Application Abuse Exclusions

Operations for the Application Abuse Exclusions service collection.

Language	Last Update
Python	v1.6.6
PowerShell
Go	v0.24.0
TypeScript	v0.9.0
Rust
Ruby	v1.6.0

Operation	Description
app-abuse-exclusions.aggregates.v1 `aggregate_app_abuse_exclusions`	Get Application Abuse Exclusion aggregates as specified via json in the request body
app-abuse-exclusions.create.v1 `create_app_abuse_exclusion`	Create new Application Abuse Exclusions
app-abuse-exclusions.delete.v1 `delete_app_abuse_exclusions`	Delete Application Abuse Exclusions by IDs
app-abuse-exclusions.get-apps-by-category.v1 `get_app_abuse_apps_by_category`	Get available applications filtered by Application Abuse Prevention category
app-abuse-exclusions.get-categories.v1 `get_app_abuse_categories`	Get available Application Abuse Prevention categories
app-abuse-exclusions.get.v1 `get_app_abuse_exclusions`	Get Application Abuse Exclusions by IDs
app-abuse-exclusions.query.v1 `query_app_abuse_exclusions`	Search for Application Abuse Exclusions
app-abuse-exclusions.report.v1 `create_app_abuse_report`	Create a report of Application Abuse Exclusions scoped by the given filters
app-abuse-exclusions.update.v1 `update_app_abuse_exclusions`	Update existing Application Abuse Exclusions

app-abuse-exclusions.aggregates.v1

Get Application Abuse Exclusion aggregates as specified via json in the request body

Method POST

Route /exclusions/aggregates/app-abuse-exclusions/GET/v1

Scope App Abuse Exclusions: READ

PEP 8 aggregate_app_abuse_exclusions

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

date_ranges body · array

List of date range objects.

exclude body · string

extended_bounds body · object

field body · string

The field to aggregate on.

filter body · string

FQL filter expression.

filters_spec body · object

from body · integer

include body · string

interval body · string

Time interval for aggregation.

max_doc_count body · integer

min_doc_count body · integer

Minimum document count threshold.

missing body · string

Missing value handling.

name body · string

Name of the aggregation.

percents body · array

q body · string

Full text search across all metadata fields.

ranges body · array

List of range objects.

size body · integer

Maximum number of results.

sort body · string

Sort expression.

sub_aggregates body · array

List of sub-aggregate expressions.

time_zone body · string

Time zone for date operations.

type body · string

Type of aggregation (terms, date_histogram, etc.)

Code Examples

from falconpy import ApplicationAbuseExclusions

falcon = ApplicationAbuseExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

ranges = [
    {
        "From": 0,
        "To": 0
    }
]

response = falcon.aggregate_app_abuse_exclusions(date_ranges=date_ranges,
                                                 field="string",
                                                 filter="string",
                                                 interval="string",
                                                 min_doc_count=integer,
                                                 missing="string",
                                                 name="string",
                                                 q="string",
                                                 ranges=ranges,
                                                 size=integer,
                                                 sort="string",
                                                 sub_aggregates=["string"],
                                                 time_zone="string",
                                                 type="string")
print(response)

from falconpy import ApplicationAbuseExclusions

falcon = ApplicationAbuseExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

ranges = [
    {
        "From": 0,
        "To": 0
    }
]

response = falcon.app_abuse_exclusions_aggregates_v1(date_ranges=date_ranges,
                                                     field="string",
                                                     filter="string",
                                                     interval="string",
                                                     min_doc_count=integer,
                                                     missing="string",
                                                     name="string",
                                                     q="string",
                                                     ranges=ranges,
                                                     size=integer,
                                                     sort="string",
                                                     sub_aggregates=["string"],
                                                     time_zone="string",
                                                     type="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "date_ranges": [
        {
            "from": "string",
            "to": "string"
        }
    ],
    "exclude": "string",
    "extended_bounds": {
        "max": "string",
        "min": "string"
    },
    "field": "string",
    "filter": "string",
    "filters_spec": {
        "filters": {},
        "other_bucket": boolean,
        "other_bucket_key": "string"
    },
    "from": integer,
    "include": "string",
    "interval": "string",
    "max_doc_count": integer,
    "min_doc_count": integer,
    "missing": "string",
    "name": "string",
    "percents": ["string"],
    "q": "string",
    "ranges": [
        {
            "from": integer,
            "to": integer
        }
    ],
    "size": integer,
    "sort": "string",
    "sub_aggregates": [
        {
            "date_ranges": [
                {
                    "from": "string",
                    "to": "string"
                }
            ],
            "exclude": "string",
            "extended_bounds": {
                "max": "string",
                "min": "string"
            },
            "field": "string",
            "filter": "string",
            "filters_spec": {
                "filters": {},
                "other_bucket": boolean,
                "other_bucket_key": "string"
            },
            "from": integer,
            "include": "string",
            "interval": "string",
            "max_doc_count": integer,
            "min_doc_count": integer,
            "missing": "string",
            "name": "string",
            "percents": ["string"],
            "q": "string",
            "ranges": [
                {
                    "from": integer,
                    "to": integer
                }
            ],
            "size": integer,
            "sort": "string",
            "sub_aggregates": [
                {
                    "date_ranges": ["string"],
                    "exclude": "string",
                    "extended_bounds": {},
                    "field": "string",
                    "filter": "string",
                    "filters_spec": {},
                    "from": integer,
                    "include": "string",
                    "interval": "string",
                    "max_doc_count": integer,
                    "min_doc_count": integer,
                    "missing": "string",
                    "name": "string",
                    "percents": ["string"],
                    "q": "string",
                    "ranges": ["string"],
                    "size": integer,
                    "sort": "string",
                    "sub_aggregates": ["string"],
                    "time_zone": "string",
                    "type": "string"
                }
            ],
            "time_zone": "string",
            "type": "string"
        }
    ],
    "time_zone": "string",
    "type": "string"
}

response = falcon.command("app_abuse_exclusions_aggregates_v1", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/application_abuse_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  from := "string"
  to := "string"
  exclude := "string"
  max := "string"
  min := "string"
  field := "string"
  filter := "string"
  otherBucket := boolean
  otherBucketKey := "string"
  from2 := int32(0)
  include := "string"
  interval := "string"
  missing := "string"
  name := "string"
  q := "string"
  from3 := float64(0)
  to2 := float64(0)
  size := int32(0)
  sort := "string"
  exclude2 := "string"
  field2 := "string"
  filter2 := "string"
  from4 := int32(0)
  include2 := "string"
  interval2 := "string"
  missing2 := "string"
  name2 := "string"
  q2 := "string"
  size2 := int32(0)
  sort2 := "string"
  timeZone := "string"
  typeVar := "string"
  timeZone2 := "string"
  typeVar2 := "string"

  response, err := client.ApplicationAbuseExclusions.AppAbuseExclusionsAggregatesV1(
    &application_abuse_exclusions.AppAbuseExclusionsAggregatesV1Params{
      Body: &models.MsaAggregateQueryRequest{
        DateRanges: []*models.MsaDateRangeSpec{
          {
            From: &from,
            To: &to,
          },
        },
        Exclude: &exclude,
        ExtendedBounds: &models.MsaExtendedBoundsSpec{
          Max: &max,
          Min: &min,
        },
        Field: &field,
        Filter: &filter,
        FiltersSpec: &models.MsaAPIFiltersSpec{
          Filters: map[string]string{},
          OtherBucket: &otherBucket,
          OtherBucketKey: &otherBucketKey,
        },
        From: &from2,
        Include: &include,
        Interval: &interval,
        MaxDocCount: integer,
        MinDocCount: integer,
        Missing: &missing,
        Name: &name,
        Percents: []float64{integer},
        Q: &q,
        Ranges: []*models.MsaRangeSpec{
          {
            From: &from3,
            To: &to2,
          },
        },
        Size: &size,
        Sort: &sort,
        SubAggregates: []*models.MsaAggregateQueryRequest{
          {
            DateRanges: []*models.MsaDateRangeSpec{},
            Exclude: &exclude2,
            ExtendedBounds: &models.MsaExtendedBoundsSpec{},
            Field: &field2,
            Filter: &filter2,
            FiltersSpec: &models.MsaAPIFiltersSpec{},
            From: &from4,
            Include: &include2,
            Interval: &interval2,
            MaxDocCount: integer,
            MinDocCount: integer,
            Missing: &missing2,
            Name: &name2,
            Percents: []float64{integer},
            Q: &q2,
            Ranges: []*models.MsaRangeSpec{},
            Size: &size2,
            Sort: &sort2,
            SubAggregates: []*models.MsaAggregateQueryRequest{},
            TimeZone: &timeZone,
            Type: &typeVar,
          },
        },
        TimeZone: &timeZone2,
        Type: &typeVar2,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.applicationAbuseExclusions.appAbuseExclusionsAggregatesV1(
  {
    dateRanges: [{
        from: "string",
        to: "string"
      }],
    exclude: "string",
    extendedBounds: {
      max: "string",
      min: "string"
    },
    field: "string",
    filter: "string",
    filtersSpec: {
      filters: {},
      otherBucket: boolean,
      otherBucketKey: "string"
    },
    from: integer,
    include: "string",
    interval: "string",
    maxDocCount: integer,
    minDocCount: integer,
    missing: "string",
    name: "string",
    percents: [],
    q: "string",
    ranges: [{
        from: integer,
        to: integer
      }],
    size: integer,
    sort: "string",
    subAggregates: [{
        dateRanges: [{
            from: "string",
            to: "string"
          }],
        exclude: "string",
        extendedBounds: {
          max: "string",
          min: "string"
        },
        field: "string",
        filter: "string",
        filtersSpec: {
          filters: {},
          otherBucket: boolean,
          otherBucketKey: "string"
        },
        from: integer,
        include: "string",
        interval: "string",
        maxDocCount: integer,
        minDocCount: integer,
        missing: "string",
        name: "string",
        percents: [],
        q: "string",
        ranges: [{
            from: integer,
            to: integer
          }],
        size: integer,
        sort: "string",
        subAggregates: [{
            dateRanges: [],
            exclude: "string",
            field: "string",
            filter: "string",
            filtersSpec: {
              filters: {},
              otherBucket: boolean,
              otherBucketKey: "string"
            },
            from: integer,
            include: "string",
            interval: "string",
            maxDocCount: integer,
            minDocCount: integer,
            missing: "string",
            name: "string",
            percents: [],
            q: "string",
            ranges: [],
            size: integer,
            sort: "string",
            subAggregates: [],
            timeZone: "string",
            type: "string"
          }],
        timeZone: "string",
        type: "string"
      }],
    timeZone: "string",
    type: "string"
}  // body
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ApplicationAbuseExclusions.new

body = Falcon::MsaAggregateQueryRequest.new(
  date_ranges: [{
      from: 'string',
      to: 'string'
    }],
  exclude: 'string',
  extended_bounds: {
    max: 'string',
    min: 'string'
  },
  field: 'string',
  filter: 'string',
  filters_spec: {
    filters: {},
    other_bucket: boolean,
    other_bucket_key: 'string'
  },
  from: integer,
  include: 'string',
  interval: 'string',
  max_doc_count: integer,
  min_doc_count: integer,
  missing: 'string',
  name: 'string',
  percents: [],
  q: 'string',
  ranges: [{
      From: integer,
      To: integer
    }],
  size: integer,
  sort: 'string',
  sub_aggregates: [{
      date_ranges: [{
          from: 'string',
          to: 'string'
        }],
      exclude: 'string',
      extended_bounds: {
        max: 'string',
        min: 'string'
      },
      field: 'string',
      filter: 'string',
      filters_spec: {
        filters: {},
        other_bucket: boolean,
        other_bucket_key: 'string'
      },
      from: integer,
      include: 'string',
      interval: 'string',
      max_doc_count: integer,
      min_doc_count: integer,
      missing: 'string',
      name: 'string',
      percents: [],
      q: 'string',
      ranges: [{
          From: integer,
          To: integer
        }],
      size: integer,
      sort: 'string',
      sub_aggregates: [{
          date_ranges: [],
          exclude: 'string',
          extended_bounds: {},
          field: 'string',
          filter: 'string',
          filters_spec: {},
          from: integer,
          include: 'string',
          interval: 'string',
          max_doc_count: integer,
          min_doc_count: integer,
          missing: 'string',
          name: 'string',
          percents: [],
          q: 'string',
          ranges: [],
          size: integer,
          sort: 'string',
          sub_aggregates: [],
          time_zone: 'string',
          type: 'string'
        }],
      time_zone: 'string',
      type: 'string'
    }],
  time_zone: 'string',
  type: 'string'
)

response = api.app_abuse_exclusions_aggregates_v1(body)

puts response

Responses

[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

app-abuse-exclusions.create.v1

Create new Application Abuse Exclusions

Method POST

Route /exclusions/entities/app-abuse-exclusions/v1

Scope App Abuse Exclusions: WRITE

PEP 8 create_app_abuse_exclusion

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

exclusions body · array

The exclusions value.

Code Examples

from falconpy import ApplicationAbuseExclusions

falcon = ApplicationAbuseExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

exclusions = [
    {
        "applied_globally": True,
        "children_cids": [
            "string"
        ],
        "comment": "string",
        "description": "string",
        "host_groups": [
            "string"
        ],
        "tag": "string"
    }
]

response = falcon.create_app_abuse_exclusion(exclusions=exclusions)
print(response)

from falconpy import ApplicationAbuseExclusions

falcon = ApplicationAbuseExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

exclusions = [
    {
        "applied_globally": True,
        "children_cids": [
            "string"
        ],
        "comment": "string",
        "description": "string",
        "host_groups": [
            "string"
        ],
        "tag": "string"
    }
]

response = falcon.app_abuse_exclusions_create_v1(exclusions=exclusions)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "exclusions": [
        {
            "applied_globally": boolean,
            "children_cids": ["string"],
            "comment": "string",
            "description": "string",
            "host_groups": ["string"],
            "tag": "string"
        }
    ]
}

response = falcon.command("app_abuse_exclusions_create_v1", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/application_abuse_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  tag := "string"

  response, err := client.ApplicationAbuseExclusions.AppAbuseExclusionsCreateV1(
    &application_abuse_exclusions.AppAbuseExclusionsCreateV1Params{
      Body: &models.DomainAppAbuseExclusionsCreateReqV1{
        Exclusions: []*models.DomainAppAbuseExclusionCreateReqV1{
          {
            AppliedGlobally: boolean,
            ChildrenCids: []string{"string"},
            Comment: "string",
            Description: "string",
            HostGroups: []string{"string"},
            Tag: &tag,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.applicationAbuseExclusions.appAbuseExclusionsCreateV1(
  {
    exclusions: [{
        appliedGlobally: boolean,
        childrenCids: [],
        comment: "string",
        description: "string",
        hostGroups: [],
        tag: "string"
      }]
}  // body
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ApplicationAbuseExclusions.new

body = Falcon::DomainAppAbuseExclusionsCreateReqV1.new(
  exclusions: [{
      applied_globally: boolean,
      children_cids: [],
      comment: 'string',
      description: 'string',
      host_groups: [],
      tag: 'string'
    }]
)

response = api.app_abuse_exclusions_create_v1(body)

puts response

Responses

[
  {
    "applied_globally": false,
    "category": "string",
    "children_cids": [],
    "cid": "string",
    "comment": "string",
    "created_by": "string",
    "created_on": "string",
    "description": "string",
    "host_groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_on": "string",
    "tag": "string",
    "tag_label": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

app-abuse-exclusions.delete.v1

Delete Application Abuse Exclusions by IDs

Method DELETE

Route /exclusions/entities/app-abuse-exclusions/v1

Scope App Abuse Exclusions: WRITE

PEP 8 delete_app_abuse_exclusions

Parameters

ids query · string or list of strings

The ids of the exclusions to delete

comment query · string

The comment why these exclusions were deleted

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ApplicationAbuseExclusions

falcon = ApplicationAbuseExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_app_abuse_exclusions(ids=id_list, comment="string")
print(response)

from falconpy import ApplicationAbuseExclusions

falcon = ApplicationAbuseExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.app_abuse_exclusions_delete_v1(ids=id_list, comment="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("app_abuse_exclusions_delete_v1",
                          ids=id_list,
                          comment="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/application_abuse_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"

  response, err := client.ApplicationAbuseExclusions.AppAbuseExclusionsDeleteV1(
    &application_abuse_exclusions.AppAbuseExclusionsDeleteV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Comment: &comment,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.applicationAbuseExclusions.appAbuseExclusionsDeleteV1(
  ["ID1", "ID2", "ID3"],  // ids
  "string"  // comment
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ApplicationAbuseExclusions.new

response = api.app_abuse_exclusions_delete_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "applied_globally": false,
    "category": "string",
    "children_cids": [],
    "cid": "string",
    "comment": "string",
    "created_by": "string",
    "created_on": "string",
    "description": "string",
    "host_groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_on": "string",
    "tag": "string",
    "tag_label": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

app-abuse-exclusions.get-apps-by-category.v1

Get available applications filtered by Application Abuse Prevention category

Method GET

Route /exclusions/entities/combined-app-abuse-prevention-apps/v1

Scope App Abuse Exclusions: READ

PEP 8 get_app_abuse_apps_by_category

Parameters

category query · string

Filter applications by category (e.g. rmm)

show_available_only query · boolean

Filter out applications that already have exclusions

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ApplicationAbuseExclusions

falcon = ApplicationAbuseExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

response = falcon.get_app_abuse_apps_by_category(category="string",
                                                 show_available_only=boolean)
print(response)

from falconpy import ApplicationAbuseExclusions

falcon = ApplicationAbuseExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

response = falcon.app_abuse_exclusions_get_apps_by_category_v1(category="string",
                                                               show_available_only=boolean)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("app_abuse_exclusions_get_apps_by_category_v1",
                          category="string",
                          show_available_only=boolean)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/application_abuse_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  category := "string"
  showAvailableOnly := boolean

  response, err := client.ApplicationAbuseExclusions.AppAbuseExclusionsGetAppsByCategoryV1(
    &application_abuse_exclusions.AppAbuseExclusionsGetAppsByCategoryV1Params{
      Category: &category,
      ShowAvailableOnly: &showAvailableOnly,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.applicationAbuseExclusions.appAbuseExclusionsGetAppsByCategoryV1(
  "string",  // category
  boolean  // showAvailableOnly
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ApplicationAbuseExclusions.new

response = api.app_abuse_exclusions_get_apps_by_category_v1(category: 'string',
                                                            show_available_only: boolean)

puts response

Responses

[
  {
    "category": "string",
    "description": "string",
    "id": "string",
    "tag_label": "string",
    "vendor": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

app-abuse-exclusions.get-categories.v1

Get available Application Abuse Prevention categories

Method GET

Route /exclusions/entities/combined-app-abuse-prevention-categories/v1

Scope App Abuse Exclusions: READ

PEP 8 get_app_abuse_categories

Code Examples

from falconpy import ApplicationAbuseExclusions

falcon = ApplicationAbuseExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

response = falcon.get_app_abuse_categories()
print(response)

from falconpy import ApplicationAbuseExclusions

falcon = ApplicationAbuseExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

response = falcon.app_abuse_exclusions_get_categories_v1()
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("app_abuse_exclusions_get_categories_v1")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/application_abuse_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ApplicationAbuseExclusions.AppAbuseExclusionsGetCategoriesV1(
    &application_abuse_exclusions.AppAbuseExclusionsGetCategoriesV1Params{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.applicationAbuseExclusions.appAbuseExclusionsGetCategoriesV1();

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ApplicationAbuseExclusions.new

response = api.app_abuse_exclusions_get_categories_v1

puts response

Responses

[
  {
    "description": "string",
    "id": "string",
    "name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

app-abuse-exclusions.get.v1

Get Application Abuse Exclusions by IDs

Method GET

Route /exclusions/entities/app-abuse-exclusions/v1

Scope App Abuse Exclusions: READ

PEP 8 get_app_abuse_exclusions

Parameters

ids query · string or list of strings

The ids of the exclusions to retrieve

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ApplicationAbuseExclusions

falcon = ApplicationAbuseExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_app_abuse_exclusions(ids=id_list)
print(response)

from falconpy import ApplicationAbuseExclusions

falcon = ApplicationAbuseExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.app_abuse_exclusions_get_v1(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("app_abuse_exclusions_get_v1",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/application_abuse_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ApplicationAbuseExclusions.AppAbuseExclusionsGetV1(
    &application_abuse_exclusions.AppAbuseExclusionsGetV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.applicationAbuseExclusions.appAbuseExclusionsGetV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ApplicationAbuseExclusions.new

response = api.app_abuse_exclusions_get_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "applied_globally": false,
    "category": "string",
    "children_cids": [],
    "cid": "string",
    "comment": "string",
    "created_by": "string",
    "created_on": "string",
    "description": "string",
    "host_groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_on": "string",
    "tag": "string",
    "tag_label": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

app-abuse-exclusions.query.v1

Search for Application Abuse Exclusions

Method GET

Route /exclusions/queries/app-abuse-exclusions/v1

Scope App Abuse Exclusions: READ

PEP 8 query_app_abuse_exclusions

Parameters

filter query · string

The filter expression that should be used to limit the results

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return. [1-100]

sort query · string

The sort expression that should be used to sort the results

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ApplicationAbuseExclusions

falcon = ApplicationAbuseExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

response = falcon.query_app_abuse_exclusions(filter="string",
                                             offset=integer,
                                             limit=integer,
                                             sort="string")
print(response)

from falconpy import ApplicationAbuseExclusions

falcon = ApplicationAbuseExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

response = falcon.app_abuse_exclusions_query_v1(filter="string",
                                                offset=integer,
                                                limit=integer,
                                                sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("app_abuse_exclusions_query_v1",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/application_abuse_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.ApplicationAbuseExclusions.AppAbuseExclusionsQueryV1(
    &application_abuse_exclusions.AppAbuseExclusionsQueryV1Params{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.applicationAbuseExclusions.appAbuseExclusionsQueryV1(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ApplicationAbuseExclusions.new

response = api.app_abuse_exclusions_query_v1(filter: 'string',
                                             offset: integer,
                                             limit: integer,
                                             sort: 'string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

app-abuse-exclusions.report.v1

Create a report of Application Abuse Exclusions scoped by the given filters

Method POST

Route /exclusions/entities/app-abuse-exclusions/reports/v1

Scope App Abuse Exclusions: READ

PEP 8 create_app_abuse_report

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

report_format body · string

The report_format value.

search body · object

The search value.

Code Examples

from falconpy import ApplicationAbuseExclusions

falcon = ApplicationAbuseExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

search = {
    "filter": "string",
    "sort": "string"
}

response = falcon.create_app_abuse_report(report_format="string", search=search)
print(response)

from falconpy import ApplicationAbuseExclusions

falcon = ApplicationAbuseExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

search = {
    "filter": "string",
    "sort": "string"
}

response = falcon.app_abuse_exclusions_report_v1(report_format="string",
                                                 search=search)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "report_format": "string",
    "search": {
        "filter": "string",
        "sort": "string"
    }
}

response = falcon.command("app_abuse_exclusions_report_v1", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/application_abuse_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  reportFormat := "string"
  filter := "string"
  sort := "string"

  response, err := client.ApplicationAbuseExclusions.AppAbuseExclusionsReportV1(
    &application_abuse_exclusions.AppAbuseExclusionsReportV1Params{
      Body: &models.DomainExclusionsReportRequest{
        ReportFormat: &reportFormat,
        Search: &models.DomainExclusionsSearch{
          Filter: &filter,
          Sort: &sort,
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.applicationAbuseExclusions.appAbuseExclusionsReportV1(
  {
    reportFormat: "string",
    search: {
      filter: "string",
      sort: "string"
    }
}  // body
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ApplicationAbuseExclusions.new

body = Falcon::DomainExclusionsReportRequest.new(
  report_format: 'string',
  search: {
    filter: 'string',
    sort: 'string'
  }
)

response = api.app_abuse_exclusions_report_v1(body)

puts response

Responses

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

app-abuse-exclusions.update.v1

Update existing Application Abuse Exclusions

Method PATCH

Route /exclusions/entities/app-abuse-exclusions/v1

Scope App Abuse Exclusions: WRITE

PEP 8 update_app_abuse_exclusions

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

exclusions body · array

The exclusions value.

Code Examples

from falconpy import ApplicationAbuseExclusions

falcon = ApplicationAbuseExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

exclusions = [
    {
        "applied_globally": True,
        "children_cids": [
            "string"
        ],
        "comment": "string",
        "description": "string",
        "host_groups": [
            "string"
        ],
        "id": "string",
        "tag": "string"
    }
]

response = falcon.update_app_abuse_exclusions(exclusions=exclusions)
print(response)

from falconpy import ApplicationAbuseExclusions

falcon = ApplicationAbuseExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

exclusions = [
    {
        "applied_globally": True,
        "children_cids": [
            "string"
        ],
        "comment": "string",
        "description": "string",
        "host_groups": [
            "string"
        ],
        "id": "string",
        "tag": "string"
    }
]

response = falcon.app_abuse_exclusions_update_v1(exclusions=exclusions)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "exclusions": [
        {
            "applied_globally": boolean,
            "children_cids": ["string"],
            "comment": "string",
            "description": "string",
            "host_groups": ["string"],
            "id": "string",
            "tag": "string"
        }
    ]
}

response = falcon.command("app_abuse_exclusions_update_v1", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/application_abuse_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  id := "string"

  response, err := client.ApplicationAbuseExclusions.AppAbuseExclusionsUpdateV1(
    &application_abuse_exclusions.AppAbuseExclusionsUpdateV1Params{
      Body: &models.DomainAppAbuseExclusionsUpdateReqV1{
        Exclusions: []*models.DomainAppAbuseExclusionUpdateReqV1{
          {
            AppliedGlobally: boolean,
            ChildrenCids: []string{"string"},
            Comment: "string",
            Description: "string",
            HostGroups: []string{"string"},
            ID: &id,
            Tag: "string",
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.applicationAbuseExclusions.appAbuseExclusionsUpdateV1(
  {
    exclusions: [{
        appliedGlobally: boolean,
        childrenCids: [],
        comment: "string",
        description: "string",
        hostGroups: [],
        id: "string",
        tag: "string"
      }]
}  // body
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ApplicationAbuseExclusions.new

body = Falcon::DomainAppAbuseExclusionsUpdateReqV1.new(
  exclusions: [{
      applied_globally: boolean,
      children_cids: [],
      comment: 'string',
      description: 'string',
      host_groups: [],
      id: 'string',
      tag: 'string'
    }]
)

response = api.app_abuse_exclusions_update_v1(body)

puts response

Responses

[
  {
    "applied_globally": false,
    "category": "string",
    "children_cids": [],
    "cid": "string",
    "comment": "string",
    "created_by": "string",
    "created_on": "string",
    "description": "string",
    "host_groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_on": "string",
    "tag": "string",
    "tag_label": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

Application Abuse Exclusions

Table of Contents

app-abuse-exclusions.aggregates.v1

Parameters

app-abuse-exclusions.create.v1

Parameters

app-abuse-exclusions.delete.v1

Parameters

app-abuse-exclusions.get-apps-by-category.v1

Parameters

app-abuse-exclusions.get-categories.v1

app-abuse-exclusions.get.v1

Parameters

app-abuse-exclusions.query.v1

Parameters

app-abuse-exclusions.report.v1

Parameters

app-abuse-exclusions.update.v1

Parameters