "Id": "string",
    "LastSeen": "string",
    "Name": "string",
    "SensorId": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

queryAgentInstallationsV1

List AI agent installations

Method GET

Route /aidr/queries/agent-installations/v1

Scope Aidr Events: READ

PEP 8 query_aidr_agent_installations

Parameters

limit query · integer

Maximum number of results to return (1-500, default 50)

offset query · integer

Pagination offset (0-1000)

time_range query · string

Lookback period (e.g., 7d, 24h). Max 90d

sensor_id query · string

Filter by sensor ID (32-hex aid / AIAgent.SensorId)

product query · string

Filter by AI product name (e.g., CLAUDE_CODE, CURSOR)

hostname query · string

Filter by hostname of the device running the agent

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.query_aidr_agent_installations(limit=integer,
                                                 offset=integer,
                                                 time_range="string",
                                                 sensor_id="string",
                                                 product="string",
                                                 hostname="string")
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.queryAgentInstallationsV1(limit=integer,
                                            offset=integer,
                                            time_range="string",
                                            sensor_id="string",
                                            product="string",
                                            hostname="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryAgentInstallationsV1",
                          limit=integer,
                          offset=integer,
                          time_range="string",
                          sensor_id="string",
                          product="string",
                          hostname="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)
  timeRange := "string"
  sensorID := "string"
  product := "string"
  hostname := "string"

  response, err := client.AidrEvents.QueryAgentInstallationsV1(
    &aidr_events.QueryAgentInstallationsV1Params{
      Limit: &limit,
      Offset: &offset,
      TimeRange: &timeRange,
      SensorID: &sensorID,
      Product: &product,
      Hostname: &hostname,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.queryAgentInstallationsV1(
  integer,  // limit
  integer,  // offset
  "string",  // timeRange
  "string",  // sensorId
  "string",  // product
  "string"  // hostname
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.query_agent_installations_v1(limit: integer,
                                            offset: integer,
                                            time_range: 'string',
                                            sensor_id: 'string',
                                            product: 'string',
                                            hostname: 'string')

puts response

Responses

[
  {
    "AgentDeclarationPath": "string",
    "AgentName": "string",
    "AgentProduct": "string",
    "AgentProductName": "string",
    "AgentVersion": "string",
    "BinaryPath": "string",
    "FileSha256": "string",
    "FirstSeen": "string",
    "Hostname": "string",
    "Id": "string",
    "InstallSource": "string",
    "LastExecutionTime": "string",
    "LastInventoryTime": "string",
    "LastSeen": "string",
    "SensorId": "string",
    "SpiffeId": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

queryAgentOSUsersV1

List OS users that ran AI agents

Method GET

Route /aidr/queries/agent-os-users/v1

Scope Aidr Events: READ

PEP 8 query_aidr_agent_os_users

Parameters

limit query · integer

Maximum number of results to return (1-500, default 50)

offset query · integer

Pagination offset (0-1000)

time_range query · string

Lookback period (e.g., 7d, 24h). Max 90d

object_sid query · string

Filter by the OS user’s ObjectSid (AD security identifier)

aid query · string

Filter by sensor ID (aid) — identifies a host, not a single agent

username query · string

Filter by OS username

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.query_aidr_agent_os_users(limit=integer,
                                            offset=integer,
                                            time_range="string",
                                            object_sid="string",
                                            aid="string",
                                            username="string")
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.queryAgentOSUsersV1(limit=integer,
                                      offset=integer,
                                      time_range="string",
                                      object_sid="string",
                                      aid="string",
                                      username="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryAgentOSUsersV1",
                          limit=integer,
                          offset=integer,
                          time_range="string",
                          object_sid="string",
                          aid="string",
                          username="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)
  timeRange := "string"
  objectSid := "string"
  aid := "string"
  username := "string"

  response, err := client.AidrEvents.QueryAgentOSUsersV1(
    &aidr_events.QueryAgentOSUsersV1Params{
      Limit: &limit,
      Offset: &offset,
      TimeRange: &timeRange,
      ObjectSid: &objectSid,
      Aid: &aid,
      Username: &username,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.queryAgentOSUsersV1(
  integer,  // limit
  integer,  // offset
  "string",  // timeRange
  "string",  // objectSid
  "string",  // aid
  "string"  // username
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.query_agent_os_users_v1(limit: integer,
                                       offset: integer,
                                       time_range: 'string',
                                       object_sid: 'string',
                                       aid: 'string',
                                       username: 'string')

puts response

Responses

[
  {
    "Aid": "string",
    "FirstSeen": "string",
    "LastSeen": "string",
    "ObjectSid": "string",
    "Username": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

queryAgentSessionsV1

List AI agent sessions

Method GET

Route /aidr/queries/agent-sessions/v1

Scope Aidr Events: READ

PEP 8 query_aidr_agent_sessions

Parameters

limit query · integer

Maximum number of results to return (1-500, default 50)

offset query · integer

Pagination offset (0-1000)

time_range query · string

Lookback period (e.g., 7d, 24h). Max 90d

product query · string

Filter by AI product name (e.g., CLAUDE_CODE, CURSOR)

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.query_aidr_agent_sessions(limit=integer,
                                            offset=integer,
                                            time_range="string",
                                            product="string")
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.queryAgentSessionsV1(limit=integer,
                                       offset=integer,
                                       time_range="string",
                                       product="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryAgentSessionsV1",
                          limit=integer,
                          offset=integer,
                          time_range="string",
                          product="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)
  timeRange := "string"
  product := "string"

  response, err := client.AidrEvents.QueryAgentSessionsV1(
    &aidr_events.QueryAgentSessionsV1Params{
      Limit: &limit,
      Offset: &offset,
      TimeRange: &timeRange,
      Product: &product,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.queryAgentSessionsV1(
  integer,  // limit
  integer,  // offset
  "string",  // timeRange
  "string"  // product
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.query_agent_sessions_v1(limit: integer,
                                       offset: integer,
                                       time_range: 'string',
                                       product: 'string')

puts response

Responses

[
  {
    "Cim": {},
    "FirstSeen": "string",
    "Id": "string",
    "LastSeen": "string",
    "Name": "string",
    "Product": "string",
    "ProductName": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

queryAgentsV1

List AI agent instances

Method GET

Route /aidr/queries/agents/v1

Scope Aidr Events: READ

PEP 8 query_aidr_agents

Parameters

limit query · integer

Maximum number of results to return (1-500, default 50)

offset query · integer

Pagination offset (0-1000)

time_range query · string

Lookback period (e.g., 7d, 24h). Max 90d

product query · string

Filter by AI product name (e.g., CLAUDE_CODE, CURSOR)

hostname query · string

Filter by hostname of the device running the agent

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.query_aidr_agents(limit=integer,
                                    offset=integer,
                                    time_range="string",
                                    product="string",
                                    hostname="string")
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.queryAgentsV1(limit=integer,
                                offset=integer,
                                time_range="string",
                                product="string",
                                hostname="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryAgentsV1",
                          limit=integer,
                          offset=integer,
                          time_range="string",
                          product="string",
                          hostname="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)
  timeRange := "string"
  product := "string"
  hostname := "string"

  response, err := client.AidrEvents.QueryAgentsV1(
    &aidr_events.QueryAgentsV1Params{
      Limit: &limit,
      Offset: &offset,
      TimeRange: &timeRange,
      Product: &product,
      Hostname: &hostname,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.queryAgentsV1(
  integer,  // limit
  integer,  // offset
  "string",  // timeRange
  "string",  // product
  "string"  // hostname
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.query_agents_v1(limit: integer,
                               offset: integer,
                               time_range: 'string',
                               product: 'string',
                               hostname: 'string')

puts response

Responses

[
  {
    "AgentIds": [],
    "AgentName": "string",
    "AgentProduct": "string",
    "AgentProductName": "string",
    "CreatedTime": "string",
    "FirstSeen": "string",
    "Hostname": "string",
    "Id": "string",
    "LastExecutionTime": "string",
    "LastInventoryTime": "string",
    "LastSeen": "string",
    "SensorId": "string",
    "SpiffeId": "string",
    "UpdatedTime": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

queryDetectionsV1

List detections involving AI agent processes

Method GET

Route /aidr/queries/detections/v1

Scope Aidr Events: READ

PEP 8 query_aidr_detections

Parameters

limit query · integer

Maximum number of results to return (1-500, default 50)

offset query · integer

Pagination offset (0-1000)

time_range query · string

Lookback period (e.g., 7d, 24h). Max 90d

agent_id query · string

Filter by agent ID (see endpoint notes: some use the 64-hex AIAgent.Id, detections use the 32-hex SensorId)

product query · string

Filter by AI product name (e.g., CLAUDE_CODE, CURSOR)

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.query_aidr_detections(limit=integer,
                                        offset=integer,
                                        time_range="string",
                                        agent_id="string",
                                        product="string")
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.queryDetectionsV1(limit=integer,
                                    offset=integer,
                                    time_range="string",
                                    agent_id="string",
                                    product="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryDetectionsV1",
                          limit=integer,
                          offset=integer,
                          time_range="string",
                          agent_id="string",
                          product="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)
  timeRange := "string"
  agentID := "string"
  product := "string"

  response, err := client.AidrEvents.QueryDetectionsV1(
    &aidr_events.QueryDetectionsV1Params{
      Limit: &limit,
      Offset: &offset,
      TimeRange: &timeRange,
      AgentID: &agentID,
      Product: &product,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.queryDetectionsV1(
  integer,  // limit
  integer,  // offset
  "string",  // timeRange
  "string",  // agentId
  "string"  // product
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.query_detections_v1(limit: integer,
                                   offset: integer,
                                   time_range: 'string',
                                   agent_id: 'string',
                                   product: 'string')

puts response

Responses

[
  {
    "AgentId": "string",
    "AgenticProductTag": "string",
    "AgenticProductTagName": "string",
    "AssignedToName": "string",
    "CompositeId": "string",
    "CreatedTimestamp": "string",
    "DataDomains": "string",
    "HasAgenticProcess": false,
    "Name": "string",
    "Product": "string",
    "RiskScore": 0,
    "Severity": 0,
    "SeverityName": "string",
    "Sha256": "string",
    "SourceHosts": "string",
    "SourceProducts": "string",
    "Status": "string",
    "Tactic": "string",
    "Technique": "string",
    "Timestamp": "string",
    "UserNames": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

queryExecutionsV1

List AI agent process executions

Method GET

Route /aidr/queries/executions/v1

Scope Aidr Events: READ

PEP 8 query_aidr_executions

Parameters

limit query · integer

Maximum number of results to return (1-500, default 50)

offset query · integer

Pagination offset (0-1000)

time_range query · string

Lookback period (e.g., 2h, 24h). Max 7d; defaults to 2h if omitted (LogScale-backed)

session_id query · string

Filter by AgenticSessionId

aid query · string

Filter by sensor ID (aid) — identifies a host, not a single agent

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.query_aidr_executions(limit=integer,
                                        offset=integer,
                                        time_range="string",
                                        session_id="string",
                                        aid="string")
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.queryExecutionsV1(limit=integer,
                                    offset=integer,
                                    time_range="string",
                                    session_id="string",
                                    aid="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryExecutionsV1",
                          limit=integer,
                          offset=integer,
                          time_range="string",
                          session_id="string",
                          aid="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)
  timeRange := "string"
  sessionID := "string"
  aid := "string"

  response, err := client.AidrEvents.QueryExecutionsV1(
    &aidr_events.QueryExecutionsV1Params{
      Limit: &limit,
      Offset: &offset,
      TimeRange: &timeRange,
      SessionID: &sessionID,
      Aid: &aid,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.queryExecutionsV1(
  integer,  // limit
  integer,  // offset
  "string",  // timeRange
  "string",  // sessionId
  "string"  // aid
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.query_executions_v1(limit: integer,
                                   offset: integer,
                                   time_range: 'string',
                                   session_id: 'string',
                                   aid: 'string')

puts response

Responses

[
  {
    "AgenticInputTokens": {},
    "AgenticModel": "string",
    "AgenticOutputTokens": {},
    "AgenticSessionId": "string",
    "AgenticWorkingDirectory": "string",
    "ContextProcessId": "string",
    "ProcessTags": [],
    "aid": "string",
    "timestamp": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

queryMcpServerNamesV1

List MCP server names

Method GET

Route /aidr/queries/mcp-server-names/v1

Scope Aidr Events: READ

PEP 8 query_aidr_mcp_server_names

Parameters

limit query · integer

Maximum number of results to return (1-500, default 50)

offset query · integer

Pagination offset (0-1000)

time_range query · string

Lookback period (e.g., 7d, 24h). Max 90d

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.query_aidr_mcp_server_names(limit=integer,
                                              offset=integer,
                                              time_range="string")
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.queryMcpServerNamesV1(limit=integer,
                                        offset=integer,
                                        time_range="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryMcpServerNamesV1",
                          limit=integer,
                          offset=integer,
                          time_range="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)
  timeRange := "string"

  response, err := client.AidrEvents.QueryMcpServerNamesV1(
    &aidr_events.QueryMcpServerNamesV1Params{
      Limit: &limit,
      Offset: &offset,
      TimeRange: &timeRange,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.queryMcpServerNamesV1(
  integer,  // limit
  integer,  // offset
  "string"  // timeRange
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.query_mcp_server_names_v1(limit: integer,
                                         offset: integer,
                                         time_range: 'string')

puts response

Responses

[
  {
    "Cim": {},
    "FirstSeen": "string",
    "Id": "string",
    "LastInventoryTime": "string",
    "LastSeen": "string",
    "LastUsedTime": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

queryModelNamesV1

List AI model names

Method GET

Route /aidr/queries/model-names/v1

Scope Aidr Events: READ

PEP 8 query_aidr_model_names

Parameters

limit query · integer

Maximum number of results to return (1-500, default 50)

offset query · integer

Pagination offset (0-1000)

time_range query · string

Lookback period (e.g., 7d, 24h). Max 90d

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.query_aidr_model_names(limit=integer,
                                         offset=integer,
                                         time_range="string")
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.queryModelNamesV1(limit=integer,
                                    offset=integer,
                                    time_range="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryModelNamesV1",
                          limit=integer,
                          offset=integer,
                          time_range="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)
  timeRange := "string"

  response, err := client.AidrEvents.QueryModelNamesV1(
    &aidr_events.QueryModelNamesV1Params{
      Limit: &limit,
      Offset: &offset,
      TimeRange: &timeRange,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.queryModelNamesV1(
  integer,  // limit
  integer,  // offset
  "string"  // timeRange
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.query_model_names_v1(limit: integer,
                                    offset: integer,
                                    time_range: 'string')

puts response

Responses

[
  {
    "Cim": {},
    "FirstSeen": "string",
    "Id": "string",
    "LastInventoryTime": "string",
    "LastSeen": "string",
    "LastUsedTime": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

queryPromptsV1

List AI prompt records

Method GET

Route /aidr/queries/prompts/v1

Scope Aidr Events: READ

PEP 8 query_aidr_prompts

Parameters

limit query · integer

Maximum number of results to return (1-500, default 50)

offset query · integer

Pagination offset (0-1000)

time_range query · string

Lookback period (e.g., 2h, 24h). Max 7d; defaults to 2h if omitted (LogScale-backed)

session_id query · string

Filter by AgenticSessionId

aid query · string

Filter by sensor ID (aid) — identifies a host, not a single agent

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.query_aidr_prompts(limit=integer,
                                     offset=integer,
                                     time_range="string",
                                     session_id="string",
                                     aid="string")
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.queryPromptsV1(limit=integer,
                                 offset=integer,
                                 time_range="string",
                                 session_id="string",
                                 aid="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryPromptsV1",
                          limit=integer,
                          offset=integer,
                          time_range="string",
                          session_id="string",
                          aid="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)
  timeRange := "string"
  sessionID := "string"
  aid := "string"

  response, err := client.AidrEvents.QueryPromptsV1(
    &aidr_events.QueryPromptsV1Params{
      Limit: &limit,
      Offset: &offset,
      TimeRange: &timeRange,
      SessionID: &sessionID,
      Aid: &aid,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.queryPromptsV1(
  integer,  // limit
  integer,  // offset
  "string",  // timeRange
  "string",  // sessionId
  "string"  // aid
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.query_prompts_v1(limit: integer,
                                offset: integer,
                                time_range: 'string',
                                session_id: 'string',
                                aid: 'string')

puts response

Responses

[
  {
    "AgenticPrompt": "string",
    "AgenticSessionId": "string",
    "ProcessTags": [],
    "aid": "string",
    "timestamp": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

querySkillsV1

List AI skill frontmatters

Method GET

Route /aidr/queries/skills/v1

Scope Aidr Events: READ

PEP 8 query_aidr_skills

Parameters

limit query · integer

Maximum number of results to return (1-500, default 50)

offset query · integer

Pagination offset (0-1000)

time_range query · string

Lookback period (e.g., 7d, 24h). Max 90d

name_filter query · string

Filter by name pattern (supports wildcards via like)

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.query_aidr_skills(limit=integer,
                                    offset=integer,
                                    time_range="string",
                                    name_filter="string")
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.querySkillsV1(limit=integer,
                                offset=integer,
                                time_range="string",
                                name_filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("querySkillsV1",
                          limit=integer,
                          offset=integer,
                          time_range="string",
                          name_filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)
  timeRange := "string"
  nameFilter := "string"

  response, err := client.AidrEvents.QuerySkillsV1(
    &aidr_events.QuerySkillsV1Params{
      Limit: &limit,
      Offset: &offset,
      TimeRange: &timeRange,
      NameFilter: &nameFilter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.querySkillsV1(
  integer,  // limit
  integer,  // offset
  "string",  // timeRange
  "string"  // nameFilter
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.query_skills_v1(limit: integer,
                               offset: integer,
                               time_range: 'string',
                               name_filter: 'string')

puts response

Responses

[
  {
    "CreatedTime": "string",
    "FirstSeen": "string",
    "Id": "string",
    "LastInventoryTime": "string",
    "LastSeen": "string",
    "SkillDescription": "string",
    "SkillDirectoryHash": "string",
    "SkillName": "string",
    "UpdatedTime": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

querySkillUsageV1

List AI skill invocations (LogScale, session-scoped)

Method GET

Route /aidr/queries/skill-usage/v1

Scope Aidr Events: READ

PEP 8 query_aidr_skill_usage

Parameters

limit query · integer

Maximum number of results to return (1-500, default 50)

offset query · integer

Pagination offset (0-1000)

time_range query · string

Lookback period (e.g., 2h, 24h). Max 7d; defaults to 2h if omitted (LogScale-backed)

name query · string

Filter skill invocations by skill name (matches AgenticSkill exactly)

session_id query · string

Filter by AgenticSessionId

aid query · string

Filter by sensor ID (aid) — identifies a host, not a single agent

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.query_aidr_skill_usage(limit=integer,
                                         offset=integer,
                                         time_range="string",
                                         name="string",
                                         session_id="string",
                                         aid="string")
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.querySkillUsageV1(limit=integer,
                                    offset=integer,
                                    time_range="string",
                                    name="string",
                                    session_id="string",
                                    aid="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("querySkillUsageV1",
                          limit=integer,
                          offset=integer,
                          time_range="string",
                          name="string",
                          session_id="string",
                          aid="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)
  timeRange := "string"
  name := "string"
  sessionID := "string"
  aid := "string"

  response, err := client.AidrEvents.QuerySkillUsageV1(
    &aidr_events.QuerySkillUsageV1Params{
      Limit: &limit,
      Offset: &offset,
      TimeRange: &timeRange,
      Name: &name,
      SessionID: &sessionID,
      Aid: &aid,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.querySkillUsageV1(
  integer,  // limit
  integer,  // offset
  "string",  // timeRange
  "string",  // name
  "string",  // sessionId
  "string"  // aid
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.query_skill_usage_v1(limit: integer,
                                    offset: integer,
                                    time_range: 'string',
                                    name: 'string',
                                    session_id: 'string',
                                    aid: 'string')

puts response

Responses

[
  {
    "AgenticSessionId": "string",
    "AgenticSkill": "string",
    "AgenticToolUseId": "string",
    "aid": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

queryToolsV1

List AI tools

Method GET

Route /aidr/queries/tools/v1

Scope Aidr Events: READ

PEP 8 query_aidr_tools

Parameters

limit query · integer

Maximum number of results to return (1-500, default 50)

offset query · integer

Pagination offset (0-1000)

time_range query · string

Lookback period (e.g., 7d, 24h). Max 90d

sensor_id query · string

Filter by sensor ID (32-hex aid / AIAgent.SensorId)

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.query_aidr_tools(limit=integer,
                                   offset=integer,
                                   time_range="string",
                                   sensor_id="string")
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.queryToolsV1(limit=integer,
                               offset=integer,
                               time_range="string",
                               sensor_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryToolsV1",
                          limit=integer,
                          offset=integer,
                          time_range="string",
                          sensor_id="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)
  timeRange := "string"
  sensorID := "string"

  response, err := client.AidrEvents.QueryToolsV1(
    &aidr_events.QueryToolsV1Params{
      Limit: &limit,
      Offset: &offset,
      TimeRange: &timeRange,
      SensorID: &sensorID,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.queryToolsV1(
  integer,  // limit
  integer,  // offset
  "string",  // timeRange
  "string"  // sensorId
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.query_tools_v1(limit: integer,
                              offset: integer,
                              time_range: 'string',
                              sensor_id: 'string')

puts response

Responses

[
  {
    "Cim": {},
    "FirstSeen": "string",
    "Id": "string",
    "LastSeen": "string",
    "Name": "string",
    "SensorId": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

queryToolUsageV1

List AI tool invocations (LogScale, session-scoped)

Method GET

Route /aidr/queries/tool-usage/v1

Scope Aidr Events: READ

PEP 8 query_aidr_tool_usage

Parameters

limit query · integer

Maximum number of results to return (1-500, default 50)

offset query · integer

Pagination offset (0-1000)

time_range query · string

Lookback period (e.g., 2h, 24h). Max 7d; defaults to 2h if omitted (LogScale-backed)

tool_name query · string

Filter tool invocations by tool name (e.g., Bash, Read, Write, Edit)

session_id query · string

Filter by AgenticSessionId

aid query · string

Filter by sensor ID (aid) — identifies a host, not a single agent

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.query_aidr_tool_usage(limit=integer,
                                        offset=integer,
                                        time_range="string",
                                        tool_name="string",
                                        session_id="string",
                                        aid="string")
print(response)

from falconpy import AIDR

falcon = AIDR(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.queryToolUsageV1(limit=integer,
                                   offset=integer,
                                   time_range="string",
                                   tool_name="string",
                                   session_id="string",
                                   aid="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryToolUsageV1",
                          limit=integer,
                          offset=integer,
                          time_range="string",
                          tool_name="string",
                          session_id="string",
                          aid="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/aidr_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)
  timeRange := "string"
  toolName := "string"
  sessionID := "string"
  aid := "string"

  response, err := client.AidrEvents.QueryToolUsageV1(
    &aidr_events.QueryToolUsageV1Params{
      Limit: &limit,
      Offset: &offset,
      TimeRange: &timeRange,
      ToolName: &toolName,
      SessionID: &sessionID,
      Aid: &aid,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.aidrEvents.queryToolUsageV1(
  integer,  // limit
  integer,  // offset
  "string",  // timeRange
  "string",  // toolName
  "string",  // sessionId
  "string"  // aid
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::AidrEvents.new

response = api.query_tool_usage_v1(limit: integer,
                                   offset: integer,
                                   time_range: 'string',
                                   tool_name: 'string',
                                   session_id: 'string',
                                   aid: 'string')

puts response

Responses

[
  {
    "AgenticDescription": "string",
    "AgenticPath": "string",
    "AgenticPattern": "string",
    "AgenticQuery": "string",
    "AgenticSessionId": "string",
    "AgenticSkill": "string",
    "AgenticTool": "string",
    "AgenticToolName": "string",
    "AgenticToolUseId": "string",
    "CommandLine": "string",
    "Url": "string",
    "aid": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

{
  "errors": [
    {
      "code": 0,
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {}
  ]
}

AIDR

Table of Contents

aggregateAgentSessionsV1

Parameters

aggregateAgentsV1

Parameters

aggregateDetectionsV1

Parameters

aggregateSkillsV1

Parameters

aggregateSkillUsageV1

Parameters

aggregateToolsV1

Parameters

aggregateToolUsageV1

Parameters

entitiesAgentInstallationsV1

Parameters

entitiesAgentOSUsersV1

Parameters

entitiesAgentSessionsV1

Parameters

entitiesAgentsV1

Parameters

entitiesClassifiedFileAccessV1

Parameters

entitiesExecutionsV1

Parameters

entitiesFileEventsV1

Parameters

entitiesModelNamesV1

Parameters

entitiesNetworkEventsV1

Parameters

entitiesProcessTreeV1

Parameters

entitiesSessionActivityV1

Parameters

entitiesSkillsV1

Parameters

entitiesToolsV1

Parameters

queryAgentInstallationsV1

Parameters

queryAgentOSUsersV1

Parameters

queryAgentSessionsV1

Parameters

queryAgentsV1

Parameters

queryDetectionsV1

Parameters

queryExecutionsV1

Parameters

queryMcpServerNamesV1

Parameters

queryModelNamesV1

Parameters

queryPromptsV1

Parameters

querySkillsV1

Parameters

querySkillUsageV1

Parameters

queryToolsV1

Parameters

queryToolUsageV1

Parameters