Skip to content

ASPM

The ASPM (Application Security Posture Management) service collection provides operations for executing queryLanguage functions across ASPM data. Run count queries, time-series queries, and services queries to analyze application security posture data.

LanguageLast Update
Pythonv1.6.1
PowerShellv2.2.9
Gov0.20.0
TypeScriptv0.6.0
Rustv0.7.0
Rubyv1.2.0
OperationDescription
ExecuteFunctionDataCount
execute_function_data_count
A selected list of queryLanguage count queries.
ExecuteFunctionsCount
execute_functions_count
A selected list of queryLanguage count queries.
ExecuteFunctionDataQueryCount
execute_function_data_query_count
A selected list of queryLanguage count queries.
ExecuteFunctionsQueryCount
execute_functions_query_count
A selected list of queryLanguage count queries.
ExecuteFunctionData
execute_function_data
A selected list of queryLanguage queries.
ExecuteFunctionsOvertime
execute_functions_over_time
A selected list of queryLanguage overtime queries.
ExecuteFunctions
execute_functions
A selected list of queryLanguage services queries.
ExecuteFunctionDataQuery
execute_function_data_query
A selected list of queryLanguage queries.
ExecuteFunctionsQueryOvertime
execute_functions_query_over_time
A selected list of queryLanguage overtime queries.
ExecuteFunctionsQuery
execute_functions_query
A selected list of queryLanguage services queries.
getServiceArtifacts
get_service_artifacts
Retrieve service artifacts.
UpsertBusinessApplications
update_business_applications
Create or Update Business Applications
GetCloudSecurityIntegrationState
get_cloud_security_integration_state
Get Cloud Security integration state.
SetCloudSecurityIntegrationState
set_cloud_security_integration_state
Set Cloud Security integration state.
GetExecutorNodes
get_executor_nodes
Get all the relay nodes
UpdateExecutorNode
update_executor_node
Update an existing relay node
CreateExecutorNode
create_executor_node
Create a new relay node
GetExecutorNodesMetadata
get_executor_nodes_metadata
Get metadata about all executor nodes.
DeleteExecutorNode
delete_node
Delete a relay node
RetrieveRelayInstances
retrieve_relay_instances
Retrieve the relay instances in CSV format.
GetIntegrationTasks
get_integration_tasks
Get all the integration tasks
CreateIntegrationTask
create_integration_task
Create new integration task.
GetIntegrationTasksMetadata
get_integration_tasks_metadata
Get metadata about all integration tasks.
GetIntegrationTasksV2
get_integration_tasks_v2
Get all the integration tasks.
UpdateIntegrationTask
update_integration_task
Update an existing integration task by its ID
DeleteIntegrationTask
delete_integration_task
Delete an existing integration task by its ID
RunIntegrationTask
run_integration_task
Run an integration task by its ID
RunIntegrationTaskAdmin
run_integration_task_admin
Run an integration task by its ID with admin scope.
RunIntegrationTaskV2
run_integration_task_v2
Run an integration task by its ID
GetIntegrationTypes
get_integration_types
Get all the integration types
GetIntegrations
get_integrations
Get a list of all the integrations
CreateIntegration
create_integration
Create a new integration
GetIntegrationsV2
get_integrations_v2
Get a list of all the integrations.
UpdateIntegration
update_integration
Update an existing integration by its ID
DeleteIntegration
delete_integration
Delete an existing integration by its ID
ExecuteQuery
execute_query
Execute a query. The syntax used is identical to that of the query page.
ServiceNowGetDeployments
get_servicenow_deployments
Retrieve ServiceNow deployments
ServiceNowGetServices
get_servicenow_services
Retrieve ServiceNow services.
GetServicesCount
get_services_count
Get the total amount of existing services
GetServiceViolationTypes
get_service_violation_types
Get the different types of violation
GetTags
get_tags
Get all the tags
UpsertTags
update_tags
Create new or update existing tag. You can update unique tags table or regular tags table
DeleteTags
delete_tags
Remove existing tags
DeleteGroup
delete_group
GetGroupHierarchy
get_group_hierarchy
Get group hierarchy
GetGroupV2
get_group_v2
Get group details
GetGroupsV2
get_groups_v2
GetIntegrationTasksAdmin
get_integration_tasks_admin
Get all the integration tasks, requires admin scope
GetUsersV2
get_users_v2
List users
PostGroupV2
post_group_v2
Create group
UpdateDefaultGroup
update_default_group
Update default group
UpdateGroup
update_group
Update group

A selected list of queryLanguage count queries.

POST /application-security/aggregates/function-data/count/v1
Scope ASPM Read Only: WRITE Consumes · Produces application/json
PEP 8 execute_function_data_count
NameTypeData typeDescription
aws_lambda_arnquerystringAWS Lambda ARN. Required for aws cloud provider.
azure_function_app_namequerystringAzure Function App name. Required for azure cloud provider.
azure_site_resource_groupquerystringAzure site resource group. Required for azure cloud provider.
azure_site_subscription_idquerystringAzure site subscription ID. Required for azure cloud provider.
cloud_providerquerystring or list of stringsCloud provider ID. Allowed values: aws, azure and gcp. Required.
gcp_cloud_function_urlquerystringGCP Cloud Function URL. Required for gcp cloud provider.
parametersquerydictionaryFull query string parameters payload in JSON format.
query_namequerystringQuery name. Required.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.execute_function_data_count(aws_lambda_arn="string",
azure_function_app_name="string",
azure_site_resource_group="string",
azure_site_subscription_id="string",
cloud_provider="string",
gcp_cloud_function_url="string",
query_name="string")
print(response)

A selected list of queryLanguage count queries.

POST /application-security/aggregates/functions/count/v1
Scope ASPM Read Only: WRITE Consumes · Produces application/json
PEP 8 execute_functions_count
NameTypeData typeDescription
cidquerystring or list of stringsCustomer ID. Required for azure cloud provider.
cloud_account_idquerystring or list of stringsAWS Cloud Account ID. Required for aws cloud provider.
cloud_providerquerystring or list of stringsCloud provider ID. Allowed values: aws, azure and gcp. Required.
parametersquerydictionaryFull query string parameters payload in JSON format.
query_namequerystringQuery name. Required.
regionquerystring or list of stringsGCP Region. Required for gcp cloud provider.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.execute_functions_count(cid=id_list,
cloud_account_id=id_list,
cloud_provider=id_list,
query_name="string",
region=id_list)
print(response)

A selected list of queryLanguage count queries.

GET /application-security/aggregates/query-function-data-count/v1
Scope ASPM Read Only: READ Consumes · Produces application/json
PEP 8 execute_function_data_query_count
NameTypeData typeDescription
fieldquerystringQuery fields.
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.execute_function_data_query_count(field="string")
print(response)

A selected list of queryLanguage count queries.

GET /application-security/aggregates/query-functions-count/v1
Scope ASPM Read Only: READ Consumes · Produces application/json
PEP 8 execute_functions_query_count
NameTypeData typeDescription
fieldquerystringQuery fields.
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.execute_functions_query_count(field="string")
print(response)

A selected list of queryLanguage queries.

GET /application-security/combined/function-data/v1
Scope ASPM Read Only: READ Consumes · Produces application/json
PEP 8 execute_function_data
NameTypeData typeDescription
fieldquerystringQuery fields.
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.execute_function_data(field="string")
print(response)

A selected list of queryLanguage overtime queries.

GET /application-security/combined/functions-overtime/v1
Scope ASPM Read Only: READ Consumes · Produces application/json
PEP 8 execute_functions_over_time
NameTypeData typeDescription
fieldquerystringQuery fields.
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.execute_functions_over_time(field="string")
print(response)

A selected list of queryLanguage services queries.

GET /application-security/combined/functions/v1
Scope ASPM Read Only: READ Consumes · Produces application/json
PEP 8 execute_functions
NameTypeData typeDescription
fieldquerystringQuery fields.
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.execute_functions(field="string")
print(response)

A selected list of queryLanguage queries.

GET /application-security/combined/query-function-data/v1
Scope ASPM Read Only: READ Consumes · Produces application/json
PEP 8 execute_function_data_query
NameTypeData typeDescription
fieldquerystringQuery fields.
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.execute_function_data_query(field="string")
print(response)

A selected list of queryLanguage overtime queries.

GET /application-security/combined/query-functions-overtime/v1
Scope ASPM Read Only: READ Consumes · Produces application/json
PEP 8 execute_functions_query_over_time
NameTypeData typeDescription
fieldquerystringQuery fields.
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.execute_functions_query_over_time(field="string")
print(response)

A selected list of queryLanguage services queries.

GET /application-security/combined/query-functions/v1
Scope ASPM Read Only: READ Consumes · Produces application/json
PEP 8 execute_functions_query
NameTypeData typeDescription
fieldquerystringQuery fields.
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.execute_functions_query(field="string")
print(response)

Retrieve service artifacts.

GET /aspm-api-gateway/api/v1/artifacts
Scope ASPM Read Only: READ Consumes · Produces application/json
PEP 8 get_service_artifacts
NameTypeData typeDescription
persistent_signaturequerystringPersistent signature.
optional_timequerystringOptional time.
revision_idquerystringRevision ID.
limitqueryintegerUpper bound for records returned.
offsetqueryintegerStarting position of records returned.
order_byquerystring or list of stringsSort order field(s).
directionquerystringSort order direction. Allowed values: asc or desc.
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_service_artifacts(persistent_signature="string",
optional_time="string",
revision_id="string",
limit=integer,
offset=integer,
order_by=id_list,
direction="string")
print(response)

Create or Update Business Applications

PUT /aspm-api-gateway/api/v1/business_applications
Scope ASPM Analyst: WRITE Consumes · Produces application/json
PEP 8 update_business_applications
NameTypeData typeDescription
bodybodydictionaryFull body payload in JSON format.
namebodystringApplication name.
persistent_signaturebodystring or list of stringsSignature to persist.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.update_business_applications(name="string",
persistent_signatures=["string"])
print(response)

Get Cloud Security integration state.

GET /aspm-api-gateway/api/v1/cloud_security_config
Scope ASPM Admin: READ Consumes · Produces application/json
PEP 8 get_cloud_security_integration_state

No keywords or arguments accepted.

from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_cloud_security_integration_state()
print(response)

Set Cloud Security integration state.

POST /aspm-api-gateway/api/v1/cloud_security_config
Scope ASPM Admin: WRITE Consumes · Produces application/json
PEP 8 set_cloud_security_integration_state
NameTypeData typeDescription
bodybodystringFull body payload as a JSON formatted dictionary.
is_enabledbodybooleanFlag indicating if the state should be enabled.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.set_cloud_security_integration_state(is_enabled=boolean)
print(response)

Get all the relay nodes

GET /aspm-api-gateway/api/v1/executor_nodes
Scope ASPM Admin: READ Consumes · Produces application/json
PEP 8 get_executor_nodes
NameTypeData typeDescription
directionquerystringSort order direction. Allowed values: asc or desc.
executor_node_idsquerystring or list of stringsExecutor node IDs.
executor_node_namesquerystring or list of stringsExecutor node names.
executor_node_statesquerystring or list of stringsExecutor node states.
executor_node_typesquerystring or list of stringsExecutor node types.
node_typequerystringRelay node type.
integration_typequerystringIntegration type.
limitqueryintegerMaximum number of records to return.
offsetqueryintegerStarting position from which to return records.
order_byquerystringField to use for sorting results. Allowed values: name, id, state and type.
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_executor_nodes(direction="string",
executor_node_ids=id_list,
executor_node_names=id_list,
executor_node_states=id_list,
executor_node_types=id_list,
node_type="string",
integration_type="string",
limit=integer,
offset=integer,
order_by="string")
print(response)

Update an existing relay node

PUT /aspm-api-gateway/api/v1/executor_nodes
Scope ASPM Admin: WRITE Consumes · Produces application/json
PEP 8 update_executor_node
NameTypeData typeDescription
bodybodydictionaryFull body payload in JSON format.
additional_headerbodystringAdditional headers.
current_aws_arnbodystringAWS ARN.
dashboard_urlbodystringDashboard URL address.
last_health_checkbodyintegerLast health check.
namebodystringNode name.
node_typebodystringNode type.
passwordbodystringPassword.
pod_settingsbodydictionaryPod settings.
proxy_addressbodystringProxy server address.
typebodystringType.
use_jobsbodybooleanFlag indicating if jobs should be used.
usernamebodystringUsername.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
pod_settings = {
"image_address": "string",
"image_pull_secrets": ["string"],
"pod_labels": [
{
"key": "string",
"value": "string"
}
]
}
status = {
"state": integer,
"state_last_updated": integer,
"state_reason": integer
}
response = falcon.update_executor_node(additional_header="string",
current_aws_arn="string",
dashboard_url="string",
id="string",
last_health_check=integer,
name="string",
node_type="string",
password="string",
pod_settings=pod_settings,
proxy_address="string",
status=status,
type="string",
use_jobs=boolean,
username="string")
print(response)

Create a new relay node

POST /aspm-api-gateway/api/v1/executor_nodes
Scope ASPM Admin: WRITE Consumes · Produces application/json
PEP 8 create_executor_node
NameTypeData typeDescription
bodybodydictionaryFull body payload in JSON format.
additional_headerbodystringAdditional headers.
current_aws_arnbodystringAWS ARN.
dashboard_urlbodystringDashboard URL address.
idbodyintegerNode ID.
last_health_checkbodyintegerLast health check.
namebodystringNode name.
node_typebodystringNode type.
passwordbodystringPassword.
pod_settingsbodydictionaryPod settings.
proxy_addressbodystringProxy server address.
typebodystringType.
use_jobsbodybooleanFlag indicating if jobs should be used.
usernamebodystringUsername.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
pod_settings = {
"image_address": "string",
"image_pull_secrets": ["string"],
"pod_labels": [
{
"key": "string",
"value": "string"
}
]
}
status = {
"state": integer,
"state_last_updated": integer,
"state_reason": integer
}
response = falcon.create_executor_node(additional_header="string",
current_aws_arn="string",
dashboard_url="string",
id="string",
last_health_check=integer,
name="string",
node_type="string",
password="string",
pod_settings=pod_settings,
proxy_address="string",
status=status,
type="string",
use_jobs=boolean,
username="string")
print(response)

Get metadata about all executor nodes.

GET /aspm-api-gateway/api/v1/executor_nodes/metadata
Scope ASPM Read Only: READ Consumes · Produces application/json
PEP 8 get_executor_nodes_metadata
NameTypeData typeDescription
executor_node_idsquerystring or list of stringsExecutor node IDs.
executor_node_namesquerystring or list of stringsExecutor node names.
executor_node_statesqueryinteger or list of integersExecutor node states.
executor_node_typesquerystring or list of stringsExecutor node types.
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_executor_nodes_metadata(executor_node_ids=id_list,
executor_node_names=id_list,
executor_node_states=integer,
executor_node_types=id_list)
print(response)

Delete a relay node

DELETE /aspm-api-gateway/api/v1/executor_nodes/{ID}
Scope ASPM Admin: WRITE Consumes · Produces application/json
PEP 8 delete_node
NameTypeData typeDescription
idpathintegerExecutor node ID.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.delete_node(id=integer)
print(response)

Retrieve the relay instances in CSV format.

GET /aspm-api-gateway/api/v1/executor_nodes/{ID}/instances/csv
Scope ASPM Admin: READ Consumes · Produces application/json
PEP 8 retrieve_relay_instances
NameTypeData typeDescription
additional_headerbodystringAdditional header to provide.
bodybodystringFull body payload as a JSON formatted dictionary.
current_aws_arnbodystringCurrent AWS ARN.
dashboard_urlbodystringURL for the related dashboard.
idpathintegerID of the node to retrieve.
last_health_checkbodyintegerLast health check.
namebodystringName.
node_typebodystringNode type.
pod_settingsbodydictionaryRelated pod settings.
proxy_addressbodystringAddress of the proxy.
statusbodydictionaryCurrent status.
typebodystringRelay type.
use_jobsbodybooleanFlag indicating if jobs should be used.
usernamebodystringAccount username.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.retrieve_relay_instances(additional_header="string",
current_aws_arn="string",
dashboard_url="string",
id=integer,
last_health_check=integer,
name="string",
node_type="string",
pod_settings={},
proxy_address="string",
status={},
type="string",
use_jobs=boolean,
username="string")
print(response)

Get all the integration tasks

GET /aspm-api-gateway/api/v1/integration_tasks
Scope ASPM Read Only: READ Consumes · Produces application/json
PEP 8 get_integration_tasks
NameTypeData typeDescription
integration_task_typequerystringIntegration task type.
categoryquerystringIntegration task category.
offsetqueryintegerStarting position from which to return records.
limitqueryintegerMaximum number of records to return.
order_byquerystringField to use for sorting results.
directionquerystringSort order direction. Allowed values: asc or desc.
integration_task_typesqueryintegerIntegration task types.
idsqueryintegerIntegration task ID to retrieve.
namesquerystringIntegration task name.
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_integration_tasks(integration_task_type=integer,
category="string",
offset=integer,
limit=integer,
order_by="string",
direction="string",
integration_task_types=integer,
ids=id_list,
names="string")
print(response)

Create new integration task.

POST /aspm-api-gateway/api/v1/integration_tasks
Scope ASPM Admin: WRITE Consumes · Produces application/json
PEP 8 create_integration_task
NameTypeData typeDescription
bodybodydictionaryFull body payload in JSON format.
access_tokenbodystringAccess token.
task_idbodyintegerTask ID.
databodystringTask data content.
overridebodybooleanFlag indicating if this task should override other task values.
scheduledbodybooleanFlag indicating if this task is scheduled.
idpathdictionaryID of the integration task to execute.
integration_taskqueryintegrationFull integration task detail.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
integration_task = {
"access_token": "string",
"additional_header": "string",
"business_application": "string",
"data": "string",
"enabled": boolean,
"id": "string",
"integration": {
"data": "string",
"enabled": boolean,
"id": "string",
"integration_type": {},
"name": "string",
"node": {},
"type": {},
"update_time": integer
},
"integration_task_type": {
"category": "string",
"display_name": "string",
"enabled": boolean,
"id": integer,
"name": "string",
"required_integration_types": ["string"]
},
"latest_task_run": {
"create_time": "string",
"events": ["string"],
"id": "string",
"latest_event": {},
"metadata": {},
"progress": integer,
"scheduled": boolean,
"trace_uuid": "string"
},
"name": "string",
"next_run": {
"nanos": integer,
"seconds": integer
},
"progress": integer,
"schedule": {
"every": integer,
"every_unit": integer,
"hour": integer,
"minute": integer,
"start_time_timezone_offset_minutes": integer,
"start_time": {},
"timezone": integer,
"weekdays": ["string"]
},
"schedule_every_unit_display_name": "string",
"trigger": "string",
"type": {
"category": "string",
"display_name": "string",
"enabled": boolean,
"id": integer,
"name": "string",
"required_integration_types": ["string"]
}
}
response = falcon.create_integration_task(integration_task=integration_task)
print(response)

Get metadata about all integration tasks.

GET /aspm-api-gateway/api/v1/integration_tasks/metadata
Scope ASPM Read Only: READ Consumes · Produces application/json
PEP 8 get_integration_tasks_metadata
NameTypeData typeDescription
categoryquerystringCategory.
integration_task_typesqueryintegerIntegration task types.
idsqueryintegerIntegration task ID to retrieve.
namesquerystringIntegration task name.
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_integration_tasks_metadata(category="string",
integration_task_types=integer,
ids=id_list,
names="string")
print(response)

Get all the integration tasks.

GET /aspm-api-gateway/api/v1/integration_tasks/v2
Scope ASPM Admin: READ Consumes · Produces application/json
PEP 8 get_integration_tasks_v2
NameTypeData typeDescription
integration_task_typequeryintegerIntegration task type.
categoryquerystringCategory.
offsetqueryintegerStarting position from which to return records.
limitqueryintegerMaximum number of records to return.
order_byquerystringField to use for sorting results.
directionquerystringSort order direction. Allowed values: asc or desc.
integration_task_typesqueryintegerIntegration task types.
idsqueryintegerIntegration task ID to retrieve.
namesquerystringIntegration task name.
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_integration_tasks_v2(integration_task_type=integer,
category="string",
offset=integer,
limit=integer,
order_by="string",
direction="string",
integration_task_types=integer,
ids=id_list,
names="string")
print(response)

Update an existing integration task by its ID

PUT /aspm-api-gateway/api/v1/integration_tasks/{ID}
Scope ASPM Admin: WRITE Consumes · Produces application/json
PEP 8 update_integration_task
NameTypeData typeDescription
bodybodydictionaryFull body payload in JSON format.
access_tokenbodystringAccess token.
task_idbodyintegerTask ID.
databodystringTask data content.
overridebodybooleanFlag indicating if this task should override other task values.
scheduledbodybooleanFlag indicating if this task is scheduled.
idpathdictionaryID of the integration task to execute.
integration_taskqueryintegrationFull integration task detail.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.update_integration_task(ID=integer)
print(response)

Delete an existing integration task by its ID

DELETE /aspm-api-gateway/api/v1/integration_tasks/{ID}
Scope ASPM Admin: WRITE Consumes · Produces application/json
PEP 8 delete_integration_task
NameTypeData typeDescription
idpathintegerExecutor node ID.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.delete_integration_task(ID=integer)
print(response)

Run an integration task by its ID

POST /aspm-api-gateway/api/v1/integration_tasks/{ID}/run
Scope ASPM Analyst: WRITE Consumes · Produces application/json
PEP 8 run_integration_task
NameTypeData typeDescription
access_tokenbodystringAccess token.
task_idbodyintegerTask ID.
databodystringTask data content.
overridebodybooleanFlag indicating if this task should override other task values.
scheduledbodybooleanFlag indicating if this task is scheduled.
idpathdictionaryID of the integration task to execute.
categoryquerystringIntegration task category.
bodybodydictionaryFull body payload in JSON format.
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.run_integration_task(access_token="string",
category="string",
data="string",
ID=integer,
override=boolean,
scheduled=boolean,
task_id=integer)
print(response)

Run an integration task by its ID with admin scope.

POST /aspm-api-gateway/api/v1/integration_tasks/{ID}/run/admin
Scope ASPM Admin: WRITE Consumes · Produces application/json
PEP 8 run_integration_task_admin
NameTypeData typeDescription
access_tokenbodystringAccess token.
task_idbodyintegerTask ID.
databodystringTask data content.
overridebodybooleanFlag indicating if this task should override other task values.
scheduledbodybooleanFlag indicating if this task is scheduled.
idpathdictionaryID of the integration task to execute.
categoryquerystringIntegration task category.
bodybodydictionaryFull body payload in JSON format.
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.run_integration_task_admin(ID=integer, category="string")
print(response)

Run an integration task by its ID

POST /aspm-api-gateway/api/v1/integration_tasks/{ID}/run/v2
Scope ASPM Admin: WRITE Consumes · Produces application/json
PEP 8 run_integration_task_v2
NameTypeData typeDescription
access_tokenbodystringAccess token.
task_idbodyintegerTask ID.
databodystringTask data content.
overridebodybooleanFlag indicating if this task should override other task values.
scheduledbodybooleanFlag indicating if this task is scheduled.
idpathdictionaryID of the integration task to execute.
categoryquerystringIntegration task category.
bodybodydictionaryFull body payload in JSON format.
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.run_integration_task_v2(ID=integer, category="string")
print(response)

Get all the integration types

GET /aspm-api-gateway/api/v1/integration_types
Scope ASPM Admin: READ Consumes · Produces application/json
PEP 8 get_integration_types

No keywords or arguments accepted.

from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_integration_types()
print(response)

Get a list of all the integrations

GET /aspm-api-gateway/api/v1/integrations
Scope ASPM Read Only: READ Consumes · Produces application/json
PEP 8 get_integrations
NameTypeData typeDescription
integration_typequerystringIntegration type.
categoryquerystringIntegration category.
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_integrations(integration_type="string", category="string")
print(response)

Create a new integration

POST /aspm-api-gateway/api/v1/integrations
Scope ASPM Admin: WRITE Consumes · Produces application/json
PEP 8 create_integration
NameTypeData typeDescription
bodybodydictionaryFull body payload in JSON format.
integrationbodydictionaryIntegration details in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.create_integration(integration={})
print(response)

Get a list of all the integrations.

GET /aspm-api-gateway/api/v1/integrations/v2
Scope ASPM Admin: READ Consumes · Produces application/json
PEP 8 get_integrations_v2
NameTypeData typeDescription
integration_typequeryintegerIntegration type.
categoryquerystringCategory.
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_integrations_v2(integration_type=integer,
category="string")
print(response)

Update an existing integration by its ID

PUT /aspm-api-gateway/api/v1/integrations/{ID}
Scope ASPM Admin: WRITE Consumes · Produces application/json
PEP 8 update_integration
NameTypeData typeDescription
parametersqueryintegerIntegration ID to update.
bodybodydictionaryFull body payload in JSON format.
overwrite_fieldsbodylist of stringsFields to be overwritten.
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.update_integration(id=integer,
integration={},
overwrite_fields=["string"])
print(response)

Delete an existing integration by its ID

DELETE /aspm-api-gateway/api/v1/integrations/{ID}
Scope ASPM Admin: WRITE Consumes · Produces application/json
PEP 8 delete_integration
NameTypeData typeDescription
idpathintegerIntegration ID.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.delete_integration(id=integer)
print(response)

Execute a query. The syntax used is identical to that of the query page.

POST /aspm-api-gateway/api/v1/query
Scope ASPM Read Only: READ Consumes · Produces application/json
PEP 8 execute_query
NameTypeData typeDescription
bodybodydictionaryFull body payload in JSON format.
paginatebodydictionaryPagination detail.
querybodystringQuery to execute.
select_fieldsbodydictionaryField selection detail.
timestampbodyintegerTimestamp.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.execute_query(paginate={},
query="string",
select_fields={},
timestamp=integer)
print(response)

Retrieve ServiceNow deployments

GET /aspm-api-gateway/api/v1/servicenow/deployments
Scope ASPM Read Only: READ Consumes · Produces application/json
PEP 8 get_servicenow_deployments
NameTypeData typeDescription
ql_filtersquerystringQuery filter.
limitqueryintegerMaximum number of records to return.
offsetqueryintegerStarting position of returned records.
order_byquerystringSort field.
directionquerystringSort direction.
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_servicenow_deployments(ql_filters="string",
limit=integer,
offset=integer,
orderBy="string",
direction="string")
print(response)

Retrieve ServiceNow services.

GET /aspm-api-gateway/api/v1/servicenow/services
Scope ASPM Read Only: READ Consumes · Produces application/json
PEP 8 get_servicenow_services
NameTypeData typeDescription
exclude_artifactsquerybooleanFlag indicating if artifacts should be excluded.
ql_filtersquerystringQuery filter.
limitqueryintegerMaximum number of records to return.
offsetqueryintegerStarting position of returned records.
order_byquerystringSort field.
directionquerystringSort direction.
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_servicenow_services(exclude_artifacts=boolean,
ql_filters="string",
limit=integer,
offset=integer,
orderBy="string",
direction="string")
print(response)

Get the total amount of existing services

POST /aspm-api-gateway/api/v1/services/count
Scope ASPM Read Only: READ Consumes · Produces application/json
PEP 8 get_services_count
NameTypeData typeDescription
bodybodydictionaryFull body payload in JSON format.
deployment_tuple_filtersbodylist of dictionariesFilter excludes and includes.
nesting_levelbodyintegerNesting level.
only_countbodybooleanFlag indicating if result totals only should be returned.
optional_timebodyintegerOptional time.
paginationbodydictionaryPagination.
persistent_signaturesbodystring or list of stringsPersistent signatures.
ql_filtersbodystringQuery filters.
related_entitiesbodylist of dictionariesRelated entities.
revision_idbodyintegerRevision ID.
roles_signaturesbodystringRoles signature.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
deployment_tuple_filters = [
{
"excludes": [
{
"key": "string",
"value": "string"
}
],
"includes": [
{
"key": "string",
"value": "string"
}
]
}
]
pagination = {
"direction": "string",
"limit": integer,
"offset": integer,
"order_by": ["string"]
}
related_entities = [
{
"aggregation_type": integer,
"entity_type": integer,
"filters": {
"include_du_services": boolean,
"only_du_types": boolean,
"only_get_brokers": boolean
},
"group_by_fields": {
"fields": ["string"]
}
}
]
response = falcon.get_services_count(cids=["string"],
deployment_tuple_filters=deployment_tuple_filters,
nesting_level=integer,
only_count=boolean,
optional_time=integer,
pagination=pagination,
persistent_signatures=["string"],
ql_filters="string",
related_entities=related_entities,
revision_id=integer,
roles_signature="string")
print(response)

Get the different types of violation

GET /aspm-api-gateway/api/v1/services/violations/types
Scope ASPM Read Only: READ Consumes · Produces application/json
PEP 8 get_service_violation_types
NameTypeData typeDescription
bodybodydictionaryFull body payload in JSON format.
filterbodydictionaryFilter to use for search.
optional_timebodyintegerOptional time.
revision_idbodyintegerRevision ID.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_service_violation_types(filter={},
optional_time=integer,
revision_id=integer)
print(response)

Get all the tags

GET /aspm-api-gateway/api/v1/tags
Scope ASPM Read Only: READ Consumes · Produces application/json
PEP 8 get_tags
NameTypeData typeDescription
is_uniquequerybooleanTag is unique.
limitqueryintegerMaximum number of records to return.
offsetqueryintegerStarting position of returned records.
tag_namequerystringTag name.
namequerystring or list of stringsName.
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_tags(is_unique=boolean,
tag_name="string",
limit=integer,
offset=integer,
name="string")
print(response)

Create new or update existing tag. You can update unique tags table or regular tags table

PUT /aspm-api-gateway/api/v1/tags
Scope ASPM Analyst: WRITE Consumes · Produces application/json
PEP 8 update_tags
NameTypeData typeDescription
bodybodydictionaryFull body payload in JSON format.
is_sensitivebodybooleanFlag indicating if the tag is sensitive.
persistent_signaturebodystringTag persistent signature.
valuebodystringTag value.
namebodystringTag name.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
entries = [
{
"isSensitive": true,
"name": "string",
"tag_type": "string",
"value": "string"
}
]
response = falcon.update_tags(entries=entries,
is_sensitive=boolean,
name="string",
tag_type="string",
value="string")
print(response)

Remove existing tags

POST /aspm-api-gateway/api/v1/tags
Scope ASPM Analyst: WRITE Consumes · Produces application/json
PEP 8 delete_tags
NameTypeData typeDescription
bodybodydictionaryFull body payload in JSON format.
is_sensitivebodybooleanFlag indicating if the tag is sensitive.
persistent_signaturebodystringTag persistent signature.
valuebodystringTag value.
namebodystringTag name.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.delete_tags(entries=[{"key": "value"}],
is_sensitive=boolean,
name="string",
persistent_signature="string",
value="string")
print(response)

Get group hierarchy

GET /aspm-api-gateway/api/v1/groups/hier/v2
Scope Aspm Admin: READ Consumes · Produces application/json
PEP 8 get_group_hierarchy
NameTypeData typeDescription
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_group_hierarchy()
print(response)

Get group details

GET /aspm-api-gateway/api/v1/group/{}/v2
Scope Aspm Admin: READ Consumes · Produces application/json
PEP 8 get_group_v2
NameTypeData typeDescription
IDpathintegerGroup ID
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_group_v2(id=integer)
print(response)

DELETE /aspm-api-gateway/api/v1/group/{}
Scope Aspm Falcon Admin: WRITE Consumes · Produces application/json
PEP 8 delete_group
NameTypeData typeDescription
IDpathintegerGroup ID
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.delete_group(id=integer)
print(response)

GET /aspm-api-gateway/api/v1/groups/list/v2
Scope Aspm Admin: READ Consumes · Produces application/json
PEP 8 get_groups_v2
NameTypeData typeDescription
typequerystringGroup types to query - can either be empty (all), parents, children
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_groups_v2(type="string")
print(response)

Get all the integration tasks, requires admin scope

GET /aspm-api-gateway/api/v1/integration_tasks/admin
Scope Aspm Admin: READ Consumes · Produces application/json
PEP 8 get_integration_tasks_admin
NameTypeData typeDescription
integration_task_typequeryinteger
categoryquerystring
offsetqueryinteger
limitqueryinteger
orderByquerystring
directionquerystring
integration_task_typesqueryinteger
idsqueryinteger
namesquerystring
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_integration_tasks_admin(integration_task_type=integer,
category="string",
offset=integer,
limit=integer,
order_by="string",
direction="string",
integration_task_types=integer,
ids=id_list,
names="string")
print(response)

List users

GET /aspm-api-gateway/api/v1/users/v2
Scope Aspm Admin: READ Consumes · Produces application/json
PEP 8 get_users_v2
NameTypeData typeDescription
paginationquerystringURL encoded pagination JSON - limit, offset, direction, orderBy
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_users_v2(pagination="string")
print(response)

Create group

POST /aspm-api-gateway/api/v1/group/v2
Scope Aspm Falcon Admin: WRITE Consumes · Produces application/json
PEP 8 post_group_v2
NameTypeData typeDescription
parametersquerydictionaryFull query string parameters payload in JSON format.
bodybodydictionaryFull body payload as a JSON formatted dictionary.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.post_group_v2(children=integer,
description="string",
group_type="string",
is_default=boolean,
name="string",
parent_id=integer,
scope="string")
print(response)

Update default group

POST /aspm-api-gateway/api/v1/group/{}/update_default
Scope Aspm Falcon Admin: WRITE Consumes · Produces application/json
PEP 8 update_default_group
NameTypeData typeDescription
IDpathintegerGroup ID
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.update_default_group(id=integer)
print(response)

Update group

POST /aspm-api-gateway/api/v1/group/{}/v2
Scope Aspm Falcon Admin: WRITE Consumes · Produces application/json
PEP 8 update_group
NameTypeData typeDescription
IDpathintegerGroup ID
parametersquerydictionaryFull query string parameters payload in JSON format.
bodybodydictionaryFull body payload as a JSON formatted dictionary.
from falconpy import ASPM
falcon = ASPM(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.update_group(id=integer,
children=integer,
description="string",
group_type="string",
is_default=boolean,
name="string",
parent_id=integer,
scope="string")
print(response)