Skip to content
CrowdStrike Developer Center

CAO Hunting

The CAO Hunting service collection provides operations for accessing intelligence queries and hunting guides. Aggregate intelligence queries or hunting guides, create archive exports, retrieve entities by ID, and search for matching records using FQL filters.

LanguageLast Update
Pythonv1.6.5
PowerShellv2.2.9
Gov0.22.0
TypeScriptv0.6.0
Rustv0.7.1
Rubyv1.4.0

Table of Contents

Section titled “Table of Contents”
OperationDescription
AggregateHuntingGuides
aggregate_guides		Aggregate Hunting Guides
AggregateIntelligenceQueries
aggregate_queries		Aggregate intelligence queries
GetArchiveExport
create_export_archive		Creates an Archive Export
GetHuntingGuides
get_guides		Retrieves a list of Hunting Guides
GetIntelligenceQueries
get_queries		Retrieves the details of a list of Intelligence queries IDs
SearchHuntingGuides
search_guides		Search for Hunting Guides that match the provided conditions
SearchIntelligenceQueries
search_queries		Search for a list of intelligence queries IDs that match the provided conditions

AggregateHuntingGuides

Section titled “AggregateHuntingGuides”

Aggregate Hunting Guides

Method POST
Route /hunting/aggregates/hunting-guides/v1
Scope CAO Hunting: READ
PEP 8 aggregate_guides

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
exclude body · string
extended_bounds body · object
field body · string
filter body · string
filters_spec body · object
from body · integer
include body · string
interval body · string
Available values (6)
yearmonthweek
dayhourminute
max_doc_count body · integer
min_doc_count body · integer
missing body · string
name body · string
percents body · array
q body · string
ranges body · array
size body · integer
sort body · string
Available values (2)
_count
sort by document count
_term
sort by the string value alphabetically
sub_aggregates body · array
time_zone body · string
type body · string
Available values (9)
date_histogram
Aggregates counts on a specified time interval. Requires use of “interval” field.
date_range
Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
terms
Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
cardinality
Returns the count of distinct values in a specified field.
max
Returns the maximum value of a specified field.
min
Returns the minimum value of a specified field.
avg
Returns the average value of the specified field.
sum
Returns the total sum of all values for the specified field.
percentiles
Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.
Code Examples
from falconpy import CAOHunting


falcon = CAOHunting(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )


date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]


extended_bounds = {
    "max": "string",
    "min": "string"
}


filters_spec = {
    "filters": {},
    "other_bucket": boolean,
    "other_bucket_key": "string"
}


ranges = [
    {
        "from": integer,
        "to": integer
    }
]


sub_aggregates = [
    {
        "date_ranges": [
            {
                "from": "string",
                "to": "string"
            }
        ],
        "exclude": "string",
        "extended_bounds": {
            "max": "string",
            "min": "string"
        },
        "field": "string",
        "filter": "string",
        "filters_spec": {
            "filters": {},
            "other_bucket": boolean,
            "other_bucket_key": "string"
        },
        "from": integer,
        "include": "string",
        "interval": "string",
        "max_doc_count": integer,
        "min_doc_count": integer,
        "missing": "string",
        "name": "string",
        "percents": ["string"],
        "q": "string",
        "ranges": [
            {
                "from": integer,
                "to": integer
            }
        ],
        "size": integer,
        "sort": "string",
        "sub_aggregates": [
            {
                "date_ranges": ["string"],
                "exclude": "string",
                "extended_bounds": {},
                "field": "string",
                "filter": "string",
                "filters_spec": {},
                "from": integer,
                "include": "string",
                "interval": "string",
                "max_doc_count": integer,
                "min_doc_count": integer,
                "missing": "string",
                "name": "string",
                "percents": ["string"],
                "q": "string",
                "ranges": ["string"],
                "size": integer,
                "sort": "string",
                "sub_aggregates": ["string"],
                "time_zone": "string",
                "type": "string"
            }
        ],
        "time_zone": "string",
        "type": "string"
    }
]


response = falcon.aggregate_guides(date_ranges=date_ranges,
                                   exclude="string",
                                   extended_bounds=extended_bounds,
                                   field="string",
                                   filter="string",
                                   filters_spec=filters_spec,
                                   from=integer,
                                   include="string",
                                   interval="string",
                                   max_doc_count=integer,
                                   min_doc_count=integer,
                                   missing="string",
                                   name="string",
                                   percents=["string"],
                                   q="string",
                                   ranges=ranges,
                                   size=integer,
                                   sort="string",
                                   sub_aggregates=sub_aggregates,
                                   time_zone="string",
                                   type="string")
print(response)
Responses
[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

AggregateIntelligenceQueries

Section titled “AggregateIntelligenceQueries”

Aggregate intelligence queries

Method POST
Route /hunting/aggregates/intelligence-queries/v1
Scope CAO Hunting: READ
PEP 8 aggregate_queries

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
If peforming a date range query specify the from and to date ranges. These can be in common date formats like 2019-07-18 or now.
exclude body · string
Fields to exclude.
extended_bounds body · object
Extended bounds.
field body · string
Term you want to aggregate on. If doing a date_range query, this is the date field you want to apply the date ranges to.
filter body · string
Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
filters_spec body · object
from body · integer
include body · string
Fields to include.
interval body · string
Available values (6)
yearmonthweek
dayhourminute
max_doc_count body · integer
Maximum number of documents.
min_doc_count body · integer
Minimum number of documents.
missing body · string
name body · string
Scan name.
percents body · array
q body · string
FQL syntax.
ranges body · array
size body · integer
sort body · string
FQL syntax.
Available values (2)
_count
sort by document count
_term
sort by the string value alphabetically
sub_aggregates body · array
time_zone body · string
type body · string
Available values (10)
date_histogram
Aggregates counts on a specified time interval. Requires use of “interval” field.
date_range
Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
terms
Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
range
Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.
cardinality
Returns the count of distinct values in a specified field.
max
Returns the maximum value of a specified field.
min
Returns the minimum value of a specified field.
avg
Returns the average value of the specified field.
sum
Returns the total sum of all values for the specified field.
percentiles
Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.
Code Examples
from falconpy import CAOHunting


falcon = CAOHunting(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )


response = falcon.aggregate_queries(date_ranges=[{"key": "value"}],
                                    exclude="string",
                                    extended_bounds={},
                                    field="string",
                                    filter="string",
                                    from=integer,
                                    include="string",
                                    interval="string",
                                    max_doc_count=integer,
                                    min_doc_count=integer,
                                    missing="string",
                                    name="string",
                                    q="string",
                                    ranges=[{"key": "value"}],
                                    size=integer,
                                    sort="string",
                                    sub_aggregates=["string"],
                                    time_zone="string",
                                    type="string")
print(response)
Responses
[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

GetArchiveExport

Section titled “GetArchiveExport”

Creates an Archive Export

Method GET
Route /hunting/entities/archive-exports/v1
Scope CAO Hunting: READ
PEP 8 create_export_archive

Parameters

Section titled “Parameters”
language query · string
The Query Language. Accepted Values:
Available values (6)
cqlsnortsuricata
yaraSPLall
filter query · string
The FQL Filter.
archive_type query · string
The Archive Type can be one of:
Available values (3)
zipandgzip
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import CAOHunting


falcon = CAOHunting(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )


with open("output_file", "wb") as save_file:
    response = falcon.create_export_archive(archive_type="string",
                                            filter="string",
                                            language="string",
                                            stream=boolean)
    save_file.write(response)
Responses
{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

GetHuntingGuides

Section titled “GetHuntingGuides”

Retrieves a list of Hunting Guides

Method GET
Route /hunting/entities/hunting-guides/v1
Scope CAO Hunting: READ
PEP 8 get_guides

Parameters

Section titled “Parameters”
ids query · string or list of strings
Hunting Guides IDs
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import CAOHunting


falcon = CAOHunting(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_guides(ids=id_list)
print(response)
Responses
[
  {
    "adversaries": [],
    "ai_description": "string",
    "ai_short_description": "string",
    "category": {},
    "cql_query_count": 0,
    "description": "string",
    "environments": [],
    "hunt_count": 0,
    "hunt_filter": "string",
    "id": "string",
    "languages": [],
    "last_updated_at": "string",
    "malware_families": [],
    "mitre": [],
    "name": "string",
    "queries": []
  }
]

GetIntelligenceQueries

Section titled “GetIntelligenceQueries”

Retrieves the details of a list of Intelligence queries IDs

Method GET
Route /hunting/entities/intelligence-queries/v1
Scope CAO Hunting: READ
PEP 8 get_queries

Parameters

Section titled “Parameters”
ids query · string or list of strings
Intelligence queries IDs
include_translated_content query · string or list of strings
The AI translated language that should be returned if it exists<br>Accepted values are:
Available values (2)
SPLall
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import CAOHunting


falcon = CAOHunting(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_queries(ids=id_list, include_translated_content=id_list)
print(response)
Responses
[
  {
    "adversaries": [],
    "content": "string",
    "created_at": "string",
    "depends_on": [],
    "description": "string",
    "elite_analyst_notes": "string",
    "elite_query_explainer": "string",
    "environment": [],
    "has_elite_analyst_notes": false,
    "has_elite_query_explainer": false,
    "hunting_guides": [],
    "id": "string",
    "kill_chain": [],
    "language": "string",
    "last_updated_at": "string",
    "malware_families": [],
    "mitre": [],
    "mitre_technique_ids": [],
    "name": "string",
    "provider": "string",
    "relates_to_community_alias": [],
    "reports": [],
    "reports_count": 0,
    "subscriptions": [],
    "translated_languages": [],
    "translations": [],
    "type": "string",
    "version": "string"
  }
]

SearchHuntingGuides

Section titled “SearchHuntingGuides”

Search for Hunting Guides that match the provided conditions

Method GET
Route /hunting/queries/hunting-guides/v1
Scope CAO Hunting: READ
PEP 8 search_guides

Parameters

Section titled “Parameters”
offset query · string
Starting index of result set from which to return IDs.
limit query · integer
Number of IDs to return.
sort query · string
Order by fields.
filter query · string
FQL query specifying the filter parameters.
q query · string
Match phrase_prefix query criteria; included fields: _all (all filter string fields indexed).
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import CAOHunting


falcon = CAOHunting(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )


response = falcon.search_guides(offset="string",
                                limit=integer,
                                sort="string",
                                filter="string",
                                q="string")
print(response)
Responses
[
  "string"
]

SearchIntelligenceQueries

Section titled “SearchIntelligenceQueries”

Search for a list of intelligence queries IDs that match the provided conditions

Method GET
Route /hunting/queries/intelligence-queries/v1
Scope CAO Hunting: READ
PEP 8 search_queries

Parameters

Section titled “Parameters”
offset query · string
Starting index of result set from which to return IDs.
limit query · integer
Number of IDs to return.
sort query · string
Order by fields.
filter query · string
FQL query specifying the filter parameters.
q query · string
Match phrase_prefix query criteria; included fields: _all (all filter string fields indexed).
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import CAOHunting


falcon = CAOHunting(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )


response = falcon.search_queries(filter="string",
                                 limit=integer,
                                 sort="string",
                                 offset="string",
                                 q="string")
print(response)
Responses
[
  "string"
]
© 2026 CrowdStrike, Inc. All rights reserved. Privacy Notice Cookie Notice Terms of Use