Case Management

The Case Management service collection provides operations for managing security cases and workflows. Create, update, assign, and query cases, as well as manage case activities, attachments, and status transitions.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
aggregates.access-tags.post.v1 get_access_tag_aggregations	Get access tag aggregates
aggregates.file-details.post.v1 aggregates_file_details_post_v1	Get file details aggregates as specified via json in the request body.
aggregates.notification-groups.post.v1 get_notification_groups_aggregation	Get notification groups aggregations deprecated
aggregates.notification-groups.post.v2 get_notification_groups_aggregation_v2	Get notification groups aggregations
aggregates.slas.post.v1 get_sla_aggregations	Get SLA aggregations
aggregates.templates.post.v1 get_template_aggregations	Get templates aggregations
combined.file-details.get.v1 query_file_details	Query file details
entities.access-tags.get.v1 get_access_tags	Get access tags
entities.alert-evidence.post.v1 add_case_alert_evidence	Adds the given list of alert evidence to the specified case.
entities.case-tags.delete.v1 delete_case_tags	Removes the specified tags from the specified case.
entities.case-tags.post.v1 add_case_tags	Adds the given list of tags to the specified case.
entities.cases.patch.v2 update_case_fields	Updates given fields on the specified case.
entities.cases.post.v2 get_cases	Retrieves all Cases given their IDs.
entities.cases.put.v2 create_case	Creates the given Case
entities.event-evidence.post.v1 add_case_event_evidence	Adds the given list of event evidence to the specified case.
entities.fields.get.v1 get_fields	Get fields by ID
entities.file-details.get.v1 get_file_details	Get file details by id
entities.file-details.patch.v1 update_file_details	Update file details
entities.files.delete.v1 delete_file_details	Delete file details by id
entities.files_bulk-download.post.v1 bulk_download_files	Download multiple existing file from case as a ZIP
entities.files_download.get.v1 download_existing_files	Download existing file from case
entities.files_download.post.v1	Download existing files from case deprecated
entities.files_upload.post.v1 upload_file	Upload file for case
entities.get-rtr-file-metadata.post.v1 get_rtr_file_metadata	gets metadata for a file via RTR without retrieving it
entities.merge.post.v1 entities_merge_post_v1	Merges a source case into a destination case.
entities.notification-groups.delete.v1 delete_notification_group	Delete notification groups by ID deprecated
entities.notification-groups.delete.v2 delete_notification_group_v2	Delete notification groups by ID
entities.notification-groups.get.v1 get_notification_groups	Get notification groups by ID deprecated
entities.notification-groups.get.v2 get_notification_groups_v2	Get notification groups by ID
entities.notification-groups.patch.v1 update_notification_group	Update notification group deprecated
entities.notification-groups.patch.v2 update_notification_group_v2	Update notification group
entities.notification-groups.post.v1 create_notification_group	Create notification group deprecated
entities.notification-groups.post.v2 create_notification_group_v2	Create notification group
entities.retrieve-rtr-file.post.v1 retrieve_rtr_file	retrieves a file from host using RTR and adds it to a case
entities.retrieve-rtr-recent-file.post.v1 retrieve_rtr_recent_file	RetrieveRecentRTRFile retrieves a recently fetched RTR file and adds it to a case
entities.slas.delete.v1 delete_sla	Delete SLAs
entities.slas.get.v1 get_slas	Get SLAs by ID
entities.slas.patch.v1 update_sla	Update SLA
entities.slas.post.v1 create_sla	Create SLA
entities.template-snapshots.get.v1 get_template_snapshots	Get template snapshots
entities.templates.delete.v1 delete_templates	Delete templates
entities.templates.get.v1 get_templates	Get templates by ID
entities.templates.patch.v1 update_template	Update template
entities.templates.post.v1 create_template	Create template
entities.templates_export.get.v1 export_templates	Export templates to files in a zip archive
entities.templates_import.post.v1 import_template	Import a template from a file
queries.access-tags.get.v1 query_access_tags	Query access tags
queries.cases.get.v1 query_case_ids	Retrieves all Cases IDs that match a given query.
queries.fields.get.v1 query_fields	Query fields
queries.file-details.get.v1 query_file_detail_ids	Query for ids of file details
queries.notification-groups.get.v1 query_notification_groups	Query notification groups deprecated
queries.notification-groups.get.v2 query_notification_groups_v2	Query notification groups
queries.slas.get.v1 query_slas	Query SLAs
queries.template-snapshots.get.v1 query_template_snapshots	Query template snapshots
queries.templates.get.v1 query_templates	Query templates

---

aggregates.access-tags.post.v1

Get access tag aggregates

Method POST

Route /casemgmt/aggregates/access-tags/v1

Scope Case Templates: READ

PEP 8 get_access_tag_aggregations

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

date_ranges body · array

Date range timeframe.

field body · string

Field to aggregate on.

filter body · string

Filter criteria in the form of an FQL query.

from body · integer

Starting index of overall result set.

name body · string

Name of the aggregation.

size body · integer

Maximum number of records to return.

sort body · string

The field to sort on.

type body · string

Type of aggregation to perform.

Available values (2)

terms

date_range

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

response = falcon.get_access_tag_aggregations(date_ranges=date_ranges,
                                              field="string",
                                              filter="string",
                                              from=integer,
                                              name="string",
                                              size=integer,
                                              sort="string",
                                              type="string")
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

response = falcon.aggregates_access_tags_post_v1(date_ranges=date_ranges,
                                                 field="string",
                                                 filter="string",
                                                 from=integer,
                                                 name="string",
                                                 size=integer,
                                                 sort="string",
                                                 type="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = [
    {
        "date_ranges": [
            {
                "from": "string",
                "to": "string"
            }
        ],
        "field": "string",
        "filter": "string",
        "from": integer,
        "name": "string",
        "size": integer,
        "sort": "string",
        "type": "string"
    }
]

response = falcon.command("aggregates_access_tags_post_v1", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  from := "string"
  to := "string"
  field := "string"
  filter := "string"
  from := integer
  name := "string"
  size := integer
  sort := "string"
  typeVar := "string"

  response, err := client.CaseManagement.AggregatesAccessTagsPostV1(
    &case_management.AggregatesAccessTagsPostV1Params{
      Body: []*models.APIMSAAggregateQueryRequest{
        {
          DateRanges: []interface{}{
            {
            From: &from,
            To: &to,
            },
          },
          Field: &field,
          Filter: &filter,
          From: &from,
          Name: &name,
          Size: &size,
          Sort: &sort,
          Type: &typeVar,
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.aggregatesAccessTagsPostV1(
  [{
    dateRanges: [{
        from: "string",
        to: "string"
      }],
    field: "string",
    filter: "string",
    from: integer,
    name: "string",
    size: integer,
    sort: "string",
    type: "string"
}]  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

body = [Falcon::ApiMSAAggregateQueryRequest.new(
  date_ranges: [{
      from: 'string',
      to: 'string'
    }],
  field: 'string',
  filter: 'string',
  from: integer,
  name: 'string',
  size: integer,
  sort: 'string',
  type: 'string'
)]

response = api.aggregates_access_tags_post_v1(body)

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

aggregates.file-details.post.v1

Get file details aggregates as specified via json in the request body.

Method POST

Route /case-files/aggregates/file-details/v1

Scope Cases: READ

PEP 8 aggregates_file_details_post_v1

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

ids query · string or list of strings

Resource IDs

filter query · string

FQL filter expression.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.aggregates_file_details_post_v1(ids=id_list, filter="string")
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.aggregates_file_details_post_v1(ids=id_list, filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("aggregates_file_details_post_v1", ids=id_list, filter="string", body={})
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_files"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.CaseFiles.AggregatesFileDetailsPostV1(
    &case_files.AggregatesFileDetailsPostV1Params{
      Body: []models.MsaAggregateQueryRequest{},
      Ids: []string{"ID1", "ID2", "ID3"},
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseFiles.aggregatesFileDetailsPostV1(
  ["ID1", "ID2", "ID3"],  // ids
  [{}],  // body
  "string"  // filter
);

console.log(response);

Rust

use rusty_falcon::apis::case_files_api::aggregates_file_details_post_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = aggregates_file_details_post_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
        vec![serde_json::json!({})],  // body
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseFiles.new

body = [{}]

response = api.aggregates_file_details_post_v1(body, ['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

aggregates.notification-groups.post.v1

Get notification groups aggregations

Deprecated

This operation is deprecated.

Method POST

Route /casemgmt/aggregates/notification-groups/v1

Scope Case Templates: READ

PEP 8 get_notification_groups_aggregation

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

date_ranges body · array

Date range timeframe.

field body · string

Field to aggregate on.

filter body · string

Filter criteria in the form of an FQL query.

from body · integer

Starting index of overall result set.

name body · string

Name of the aggregation.

size body · integer

Maximum number of records to return.

sort body · string

The field to sort on.

type body · string

Type of aggregation to perform.

Available values (2)

terms

date_range

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

response = falcon.get_notification_groups_aggregation(date_ranges=date_ranges,
                                                      field="string",
                                                      filter="string",
                                                      from=integer,
                                                      name="string",
                                                      size=integer,
                                                      sort="string",
                                                      type="string")
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

response = falcon.aggregates_notification_groups_post_v1(date_ranges=date_ranges,
                                                         field="string",
                                                         filter="string",
                                                         from=integer,
                                                         name="string",
                                                         size=integer,
                                                         sort="string",
                                                         type="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = [
    {
        "date_ranges": [
            {
                "from": "string",
                "to": "string"
            }
        ],
        "field": "string",
        "filter": "string",
        "from": integer,
        "name": "string",
        "size": integer,
        "sort": "string",
        "type": "string"
    }
]

response = falcon.command("aggregates_notification_groups_post_v1", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  from := "string"
  to := "string"
  field := "string"
  filter := "string"
  from := integer
  name := "string"
  size := integer
  sort := "string"
  typeVar := "string"

  response, err := client.CaseManagement.AggregatesNotificationGroupsPostV1(
    &case_management.AggregatesNotificationGroupsPostV1Params{
      Body: []*models.APIMSAAggregateQueryRequest{
        {
          DateRanges: []interface{}{
            {
            From: &from,
            To: &to,
            },
          },
          Field: &field,
          Filter: &filter,
          From: &from,
          Name: &name,
          Size: &size,
          Sort: &sort,
          Type: &typeVar,
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.aggregatesNotificationGroupsPostV1(
  [{
    dateRanges: [{
        from: "string",
        to: "string"
      }],
    field: "string",
    filter: "string",
    from: integer,
    name: "string",
    size: integer,
    sort: "string",
    type: "string"
}]  // body
);

console.log(response);

Rust

use rusty_falcon::apis::case_management_api::aggregates_notification_groups_post_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApiMsaAggregateQueryRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = vec![ApiMsaAggregateQueryRequest {
            date_ranges: vec![DateRangeSpec {
                from: Some("string".to_string()),
                to: Some("string".to_string()),
                ..Default::default()
            }],
            field: Some("string".to_string()),
            filter: Some("string".to_string()),
            from: Some(integer),
            name: Some("string".to_string()),
            size: Some(integer),
            sort: Some("string".to_string()),
            type: Some("string".to_string()),
            ..Default::default()
        }];

    let response = aggregates_notification_groups_post_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

body = [Falcon::ApiMSAAggregateQueryRequest.new(
  date_ranges: [{
      from: 'string',
      to: 'string'
    }],
  field: 'string',
  filter: 'string',
  from: integer,
  name: 'string',
  size: integer,
  sort: 'string',
  type: 'string'
)]

response = api.aggregates_notification_groups_post_v1(body)

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

aggregates.notification-groups.post.v2

Get notification groups aggregations

Method POST

Route /casemgmt/aggregates/notification-groups/v2

Scope Case Templates: READ

PEP 8 get_notification_groups_aggregation_v2

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

date_ranges body · array

Date range timeframe.

field body · string

Field to aggregate on.

filter body · string

Filter criteria in the form of an FQL query.

from body · integer

Starting index of overall result set.

name body · string

Name of the aggregation.

size body · integer

Maximum number of records to return.

sort body · string

The field to sort on.

type body · string

Type of aggregation to perform.

Available values (2)

terms

date_range

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

response = falcon.get_notification_groups_aggregation_v2(date_ranges=date_ranges,
                                                         field="string",
                                                         filter="string",
                                                         from=integer,
                                                         name="string",
                                                         size=integer,
                                                         sort="string",
                                                         type="string")
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

response = falcon.aggregates_notification_groups_post_v2(date_ranges=date_ranges,
                                                         field="string",
                                                         filter="string",
                                                         from=integer,
                                                         name="string",
                                                         size=integer,
                                                         sort="string",
                                                         type="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = [
    {
        "date_ranges": [
            {
                "from": "string",
                "to": "string"
            }
        ],
        "field": "string",
        "filter": "string",
        "from": integer,
        "name": "string",
        "size": integer,
        "sort": "string",
        "type": "string"
    }
]

response = falcon.command("aggregates_notification_groups_post_v2", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  from := "string"
  to := "string"
  field := "string"
  filter := "string"
  from := integer
  name := "string"
  size := integer
  sort := "string"
  typeVar := "string"

  response, err := client.CaseManagement.AggregatesNotificationGroupsPostV2(
    &case_management.AggregatesNotificationGroupsPostV2Params{
      Body: []*models.APIMSAAggregateQueryRequest{
        {
          DateRanges: []interface{}{
            {
            From: &from,
            To: &to,
            },
          },
          Field: &field,
          Filter: &filter,
          From: &from,
          Name: &name,
          Size: &size,
          Sort: &sort,
          Type: &typeVar,
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.aggregatesNotificationGroupsPostV2(
  [{
    dateRanges: [{
        from: "string",
        to: "string"
      }],
    field: "string",
    filter: "string",
    from: integer,
    name: "string",
    size: integer,
    sort: "string",
    type: "string"
}]  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

body = [Falcon::ApiMSAAggregateQueryRequest.new(
  date_ranges: [{
      from: 'string',
      to: 'string'
    }],
  field: 'string',
  filter: 'string',
  from: integer,
  name: 'string',
  size: integer,
  sort: 'string',
  type: 'string'
)]

response = api.aggregates_notification_groups_post_v2(body)

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

aggregates.slas.post.v1

Get SLA aggregations

Method POST

Route /casemgmt/aggregates/slas/v1

Scope Case Templates: READ

PEP 8 get_sla_aggregations

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

date_ranges body · array

Date range timeframe.

field body · string

Field to aggregate on.

filter body · string

Filter criteria in the form of an FQL query.

from body · integer

Starting index of overall result set.

name body · string

Name of the aggregation.

size body · integer

Maximum number of records to return.

sort body · string

The field to sort on.

type body · string

Type of aggregation to perform.

Available values (2)

terms

date_range

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

response = falcon.get_sla_aggregations(date_ranges=date_ranges,
                                       field="string",
                                       filter="string",
                                       from=integer,
                                       name="string",
                                       size=integer,
                                       sort="string",
                                       type="string")
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

response = falcon.aggregates_slas_post_v1(date_ranges=date_ranges,
                                          field="string",
                                          filter="string",
                                          from=integer,
                                          name="string",
                                          size=integer,
                                          sort="string",
                                          type="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = [
    {
        "date_ranges": [
            {
                "from": "string",
                "to": "string"
            }
        ],
        "field": "string",
        "filter": "string",
        "from": integer,
        "name": "string",
        "size": integer,
        "sort": "string",
        "type": "string"
    }
]

response = falcon.command("aggregates_slas_post_v1", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  from := "string"
  to := "string"
  field := "string"
  filter := "string"
  from := integer
  name := "string"
  size := integer
  sort := "string"
  typeVar := "string"

  response, err := client.CaseManagement.AggregatesSlasPostV1(
    &case_management.AggregatesSlasPostV1Params{
      Body: []*models.APIMSAAggregateQueryRequest{
        {
          DateRanges: []interface{}{
            {
            From: &from,
            To: &to,
            },
          },
          Field: &field,
          Filter: &filter,
          From: &from,
          Name: &name,
          Size: &size,
          Sort: &sort,
          Type: &typeVar,
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.aggregatesSlasPostV1(
  [{
    dateRanges: [{
        from: "string",
        to: "string"
      }],
    field: "string",
    filter: "string",
    from: integer,
    name: "string",
    size: integer,
    sort: "string",
    type: "string"
}]  // body
);

console.log(response);

Rust

use rusty_falcon::apis::case_management_api::aggregates_slas_post_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApiMsaAggregateQueryRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = vec![ApiMsaAggregateQueryRequest {
            date_ranges: vec![DateRangeSpec {
                from: Some("string".to_string()),
                to: Some("string".to_string()),
                ..Default::default()
            }],
            field: Some("string".to_string()),
            filter: Some("string".to_string()),
            from: Some(integer),
            name: Some("string".to_string()),
            size: Some(integer),
            sort: Some("string".to_string()),
            type: Some("string".to_string()),
            ..Default::default()
        }];

    let response = aggregates_slas_post_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

body = [Falcon::ApiMSAAggregateQueryRequest.new(
  date_ranges: [{
      from: 'string',
      to: 'string'
    }],
  field: 'string',
  filter: 'string',
  from: integer,
  name: 'string',
  size: integer,
  sort: 'string',
  type: 'string'
)]

response = api.aggregates_slas_post_v1(body)

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

aggregates.templates.post.v1

Get templates aggregations

Method POST

Route /casemgmt/aggregates/templates/v1

Scope Case Templates: READ

PEP 8 get_template_aggregations

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

date_ranges body · array

Date range timeframe.

field body · string

Field to aggregate on.

filter body · string

Filter criteria in the form of an FQL query.

from body · integer

Starting index of overall result set.

name body · string

Name of the aggregation.

size body · integer

Maximum number of records to return.

sort body · string

The field to sort on.

type body · string

Type of aggregation to perform.

Available values (2)

terms

date_range

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

response = falcon.get_template_aggregations(date_ranges=date_ranges,
                                            field="string",
                                            filter="string",
                                            from=integer,
                                            name="string",
                                            size=integer,
                                            sort="string",
                                            type="string")
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

response = falcon.aggregates_templates_post_v1(date_ranges=date_ranges,
                                               field="string",
                                               filter="string",
                                               from=integer,
                                               name="string",
                                               size=integer,
                                               sort="string",
                                               type="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = [
    {
        "date_ranges": [
            {
                "from": "string",
                "to": "string"
            }
        ],
        "field": "string",
        "filter": "string",
        "from": integer,
        "name": "string",
        "size": integer,
        "sort": "string",
        "type": "string"
    }
]

response = falcon.command("aggregates_templates_post_v1", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  from := "string"
  to := "string"
  field := "string"
  filter := "string"
  from := integer
  name := "string"
  size := integer
  sort := "string"
  typeVar := "string"

  response, err := client.CaseManagement.AggregatesTemplatesPostV1(
    &case_management.AggregatesTemplatesPostV1Params{
      Body: []*models.APIMSAAggregateQueryRequest{
        {
          DateRanges: []interface{}{
            {
            From: &from,
            To: &to,
            },
          },
          Field: &field,
          Filter: &filter,
          From: &from,
          Name: &name,
          Size: &size,
          Sort: &sort,
          Type: &typeVar,
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.aggregatesTemplatesPostV1(
  [{
    dateRanges: [{
        from: "string",
        to: "string"
      }],
    field: "string",
    filter: "string",
    from: integer,
    name: "string",
    size: integer,
    sort: "string",
    type: "string"
}]  // body
);

console.log(response);

Rust

use rusty_falcon::apis::case_management_api::aggregates_templates_post_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApiMsaAggregateQueryRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = vec![ApiMsaAggregateQueryRequest {
            date_ranges: vec![DateRangeSpec {
                from: Some("string".to_string()),
                to: Some("string".to_string()),
                ..Default::default()
            }],
            field: Some("string".to_string()),
            filter: Some("string".to_string()),
            from: Some(integer),
            name: Some("string".to_string()),
            size: Some(integer),
            sort: Some("string".to_string()),
            type: Some("string".to_string()),
            ..Default::default()
        }];

    let response = aggregates_templates_post_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

body = [Falcon::ApiMSAAggregateQueryRequest.new(
  date_ranges: [{
      from: 'string',
      to: 'string'
    }],
  field: 'string',
  filter: 'string',
  from: integer,
  name: 'string',
  size: integer,
  sort: 'string',
  type: 'string'
)]

response = api.aggregates_templates_post_v1(body)

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

combined.file-details.get.v1

Query file details

Method GET

Route /case-files/combined/file-details/v1

Scope Cases: READ

PEP 8 query_file_details

Parameters

filter query · string

FQL filter expression.

limit query · integer

Page size

offset query · integer

Page offset

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.query_file_details(filter="string",
                                     limit=integer,
                                     offset=integer)
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.combined_file_details_get_v1(filter="string",
                                               limit=integer,
                                               offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("combined_file_details_get_v1",
                          filter="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconNgsCaseFile -Filter "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_files"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.CaseFiles.CombinedFileDetailsGetV1(
    &case_files.CombinedFileDetailsGetV1Params{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseFiles.combinedFileDetailsGetV1(
  "string",  // filter
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::case_files_api::combined_file_details_get_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = combined_file_details_get_v1(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseFiles.new

response = api.combined_file_details_get_v1(filter: 'string',
                                            limit: integer,
                                            offset: integer)

puts response

Responses

200 OK

[
  {
    "case_id": "string",
    "cid": "string",
    "description": "string",
    "file_size": "string",
    "file_size_bytes": 0,
    "file_type": "string",
    "hash_value": "string",
    "id": "string",
    "name": "string",
    "source": "string",
    "uploaded_by": "string",
    "uploaded_on": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.access-tags.get.v1

Get access tags

Method GET

Route /casemgmt/entities/access-tags/v1

Scope Case Templates: READ

PEP 8 get_access_tags

Parameters

ids query · string or list of strings

Resource IDs

with_has_access query · boolean

Evaluate FGAC and return has_access property

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_access_tags(ids=id_list, with_has_access=boolean)
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_access_tags_get_v1(ids=id_list,
                                              with_has_access=boolean)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_access_tags_get_v1",
                          ids=id_list,
                          with_has_access=boolean)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  withHasAccess := boolean

  response, err := client.CaseManagement.EntitiesAccessTagsGetV1(
    &case_management.EntitiesAccessTagsGetV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      WithHasAccess: &withHasAccess,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.entitiesAccessTagsGetV1(
  "string",  // ids
  boolean  // withHasAccess
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

response = api.entities_access_tags_get_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "has_access": false,
    "id": "string",
    "key": "string",
    "templates": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.alert-evidence.post.v1

Adds the given list of alert evidence to the specified case.

Method POST

Route /cases/entities/alert-evidence/v1

Scope Cases: WRITE

PEP 8 add_case_alert_evidence

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

alerts body · array

The alert IDs.

id body · string

The specified case ID.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.add_case_alert_evidence(alerts=["string"], id="string")
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.entities_alert_evidence_post_v1(alerts=["string"],
                                                  id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "alerts": [
        {
            "id": "string"
        }
    ],
    "id": "string"
}

response = falcon.command("entities_alert_evidence_post_v1", body=body_payload)
print(response)

PowerShell

Add-FalconNgsCaseEvidence -AlertId @("ID1", "ID2") -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cases"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  id := "string"

  response, err := client.Cases.EntitiesAlertEvidencePostV1(
    &cases.EntitiesAlertEvidencePostV1Params{
      Body: &models.OperationsAddAlertsToCaseRequest{
        Alerts: []interface{}{
          {
          ID: &id,
          },
        },
        ID: &id,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cases.entitiesAlertEvidencePostV1(
  {
    alerts: [{
        id: "string"
      }],
    id: "string"
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::cases_api::entities_alert_evidence_post_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::OperationsAddAlertsToCaseRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = OperationsAddAlertsToCaseRequest {
        alerts: vec![AlertEvidenceSelector {
            id: Some("string".to_string()),
            ..Default::default()
        }],
        id: Some("string".to_string()),
        ..Default::default()
    };

    let response = entities_alert_evidence_post_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Cases.new

body = Falcon::OperationsAddAlertsToCaseRequest.new(
  alerts: [{
      id: 'string'
    }],
  id: 'string'
)

response = api.entities_alert_evidence_post_v1(body)

puts response

Responses

200 OK

[
  {
    "access_tags": [],
    "analysis_results": {},
    "assigned_to": {},
    "cid": "string",
    "consistency": {},
    "created_by": {},
    "created_timestamp": "string",
    "creation_actor": {},
    "description": "string",
    "description_format": "string",
    "description_tagged_users": [],
    "end_timestamp": "string",
    "evidence": {},
    "fields": [],
    "id": "string",
    "last_updated_by": {},
    "name": "string",
    "read_only": {},
    "reference_id": "string",
    "severity": 0,
    "severity_info": {},
    "sla": {},
    "start_timestamp": "string",
    "status": "string",
    "tags": [],
    "template": {},
    "update_actor": {},
    "updated_timestamp": "string",
    "version": 0,
    "workflows": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "access_tags": [],
      "analysis_results": {},
      "assigned_to": {},
      "cid": "string",
      "consistency": {},
      "created_by": {},
      "created_timestamp": "string",
      "creation_actor": {},
      "description": "string",
      "description_format": "string",
      "description_tagged_users": [],
      "end_timestamp": "string",
      "evidence": {},
      "fields": [],
      "id": "string",
      "last_updated_by": {},
      "name": "string",
      "read_only": {},
      "reference_id": "string",
      "severity": 0,
      "severity_info": {},
      "sla": {},
      "start_timestamp": "string",
      "status": "string",
      "tags": [],
      "template": {},
      "update_actor": {},
      "updated_timestamp": "string",
      "version": 0,
      "workflows": []
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "access_tags": [],
      "analysis_results": {},
      "assigned_to": {},
      "cid": "string",
      "consistency": {},
      "created_by": {},
      "created_timestamp": "string",
      "creation_actor": {},
      "description": "string",
      "description_format": "string",
      "description_tagged_users": [],
      "end_timestamp": "string",
      "evidence": {},
      "fields": [],
      "id": "string",
      "last_updated_by": {},
      "name": "string",
      "read_only": {},
      "reference_id": "string",
      "severity": 0,
      "severity_info": {},
      "sla": {},
      "start_timestamp": "string",
      "status": "string",
      "tags": [],
      "template": {},
      "update_actor": {},
      "updated_timestamp": "string",
      "version": 0,
      "workflows": []
    }
  ]
}

---

---

entities.case-tags.delete.v1

Removes the specified tags from the specified case.

Method DELETE

Route /cases/entities/case-tags/v1

Scope Cases: WRITE

PEP 8 delete_case_tags

Parameters

id query · string

The ID of the case to remove tags from.

tag query · string or list of strings

The tag to remove from the case.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_case_tags(id="string", tag=id_list)
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_case_tags_delete_v1(id="string", tag=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_case_tags_delete_v1",
                          id="string",
                          tag=id_list)
print(response)

PowerShell

Remove-FalconNgsCaseTag -Tag @("ID1", "ID2") -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cases"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Cases.EntitiesCaseTagsDeleteV1(
    &cases.EntitiesCaseTagsDeleteV1Params{
      ID: "string",
      Tag: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cases.entitiesCaseTagsDeleteV1(
  "string",  // id
  ["ID1", "ID2", "ID3"]  // tag
);

console.log(response);

Rust

use rusty_falcon::apis::cases_api::entities_case_tags_delete_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = entities_case_tags_delete_v1(
        &falcon.cfg,  // configuration
        "string",  // id
        vec!["string".to_string()],  // tag
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Cases.new

response = api.entities_case_tags_delete_v1('string', ['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "access_tags": [],
    "analysis_results": {},
    "assigned_to": {},
    "cid": "string",
    "consistency": {},
    "created_by": {},
    "created_timestamp": "string",
    "creation_actor": {},
    "description": "string",
    "description_format": "string",
    "description_tagged_users": [],
    "end_timestamp": "string",
    "evidence": {},
    "fields": [],
    "id": "string",
    "last_updated_by": {},
    "name": "string",
    "read_only": {},
    "reference_id": "string",
    "severity": 0,
    "severity_info": {},
    "sla": {},
    "start_timestamp": "string",
    "status": "string",
    "tags": [],
    "template": {},
    "update_actor": {},
    "updated_timestamp": "string",
    "version": 0,
    "workflows": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "access_tags": [],
      "analysis_results": {},
      "assigned_to": {},
      "cid": "string",
      "consistency": {},
      "created_by": {},
      "created_timestamp": "string",
      "creation_actor": {},
      "description": "string",
      "description_format": "string",
      "description_tagged_users": [],
      "end_timestamp": "string",
      "evidence": {},
      "fields": [],
      "id": "string",
      "last_updated_by": {},
      "name": "string",
      "read_only": {},
      "reference_id": "string",
      "severity": 0,
      "severity_info": {},
      "sla": {},
      "start_timestamp": "string",
      "status": "string",
      "tags": [],
      "template": {},
      "update_actor": {},
      "updated_timestamp": "string",
      "version": 0,
      "workflows": []
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "access_tags": [],
      "analysis_results": {},
      "assigned_to": {},
      "cid": "string",
      "consistency": {},
      "created_by": {},
      "created_timestamp": "string",
      "creation_actor": {},
      "description": "string",
      "description_format": "string",
      "description_tagged_users": [],
      "end_timestamp": "string",
      "evidence": {},
      "fields": [],
      "id": "string",
      "last_updated_by": {},
      "name": "string",
      "read_only": {},
      "reference_id": "string",
      "severity": 0,
      "severity_info": {},
      "sla": {},
      "start_timestamp": "string",
      "status": "string",
      "tags": [],
      "template": {},
      "update_actor": {},
      "updated_timestamp": "string",
      "version": 0,
      "workflows": []
    }
  ]
}

---

---

entities.case-tags.post.v1

Adds the given list of tags to the specified case.

Method POST

Route /cases/entities/case-tags/v1

Scope Cases: WRITE

PEP 8 add_case_tags

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

id body · string

The specified case ID.

tags body · array

The given list of tags.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.add_case_tags(id="string", tags=id_list)
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_case_tags_post_v1(id="string", tags=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "id": "string",
    "tags": ["string"]
}

response = falcon.command("entities_case_tags_post_v1", body=body_payload)
print(response)

PowerShell

Add-FalconNgsCaseTag -Tag @("ID1", "ID2") -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cases"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  id := "string"

  response, err := client.Cases.EntitiesCaseTagsPostV1(
    &cases.EntitiesCaseTagsPostV1Params{
      Body: &models.OperationsAddTagsToCaseRequest{
        ID: &id,
        Tags: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cases.entitiesCaseTagsPostV1(
  {
    id: "string",
    tags: []
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::cases_api::entities_case_tags_post_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::OperationsAddTagsToCaseRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = OperationsAddTagsToCaseRequest {
        id: Some("string".to_string()),
        tags: vec!["string".to_string()],
        ..Default::default()
    };

    let response = entities_case_tags_post_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Cases.new

body = Falcon::OperationsAddTagsToCaseRequest.new(
  id: 'string',
  tags: []
)

response = api.entities_case_tags_post_v1(body)

puts response

Responses

200 OK

[
  {
    "access_tags": [],
    "analysis_results": {},
    "assigned_to": {},
    "cid": "string",
    "consistency": {},
    "created_by": {},
    "created_timestamp": "string",
    "creation_actor": {},
    "description": "string",
    "description_format": "string",
    "description_tagged_users": [],
    "end_timestamp": "string",
    "evidence": {},
    "fields": [],
    "id": "string",
    "last_updated_by": {},
    "name": "string",
    "read_only": {},
    "reference_id": "string",
    "severity": 0,
    "severity_info": {},
    "sla": {},
    "start_timestamp": "string",
    "status": "string",
    "tags": [],
    "template": {},
    "update_actor": {},
    "updated_timestamp": "string",
    "version": 0,
    "workflows": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "access_tags": [],
      "analysis_results": {},
      "assigned_to": {},
      "cid": "string",
      "consistency": {},
      "created_by": {},
      "created_timestamp": "string",
      "creation_actor": {},
      "description": "string",
      "description_format": "string",
      "description_tagged_users": [],
      "end_timestamp": "string",
      "evidence": {},
      "fields": [],
      "id": "string",
      "last_updated_by": {},
      "name": "string",
      "read_only": {},
      "reference_id": "string",
      "severity": 0,
      "severity_info": {},
      "sla": {},
      "start_timestamp": "string",
      "status": "string",
      "tags": [],
      "template": {},
      "update_actor": {},
      "updated_timestamp": "string",
      "version": 0,
      "workflows": []
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "access_tags": [],
      "analysis_results": {},
      "assigned_to": {},
      "cid": "string",
      "consistency": {},
      "created_by": {},
      "created_timestamp": "string",
      "creation_actor": {},
      "description": "string",
      "description_format": "string",
      "description_tagged_users": [],
      "end_timestamp": "string",
      "evidence": {},
      "fields": [],
      "id": "string",
      "last_updated_by": {},
      "name": "string",
      "read_only": {},
      "reference_id": "string",
      "severity": 0,
      "severity_info": {},
      "sla": {},
      "start_timestamp": "string",
      "status": "string",
      "tags": [],
      "template": {},
      "update_actor": {},
      "updated_timestamp": "string",
      "version": 0,
      "workflows": []
    }
  ]
}

---

---

entities.cases.patch.v2

Updates given fields on the specified case.

Method PATCH

Route /cases/entities/cases/v2

Scope Cases: WRITE

PEP 8 update_case_fields

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

expected_consistency_version body · integer

The consistency version.

expected_version body · integer

The version.

fields body · object

The updated given fields for the specified case.

id body · string

The specified case ID.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

fields = {
    "assigned_to_user_uuid": "string",
    "custom_fields": [
        {
            "id": "string",
            "values": [
                "string"
            ]
        }
    ],
    "description": "string",
    "name": "string",
    "remove_user_assignment": True,
    "severity": 0,
    "slas_active": True,
    "status": "string",
    "template": {
        "id": "string"
    }
}

response = falcon.update_case_fields(expected_consistency_version=integer,
                                     expected_version=integer,
                                     fields=fields,
                                     id="string")
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

fields = {
    "assigned_to_user_uuid": "string",
    "custom_fields": [
        {
            "id": "string",
            "values": [
                "string"
            ]
        }
    ],
    "description": "string",
    "name": "string",
    "remove_user_assignment": True,
    "severity": 0,
    "slas_active": True,
    "status": "string",
    "template": {
        "id": "string"
    }
}

response = falcon.entities_cases_patch_v2(expected_consistency_version=integer,
                                          expected_version=integer,
                                          fields=fields,
                                          id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "expected_consistency_version": integer,
    "expected_version": integer,
    "fields": {
        "access_tags": [
            {
                "cid": "string",
                "id": "string",
                "key": "string"
            }
        ],
        "assigned_to_user_uuid": "string",
        "custom_fields": [
            {
                "id": "string",
                "values": ["string"]
            }
        ],
        "description": "string",
        "description_format": "string",
        "description_tagged_users": ["string"],
        "name": "string",
        "remove_user_assignment": boolean,
        "severity": integer,
        "severity_info": {
            "level": "string"
        },
        "slas_active": boolean,
        "status": "string",
        "template": {
            "id": "string"
        },
        "workflows": [
            {
                "execution_id": "string",
                "id": "string",
                "name": "string",
                "status": "string"
            }
        ]
    },
    "id": "string"
}

response = falcon.command("entities_cases_patch_v2", body=body_payload)
print(response)

PowerShell

Edit-FalconNgsCase -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cases"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  expected_consistency_version := integer
  expected_version := integer
  id := "string"

  response, err := client.Cases.EntitiesCasesPatchV2(
    &cases.EntitiesCasesPatchV2Params{
      Body: &models.OperationsUpdateCaseRequest{
        ExpectedConsistencyVersion: &expected_consistency_version,
        ExpectedVersion: &expected_version,
        Fields: &struct{}{},
        ID: &id,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cases.entitiesCasesPatchV2(
  {
    expectedConsistencyVersion: integer,
    expectedVersion: integer,
    fields: {
      accessTags: [{
          cid: "string",
          id: "string",
          key: "string"
        }],
      assignedToUserUuid: "string",
      customFields: [{
          id: "string",
          values: []
        }],
      description: "string",
      descriptionFormat: "string",
      descriptionTaggedUsers: [],
      name: "string",
      removeUserAssignment: boolean,
      severity: integer,
      severityInfo: {
        level: "string"
      },
      slasActive: boolean,
      status: "string",
      template: {
        id: "string"
      },
      workflows: [{
          executionId: "string",
          id: "string",
          name: "string",
          status: "string"
        }]
    },
    id: "string"
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::cases_api::entities_cases_patch_v2;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::OperationsUpdateCaseRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = OperationsUpdateCaseRequest {
        fields: Default::default(),
        id: Some("string".to_string()),
        ..Default::default()
    };

    let response = entities_cases_patch_v2(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Cases.new

body = Falcon::OperationsUpdateCaseRequest.new(
  expected_consistency_version: integer,
  expected_version: integer,
  fields: {
    access_tags: [{
        cid: 'string',
        id: 'string',
        key: 'string'
      }],
    assigned_to_user_uuid: 'string',
    custom_fields: [{
        id: 'string',
        values: []
      }],
    description: 'string',
    description_format: 'string',
    description_tagged_users: [],
    name: 'string',
    remove_user_assignment: boolean,
    severity: integer,
    severity_info: {
      level: 'string'
    },
    slas_active: boolean,
    status: 'string',
    template: {
      id: 'string'
    },
    workflows: [{
        execution_id: 'string',
        id: 'string',
        name: 'string',
        status: 'string'
      }]
  },
  id: 'string'
)

response = api.entities_cases_patch_v2(body)

puts response

Responses

200 OK

[
  {
    "access_tags": [],
    "analysis_results": {},
    "assigned_to": {},
    "cid": "string",
    "consistency": {},
    "created_by": {},
    "created_timestamp": "string",
    "creation_actor": {},
    "description": "string",
    "description_format": "string",
    "description_tagged_users": [],
    "end_timestamp": "string",
    "evidence": {},
    "fields": [],
    "id": "string",
    "last_updated_by": {},
    "name": "string",
    "read_only": {},
    "reference_id": "string",
    "severity": 0,
    "severity_info": {},
    "sla": {},
    "start_timestamp": "string",
    "status": "string",
    "tags": [],
    "template": {},
    "update_actor": {},
    "updated_timestamp": "string",
    "version": 0,
    "workflows": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "access_tags": [],
      "analysis_results": {},
      "assigned_to": {},
      "cid": "string",
      "consistency": {},
      "created_by": {},
      "created_timestamp": "string",
      "creation_actor": {},
      "description": "string",
      "description_format": "string",
      "description_tagged_users": [],
      "end_timestamp": "string",
      "evidence": {},
      "fields": [],
      "id": "string",
      "last_updated_by": {},
      "name": "string",
      "read_only": {},
      "reference_id": "string",
      "severity": 0,
      "severity_info": {},
      "sla": {},
      "start_timestamp": "string",
      "status": "string",
      "tags": [],
      "template": {},
      "update_actor": {},
      "updated_timestamp": "string",
      "version": 0,
      "workflows": []
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "access_tags": [],
      "analysis_results": {},
      "assigned_to": {},
      "cid": "string",
      "consistency": {},
      "created_by": {},
      "created_timestamp": "string",
      "creation_actor": {},
      "description": "string",
      "description_format": "string",
      "description_tagged_users": [],
      "end_timestamp": "string",
      "evidence": {},
      "fields": [],
      "id": "string",
      "last_updated_by": {},
      "name": "string",
      "read_only": {},
      "reference_id": "string",
      "severity": 0,
      "severity_info": {},
      "sla": {},
      "start_timestamp": "string",
      "status": "string",
      "tags": [],
      "template": {},
      "update_actor": {},
      "updated_timestamp": "string",
      "version": 0,
      "workflows": []
    }
  ]
}

---

---

entities.cases.post.v2

Retrieves all Cases given their IDs.

Method POST

Route /cases/entities/cases/v2

Scope Cases: READ

PEP 8 get_cases

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

ids body · array

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_cases(ids=["string"])
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.entities_cases_post_v2(ids=["string"])
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "ids": ["string"]
}

response = falcon.command("entities_cases_post_v2", body=body_payload)
print(response)

PowerShell

Get-FalconNgsCase -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cases"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Cases.EntitiesCasesPostV2(
    &cases.EntitiesCasesPostV2Params{
      Body: &models.OperationsGetCasesByIDsRequest{
        Ids: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cases.entitiesCasesPostV2(
  {
    ids: []
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::cases_api::entities_cases_post_v2;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::OperationsGetCasesByIdsRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = OperationsGetCasesByIdsRequest {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = entities_cases_post_v2(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Cases.new

body = Falcon::OperationsGetCasesByIDsRequest.new(
  ids: []
)

response = api.entities_cases_post_v2(body)

puts response

Responses

200 OK

[
  {
    "access_tags": [],
    "analysis_results": {},
    "assigned_to": {},
    "cid": "string",
    "consistency": {},
    "created_by": {},
    "created_timestamp": "string",
    "creation_actor": {},
    "description": "string",
    "description_format": "string",
    "description_tagged_users": [],
    "end_timestamp": "string",
    "evidence": {},
    "fields": [],
    "id": "string",
    "last_updated_by": {},
    "name": "string",
    "read_only": {},
    "reference_id": "string",
    "severity": 0,
    "severity_info": {},
    "sla": {},
    "start_timestamp": "string",
    "status": "string",
    "tags": [],
    "template": {},
    "update_actor": {},
    "updated_timestamp": "string",
    "version": 0,
    "workflows": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "access_tags": [],
      "analysis_results": {},
      "assigned_to": {},
      "cid": "string",
      "consistency": {},
      "created_by": {},
      "created_timestamp": "string",
      "creation_actor": {},
      "description": "string",
      "description_format": "string",
      "description_tagged_users": [],
      "end_timestamp": "string",
      "evidence": {},
      "fields": [],
      "id": "string",
      "last_updated_by": {},
      "name": "string",
      "read_only": {},
      "reference_id": "string",
      "severity": 0,
      "severity_info": {},
      "sla": {},
      "start_timestamp": "string",
      "status": "string",
      "tags": [],
      "template": {},
      "update_actor": {},
      "updated_timestamp": "string",
      "version": 0,
      "workflows": []
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "access_tags": [],
      "analysis_results": {},
      "assigned_to": {},
      "cid": "string",
      "consistency": {},
      "created_by": {},
      "created_timestamp": "string",
      "creation_actor": {},
      "description": "string",
      "description_format": "string",
      "description_tagged_users": [],
      "end_timestamp": "string",
      "evidence": {},
      "fields": [],
      "id": "string",
      "last_updated_by": {},
      "name": "string",
      "read_only": {},
      "reference_id": "string",
      "severity": 0,
      "severity_info": {},
      "sla": {},
      "start_timestamp": "string",
      "status": "string",
      "tags": [],
      "template": {},
      "update_actor": {},
      "updated_timestamp": "string",
      "version": 0,
      "workflows": []
    }
  ]
}

---

---

entities.cases.put.v2

Creates the given Case

Method PUT

Route /cases/entities/cases/v2

Scope Cases: WRITE

PEP 8 create_case

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

access_tags body · array

assigned_to_user_uuid body · string

UUID of the user to assign the case to.

description body · string

The description of the case.

description_format body · string

description_tagged_users body · array

evidence body · object

The case evidence info.

name body · string

The name of the case.

severity body · integer

The severity level of the case.

severity_info body · object

status body · string

The current status of the case.

tags body · array

The tags to be attached to the case.

template body · object

The template case to utilize.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

evidence = {
    "alerts": [
        {
            "id": "string"
        }
    ],
    "events": [
        {
            "id": "string"
        }
    ],
    "leads": [
        {
            "id": "string"
        }
    ]
}

template = {
    "id": "string"
}

response = falcon.create_case(assigned_to_user_uuid="string",
                              description="string",
                              evidence=evidence,
                              name="string",
                              severity=integer,
                              status="string",
                              tags=id_list,
                              template=template)
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

evidence = {
    "alerts": [
        {
            "id": "string"
        }
    ],
    "events": [
        {
            "id": "string"
        }
    ],
    "leads": [
        {
            "id": "string"
        }
    ]
}

template = {
    "id": "string"
}

response = falcon.entities_cases_put_v2(assigned_to_user_uuid="string",
                                        description="string",
                                        evidence=evidence,
                                        name="string",
                                        severity=integer,
                                        status="string",
                                        tags=id_list,
                                        template=template)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "access_tags": [
        {
            "cid": "string",
            "id": "string",
            "key": "string"
        }
    ],
    "assigned_to_user_uuid": "string",
    "description": "string",
    "description_format": "string",
    "description_tagged_users": ["string"],
    "evidence": {
        "alerts": [
            {
                "id": "string"
            }
        ],
        "events": [
            {
                "id": "string"
            }
        ],
        "leads": [
            {
                "id": "string"
            }
        ]
    },
    "name": "string",
    "severity": integer,
    "severity_info": {
        "level": "string"
    },
    "status": "string",
    "tags": ["string"],
    "template": {
        "id": "string"
    }
}

response = falcon.command("entities_cases_put_v2", body=body_payload)
print(response)

PowerShell

New-FalconNgsCase -Name "string" -Severity "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cases"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cid := "string"
  id := "string"
  key := "string"
  assigned_to_user_uuid := "string"
  description := "string"
  description_format := "string"
  name := "string"
  severity := integer
  status := "string"

  response, err := client.Cases.EntitiesCasesPutV2(
    &cases.EntitiesCasesPutV2Params{
      Body: &models.OperationsCreateCaseRequest{
        AccessTags: []interface{}{
          {
          CID: &cid,
          ID: &id,
          Key: &key,
          },
        },
        AssignedToUserUuid: &assigned_to_user_uuid,
        Description: &description,
        DescriptionFormat: &description_format,
        DescriptionTaggedUsers: []string{"string"},
        Evidence: &struct{}{},
        Name: &name,
        Severity: &severity,
        SeverityInfo: &struct{}{},
        Status: &status,
        Tags: []string{"string"},
        Template: &struct{}{},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cases.entitiesCasesPutV2(
  {
    accessTags: [{
        cid: "string",
        id: "string",
        key: "string"
      }],
    assignedToUserUuid: "string",
    description: "string",
    descriptionFormat: "string",
    descriptionTaggedUsers: [],
    evidence: {
      alerts: [{
          id: "string"
        }],
      events: [{
          id: "string"
        }],
      leads: [{
          id: "string"
        }]
    },
    name: "string",
    severity: integer,
    severityInfo: {
      level: "string"
    },
    status: "string",
    tags: [],
    template: {
      id: "string"
    }
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::cases_api::entities_cases_put_v2;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::OperationsCreateCaseRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = OperationsCreateCaseRequest {
        assigned_to_user_uuid: Some("string".to_string()),
        description: Some("string".to_string()),
        evidence: Default::default(),
        name: Some("string".to_string()),
        severity: Some(integer),
        severity_info: Default::default(),
        status: Some("string".to_string()),
        ..Default::default()
    };

    let response = entities_cases_put_v2(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Cases.new

body = Falcon::OperationsCreateCaseRequest.new(
  access_tags: [{
      cid: 'string',
      id: 'string',
      key: 'string'
    }],
  assigned_to_user_uuid: 'string',
  description: 'string',
  description_format: 'string',
  description_tagged_users: [],
  evidence: {
    alerts: [{
        id: 'string'
      }],
    events: [{
        id: 'string'
      }],
    leads: [{
        id: 'string'
      }]
  },
  name: 'string',
  severity: integer,
  severity_info: {
    level: 'string'
  },
  status: 'string',
  tags: [],
  template: {
    id: 'string'
  }
)

response = api.entities_cases_put_v2(body)

puts response

Responses

201 Created

[
  {
    "access_tags": [],
    "analysis_results": {},
    "assigned_to": {},
    "cid": "string",
    "consistency": {},
    "created_by": {},
    "created_timestamp": "string",
    "creation_actor": {},
    "description": "string",
    "description_format": "string",
    "description_tagged_users": [],
    "end_timestamp": "string",
    "evidence": {},
    "fields": [],
    "id": "string",
    "last_updated_by": {},
    "name": "string",
    "read_only": {},
    "reference_id": "string",
    "severity": 0,
    "severity_info": {},
    "sla": {},
    "start_timestamp": "string",
    "status": "string",
    "tags": [],
    "template": {},
    "update_actor": {},
    "updated_timestamp": "string",
    "version": 0,
    "workflows": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "access_tags": [],
      "analysis_results": {},
      "assigned_to": {},
      "cid": "string",
      "consistency": {},
      "created_by": {},
      "created_timestamp": "string",
      "creation_actor": {},
      "description": "string",
      "description_format": "string",
      "description_tagged_users": [],
      "end_timestamp": "string",
      "evidence": {},
      "fields": [],
      "id": "string",
      "last_updated_by": {},
      "name": "string",
      "read_only": {},
      "reference_id": "string",
      "severity": 0,
      "severity_info": {},
      "sla": {},
      "start_timestamp": "string",
      "status": "string",
      "tags": [],
      "template": {},
      "update_actor": {},
      "updated_timestamp": "string",
      "version": 0,
      "workflows": []
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "access_tags": [],
      "analysis_results": {},
      "assigned_to": {},
      "cid": "string",
      "consistency": {},
      "created_by": {},
      "created_timestamp": "string",
      "creation_actor": {},
      "description": "string",
      "description_format": "string",
      "description_tagged_users": [],
      "end_timestamp": "string",
      "evidence": {},
      "fields": [],
      "id": "string",
      "last_updated_by": {},
      "name": "string",
      "read_only": {},
      "reference_id": "string",
      "severity": 0,
      "severity_info": {},
      "sla": {},
      "start_timestamp": "string",
      "status": "string",
      "tags": [],
      "template": {},
      "update_actor": {},
      "updated_timestamp": "string",
      "version": 0,
      "workflows": []
    }
  ]
}

---

---

entities.event-evidence.post.v1

Adds the given list of event evidence to the specified case.

Method POST

Route /cases/entities/event-evidence/v1

Scope Cases: WRITE

PEP 8 add_case_event_evidence

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

events body · array

The event evidence field.

id body · string

The specified case ID.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

events = [
    {
        "id": "string"
    }
]

response = falcon.add_case_event_evidence(events=events, id="string")
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

events = [
    {
        "id": "string"
    }
]

response = falcon.entities_event_evidence_post_v1(events=events, id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "events": [
        {
            "id": "string"
        }
    ],
    "id": "string"
}

response = falcon.command("entities_event_evidence_post_v1", body=body_payload)
print(response)

PowerShell

Add-FalconNgsCaseEvidence -EventId @("ID1", "ID2") -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cases"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  id := "string"

  response, err := client.Cases.EntitiesEventEvidencePostV1(
    &cases.EntitiesEventEvidencePostV1Params{
      Body: &models.OperationsAddEventsToCaseRequest{
        Events: []interface{}{
          {
          ID: &id,
          },
        },
        ID: &id,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cases.entitiesEventEvidencePostV1(
  {
    events: [{
        id: "string"
      }],
    id: "string"
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::cases_api::entities_event_evidence_post_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::OperationsAddEventsToCaseRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = OperationsAddEventsToCaseRequest {
        events: vec![EventEvidenceSelector {
            id: Some("string".to_string()),
            ..Default::default()
        }],
        id: Some("string".to_string()),
        ..Default::default()
    };

    let response = entities_event_evidence_post_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Cases.new

body = Falcon::OperationsAddEventsToCaseRequest.new(
  events: [{
      id: 'string'
    }],
  id: 'string'
)

response = api.entities_event_evidence_post_v1(body)

puts response

Responses

200 OK

[
  {
    "access_tags": [],
    "analysis_results": {},
    "assigned_to": {},
    "cid": "string",
    "consistency": {},
    "created_by": {},
    "created_timestamp": "string",
    "creation_actor": {},
    "description": "string",
    "description_format": "string",
    "description_tagged_users": [],
    "end_timestamp": "string",
    "evidence": {},
    "fields": [],
    "id": "string",
    "last_updated_by": {},
    "name": "string",
    "read_only": {},
    "reference_id": "string",
    "severity": 0,
    "severity_info": {},
    "sla": {},
    "start_timestamp": "string",
    "status": "string",
    "tags": [],
    "template": {},
    "update_actor": {},
    "updated_timestamp": "string",
    "version": 0,
    "workflows": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "access_tags": [],
      "analysis_results": {},
      "assigned_to": {},
      "cid": "string",
      "consistency": {},
      "created_by": {},
      "created_timestamp": "string",
      "creation_actor": {},
      "description": "string",
      "description_format": "string",
      "description_tagged_users": [],
      "end_timestamp": "string",
      "evidence": {},
      "fields": [],
      "id": "string",
      "last_updated_by": {},
      "name": "string",
      "read_only": {},
      "reference_id": "string",
      "severity": 0,
      "severity_info": {},
      "sla": {},
      "start_timestamp": "string",
      "status": "string",
      "tags": [],
      "template": {},
      "update_actor": {},
      "updated_timestamp": "string",
      "version": 0,
      "workflows": []
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "access_tags": [],
      "analysis_results": {},
      "assigned_to": {},
      "cid": "string",
      "consistency": {},
      "created_by": {},
      "created_timestamp": "string",
      "creation_actor": {},
      "description": "string",
      "description_format": "string",
      "description_tagged_users": [],
      "end_timestamp": "string",
      "evidence": {},
      "fields": [],
      "id": "string",
      "last_updated_by": {},
      "name": "string",
      "read_only": {},
      "reference_id": "string",
      "severity": 0,
      "severity_info": {},
      "sla": {},
      "start_timestamp": "string",
      "status": "string",
      "tags": [],
      "template": {},
      "update_actor": {},
      "updated_timestamp": "string",
      "version": 0,
      "workflows": []
    }
  ]
}

---

---

entities.fields.get.v1

Get fields by ID

Method GET

Route /casemgmt/entities/fields/v1

Scope Case Templates: READ

PEP 8 get_fields

Parameters

ids query · string or list of strings

Resource IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_fields(ids=id_list)
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_fields_get_v1(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_fields_get_v1",
                          ids=id_list)
print(response)

PowerShell

Get-FalconNgsCaseField -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CaseManagement.EntitiesFieldsGetV1(
    &case_management.EntitiesFieldsGetV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.entitiesFieldsGetV1("string");  // ids

console.log(response);

Rust

use rusty_falcon::apis::case_management_api::entities_fields_get_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = entities_fields_get_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

response = api.entities_fields_get_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "created_by": {},
    "created_by_name": "string",
    "created_timestamp": "string",
    "data_type": "string",
    "default_value": "string",
    "display_order": 0,
    "id": "string",
    "input_type": "string",
    "multivalued": false,
    "name": "string",
    "options": [],
    "required": false,
    "updated_by": {},
    "updated_by_name": "string",
    "updated_timestamp": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.file-details.get.v1

Get file details by id

Method GET

Route /case-files/entities/file-details/v1

Scope Cases: READ

PEP 8 get_file_details

Parameters

ids query · string or list of strings

Resource IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_file_details(ids=id_list)
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_file_details_get_v1(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_file_details_get_v1",
                          ids=id_list)
print(response)

PowerShell

Get-FalconNgsCaseFile -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_files"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CaseFiles.EntitiesFileDetailsGetV1(
    &case_files.EntitiesFileDetailsGetV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseFiles.entitiesFileDetailsGetV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::case_files_api::entities_file_details_get_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = entities_file_details_get_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseFiles.new

response = api.entities_file_details_get_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "case_id": "string",
    "cid": "string",
    "description": "string",
    "file_size": "string",
    "file_size_bytes": 0,
    "file_type": "string",
    "hash_value": "string",
    "id": "string",
    "name": "string",
    "source": "string",
    "uploaded_by": "string",
    "uploaded_on": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.file-details.patch.v1

Update file details

Method PATCH

Route /case-files/entities/file-details/v1

Scope Cases: WRITE

PEP 8 update_file_details

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

description body · string

File details update desecription.

id body · string

File details ID.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.update_file_details(description="string", id="string")
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.entities_file_details_patch_v1(description="string",
                                                 id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "id": "string"
}

response = falcon.command("entities_file_details_patch_v1", body=body_payload)
print(response)

PowerShell

Edit-FalconNgsCaseFile -Description "string" -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_files"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  id := "string"

  response, err := client.CaseFiles.EntitiesFileDetailsPatchV1(
    &case_files.EntitiesFileDetailsPatchV1Params{
      Body: &models.CasefilesapiUpdateRequestV1{
        Description: &description,
        ID: &id,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseFiles.entitiesFileDetailsPatchV1(
  {
    description: "string",
    id: "string"
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::case_files_api::entities_file_details_patch_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApiUpdateRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ApiUpdateRequestV1 {
        description: Some("string".to_string()),
        id: Some("string".to_string()),
        ..Default::default()
    };

    let response = entities_file_details_patch_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseFiles.new

body = Falcon::CasefilesapiUpdateRequestV1.new(
  description: 'string',
  id: 'string'
)

response = api.entities_file_details_patch_v1(body)

puts response

Responses

200 OK

[
  {
    "case_id": "string",
    "cid": "string",
    "description": "string",
    "file_size": "string",
    "file_size_bytes": 0,
    "file_type": "string",
    "hash_value": "string",
    "id": "string",
    "name": "string",
    "source": "string",
    "uploaded_by": "string",
    "uploaded_on": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.files.delete.v1

Delete file details by id

Method DELETE

Route /case-files/entities/files/v1

Scope Cases: WRITE

PEP 8 delete_file_details

Parameters

ids query · string or list of strings

Resource IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_file_details(ids=id_list)
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_files_delete_v1(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_files_delete_v1",
                          ids=id_list)
print(response)

PowerShell

Remove-FalconNgsCaseFile -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_files"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CaseFiles.EntitiesFilesDeleteV1(
    &case_files.EntitiesFilesDeleteV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseFiles.entitiesFilesDeleteV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::case_files_api::entities_files_delete_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = entities_files_delete_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseFiles.new

response = api.entities_files_delete_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.files_bulk-download.post.v1

Download multiple existing file from case as a ZIP

Method POST

Route /case-files/entities/files/bulk-download/v1

Scope Cases: READ

PEP 8 bulk_download_files

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

ids body · array

List of files to download.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.bulk_download_files(ids=id_list)
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_files_bulk_download_post_v1(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "ids": ["string"]
}

response = falcon.command("entities_files_bulk_download_post_v1", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_files"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CaseFiles.EntitiesFilesBulkDownloadPostV1(
    &case_files.EntitiesFilesBulkDownloadPostV1Params{
      Body: &models.CasefilesapiBulkDownloadRequestV1{
        Ids: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseFiles.entitiesFilesBulkDownloadPostV1(
  {
    ids: []
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::case_files_api::entities_files_bulk_download_post_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApiBulkDownloadRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ApiBulkDownloadRequestV1 {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = entities_files_bulk_download_post_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseFiles.new

body = Falcon::CasefilesapiBulkDownloadRequestV1.new(
  ids: []
)

response = api.entities_files_bulk_download_post_v1(body)

puts response

Responses

200 OK

[
  {
    "link": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.files_download.get.v1

Download existing file from case

Method GET

Route /case-files/entities/files/download/v1

Scope Cases: READ

PEP 8 download_existing_files

Parameters

id query · string

Resource ID

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.download_existing_files(id="string")
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.entities_files_download_get_v1(id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("entities_files_download_get_v1",
                          id="string")
print(response)

PowerShell

Receive-FalconNgsCaseFile -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_files"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CaseFiles.EntitiesFilesDownloadGetV1(
    &case_files.EntitiesFilesDownloadGetV1Params{
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseFiles.entitiesFilesDownloadGetV1("string");  // id

console.log(response);

Rust

use rusty_falcon::apis::case_files_api::entities_files_download_get_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = entities_files_download_get_v1(
        &falcon.cfg,  // configuration
        "string",  // id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseFiles.new

response = api.entities_files_download_get_v1('string')

puts response

Responses

200 OK

[
  {
    "link": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.files_download.post.v1

Download existing files from case

Deprecated

This operation is deprecated.

Method POST

Route /case-files/entities/files/download/v1

Scope Cases: READ

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

ids body · array

Code Examples

Python

Examples coming soon.

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_files"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CaseFiles.EntitiesFilesDownloadPostV1(
    &case_files.EntitiesFilesDownloadPostV1Params{
      Body: &models.CasefilesapiDownloadRequestV1{
        Ids: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseFiles.entitiesFilesDownloadPostV1(
  {
    ids: []
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::case_files_api::entities_files_download_post_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApiDownloadRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ApiDownloadRequestV1 {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = entities_files_download_post_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseFiles.new

body = Falcon::CasefilesapiDownloadRequestV1.new(
  ids: []
)

response = api.entities_files_download_post_v1(body)

puts response

Responses

200 OK

[
  {
    "link": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.files_upload.post.v1

Upload file for case

Method POST

Route /case-files/entities/files/upload/v1

Scope Cases: WRITE

PEP 8 upload_file

Parameters

file body · file

Local file to Upload

description body · string

Description of the file

case_id body · string

Case ID for the file

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.upload_file(file="string",
                              description="string",
                              case_id="string")
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.entities_files_upload_post_v1(file="string",
                                                description="string",
                                                case_id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("entities_files_upload_post_v1",
                          file_data=open("filename", "rb").read(),
                          description="string",
                          case_id="string")
print(response)

PowerShell

Send-FalconNgsCaseFile

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_files"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"

  response, err := client.CaseFiles.EntitiesFilesUploadPostV1(
    &case_files.EntitiesFilesUploadPostV1Params{
      Description: &description,
      CaseID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseFiles.entitiesFilesUploadPostV1(
  "string",  // file
  "string",  // caseId
  "string"  // description
);

console.log(response);

Rust

use rusty_falcon::apis::case_files_api::entities_files_upload_post_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = entities_files_upload_post_v1(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseFiles.new

response = api.entities_files_upload_post_v1('string', 'string')

puts response

Responses

200 OK

[
  {
    "case_id": "string",
    "cid": "string",
    "description": "string",
    "file_size": "string",
    "file_size_bytes": 0,
    "file_type": "string",
    "hash_value": "string",
    "id": "string",
    "name": "string",
    "source": "string",
    "uploaded_by": "string",
    "uploaded_on": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.get-rtr-file-metadata.post.v1

gets metadata for a file via RTR without retrieving it

Method POST

Route /case-files/entities/get-rtr-file-metadata/v1

Scope Cases: WRITE

PEP 8 get_rtr_file_metadata

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

aid body · string

The agent ID of the host to retrieve file metadata from.

file_path body · string

The path to the file on the host.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_rtr_file_metadata(aid="string", file_path="string")
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.entities_get_rtr_file_metadata_post_v1(aid="string",
                                                         file_path="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "aid": "string",
    "file_path": "string"
}

response = falcon.command("entities_get_rtr_file_metadata_post_v1", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_files"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  aid := "string"
  file_path := "string"

  response, err := client.CaseFiles.EntitiesGetRtrFileMetadataPostV1(
    &case_files.EntitiesGetRtrFileMetadataPostV1Params{
      Body: &models.CasefilesapiGetRTRFileMetaDataRequestV1{
        Aid: &aid,
        FilePath: &file_path,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseFiles.entitiesGetRtrFileMetadataPostV1(
  {
    aid: "string",
    filePath: "string"
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseFiles.new

body = Falcon::CasefilesapiGetRTRFileMetaDataRequestV1.new(
  aid: 'string',
  file_path: 'string'
)

response = api.entities_get_rtr_file_metadata_post_v1(body)

puts response

Responses

200 OK

[
  {
    "file_name": "string",
    "file_size": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.merge.post.v1

Merges a source case into a destination case.

Method POST

Route /cases/entities/merge/v1

Scope Cases: WRITE

PEP 8 entities_merge_post_v1

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

destination_id body · string

The destination_id value.

source_id body · string

The source_id value.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.entities_merge_post_v1(destination_id="string",
                                         source_id="string")
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.entities_merge_post_v1(destination_id="string",
                                         source_id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "destination_id": "string",
    "source_id": "string"
}

response = falcon.command("entities_merge_post_v1", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cases"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  destination_id := "string"
  source_id := "string"

  response, err := client.Cases.EntitiesMergePostV1(
    &cases.EntitiesMergePostV1Params{
      Body: &models.OperationsMergeCasesRequest{
        DestinationID: &destination_id,
        SourceID: &source_id,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cases.entitiesMergePostV1(
  {
    destinationId: "string",
    sourceId: "string"
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Cases.new

body = Falcon::OperationsMergeCasesRequest.new(
  destination_id: 'string',
  source_id: 'string'
)

response = api.entities_merge_post_v1(body)

puts response

Responses

200 OK

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.notification-groups.delete.v1

Delete notification groups by ID

Deprecated

This operation is deprecated.

Method DELETE

Route /casemgmt/entities/notification-groups/v1

Scope Case Templates: WRITE

PEP 8 delete_notification_group

Parameters

ids query · string or list of strings

Resource IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_notification_group(ids=id_list)
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_notification_groups_delete_v1(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_notification_groups_delete_v1",
                          ids=id_list)
print(response)

PowerShell

Remove-FalconNgsCaseNotificationGroup -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CaseManagement.EntitiesNotificationGroupsDeleteV1(
    &case_management.EntitiesNotificationGroupsDeleteV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.entitiesNotificationGroupsDeleteV1("string");  // ids

console.log(response);

Rust

use rusty_falcon::apis::case_management_api::entities_notification_groups_delete_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = entities_notification_groups_delete_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

response = api.entities_notification_groups_delete_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.notification-groups.delete.v2

Delete notification groups by ID

Method DELETE

Route /casemgmt/entities/notification-groups/v2

Scope Case Templates: WRITE

PEP 8 delete_notification_group_v2

Parameters

ids query · string or list of strings

Resource IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_notification_group_v2(ids=id_list)
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_notification_groups_delete_v2(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_notification_groups_delete_v2",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CaseManagement.EntitiesNotificationGroupsDeleteV2(
    &case_management.EntitiesNotificationGroupsDeleteV2Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.entitiesNotificationGroupsDeleteV2("string");  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

response = api.entities_notification_groups_delete_v2(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.notification-groups.get.v1

Get notification groups by ID

Deprecated

This operation is deprecated.

Method GET

Route /casemgmt/entities/notification-groups/v1

Scope Case Templates: READ

PEP 8 get_notification_groups

Parameters

ids query · string or list of strings

Resource IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_notification_groups(ids=id_list)
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_notification_groups_get_v1(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_notification_groups_get_v1",
                          ids=id_list)
print(response)

PowerShell

Get-FalconNgsCaseNotificationGroup -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CaseManagement.EntitiesNotificationGroupsGetV1(
    &case_management.EntitiesNotificationGroupsGetV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.entitiesNotificationGroupsGetV1("string");  // ids

console.log(response);

Rust

use rusty_falcon::apis::case_management_api::entities_notification_groups_get_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = entities_notification_groups_get_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

response = api.entities_notification_groups_get_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "channels": [],
    "cid": "string",
    "created_by": {},
    "created_by_name": "string",
    "created_timestamp": "string",
    "description": "string",
    "id": "string",
    "name": "string",
    "updated_by": {},
    "updated_by_name": "string",
    "updated_timestamp": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.notification-groups.get.v2

Get notification groups by ID

Method GET

Route /casemgmt/entities/notification-groups/v2

Scope Case Templates: READ

PEP 8 get_notification_groups_v2

Parameters

ids query · string or list of strings

Resource IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_notification_groups_v2(ids=id_list)
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_notification_groups_get_v2(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_notification_groups_get_v2",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CaseManagement.EntitiesNotificationGroupsGetV2(
    &case_management.EntitiesNotificationGroupsGetV2Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.entitiesNotificationGroupsGetV2("string");  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

response = api.entities_notification_groups_get_v2(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "channels": [],
    "cid": "string",
    "created_by": {},
    "created_by_name": "string",
    "created_timestamp": "string",
    "description": "string",
    "id": "string",
    "name": "string",
    "updated_by": {},
    "updated_by_name": "string",
    "updated_timestamp": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.notification-groups.patch.v1

Update notification group

Deprecated

This operation is deprecated.

Method PATCH

Route /casemgmt/entities/notification-groups/v1

Scope Case Templates: WRITE

PEP 8 update_notification_group

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

channels body · array

The notification group channel configuration parameters.

description body · string

Notification group description.

id body · string

The ID of the notification group.

name body · string

Notification group name.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

channels = [
    {
        "config_id": "string",
        "config_name": "string",
        "recipients": [
            "string"
        ],
        "severity": "string",
        "type": "email"
    }
]

response = falcon.update_notification_group(channels=channels,
                                            description="string",
                                            id="string",
                                            name="string")
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

channels = [
    {
        "config_id": "string",
        "config_name": "string",
        "recipients": [
            "string"
        ],
        "severity": "string",
        "type": "email"
    }
]

response = falcon.entities_notification_groups_patch_v1(channels=channels,
                                                        description="string",
                                                        id="string",
                                                        name="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "channels": [
        {
            "config_id": "string",
            "config_name": "string",
            "recipients": ["string"],
            "severity": "string",
            "type": "string"
        }
    ],
    "description": "string",
    "id": "string",
    "name": "string"
}

response = falcon.command("entities_notification_groups_patch_v1", body=body_payload)
print(response)

PowerShell

Edit-FalconNgsCaseNotificationGroup -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  config_id := "string"
  config_name := "string"
  severity := "string"
  typeVar := "string"
  description := "string"
  id := "string"
  name := "string"

  response, err := client.CaseManagement.EntitiesNotificationGroupsPatchV1(
    &case_management.EntitiesNotificationGroupsPatchV1Params{
      Body: &models.APINotificationGroupV1UpdateRequest{
        Channels: []interface{}{
          {
          ConfigID: &config_id,
          ConfigName: &config_name,
          Recipients: []string{"string"},
          Severity: &severity,
          Type: &typeVar,
          },
        },
        Description: &description,
        ID: &id,
        Name: &name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.entitiesNotificationGroupsPatchV1(
  {
    channels: [{
        configId: "string",
        configName: "string",
        recipients: [],
        severity: "string",
        type: "string"
      }],
    description: "string",
    id: "string",
    name: "string"
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::case_management_api::entities_notification_groups_patch_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApiNotificationGroupV1UpdateRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ApiNotificationGroupV1UpdateRequest {
        channels: vec![NotificationChannelV1 {
            config_name: Some("string".to_string()),
            type: Some("string".to_string()),
            ..Default::default()
        }],
        description: Some("string".to_string()),
        id: Some("string".to_string()),
        name: Some("string".to_string()),
        ..Default::default()
    };

    let response = entities_notification_groups_patch_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

body = Falcon::ApiNotificationGroupV1UpdateRequest.new(
  channels: [{
      config_id: 'string',
      config_name: 'string',
      recipients: [],
      severity: 'string',
      type: 'string'
    }],
  description: 'string',
  id: 'string',
  name: 'string'
)

response = api.entities_notification_groups_patch_v1(body)

puts response

Responses

200 OK

[
  {
    "channels": [],
    "cid": "string",
    "created_by": {},
    "created_by_name": "string",
    "created_timestamp": "string",
    "description": "string",
    "id": "string",
    "name": "string",
    "updated_by": {},
    "updated_by_name": "string",
    "updated_timestamp": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.notification-groups.patch.v2

Update notification group

Method PATCH

Route /casemgmt/entities/notification-groups/v2

Scope Case Templates: WRITE

PEP 8 update_notification_group_v2

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

channels body · array

The notification group channel configuration parameters.

description body · string

Notification group description.

id body · string

The ID of the notification group.

name body · string

Notification group name.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

channels = [
    {
        "config_id": "string",
        "config_name": "string",
        "params": {},
        "type": "email"
    }
]

response = falcon.update_notification_group_v2(channels=channels,
                                               description="string",
                                               id="string",
                                               name="string")
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

channels = [
    {
        "config_id": "string",
        "config_name": "string",
        "params": {},
        "type": "email"
    }
]

response = falcon.entities_notification_groups_patch_v2(channels=channels,
                                                        description="string",
                                                        id="string",
                                                        name="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "channels": [
        {
            "config_id": "string",
            "config_name": "string",
            "params": {},
            "type": "string"
        }
    ],
    "description": "string",
    "id": "string",
    "name": "string"
}

response = falcon.command("entities_notification_groups_patch_v2", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  config_id := "string"
  config_name := "string"
  typeVar := "string"
  description := "string"
  id := "string"
  name := "string"

  response, err := client.CaseManagement.EntitiesNotificationGroupsPatchV2(
    &case_management.EntitiesNotificationGroupsPatchV2Params{
      Body: &models.APINotificationGroupV2UpdateRequest{
        Channels: []interface{}{
          {
          ConfigID: &config_id,
          ConfigName: &config_name,
          Params: &struct{}{},
          Type: &typeVar,
          },
        },
        Description: &description,
        ID: &id,
        Name: &name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.entitiesNotificationGroupsPatchV2(
  {
    channels: [{
        configId: "string",
        configName: "string",
        params: {},
        type: "string"
      }],
    description: "string",
    id: "string",
    name: "string"
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

body = Falcon::ApiNotificationGroupV2UpdateRequest.new(
  channels: [{
      config_id: 'string',
      config_name: 'string',
      params: {},
      type: 'string'
    }],
  description: 'string',
  id: 'string',
  name: 'string'
)

response = api.entities_notification_groups_patch_v2(body)

puts response

Responses

200 OK

[
  {
    "channels": [],
    "cid": "string",
    "created_by": {},
    "created_by_name": "string",
    "created_timestamp": "string",
    "description": "string",
    "id": "string",
    "name": "string",
    "updated_by": {},
    "updated_by_name": "string",
    "updated_timestamp": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.notification-groups.post.v1

Create notification group

Deprecated

This operation is deprecated.

Method POST

Route /casemgmt/entities/notification-groups/v1

Scope Case Templates: WRITE

PEP 8 create_notification_group

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

channels body · array

The notification group channel configuration parameters.

description body · string

Notification group description.

name body · string

Notification group name.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

channels = [
    {
        "config_id": "string",
        "config_name": "string",
        "recipients": [
            "string"
        ],
        "severity": "string",
        "type": "email"
    }
]

response = falcon.create_notification_group(channels=channels,
                                            description="string",
                                            name="string")
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

channels = [
    {
        "config_id": "string",
        "config_name": "string",
        "recipients": [
            "string"
        ],
        "severity": "string",
        "type": "email"
    }
]

response = falcon.entities_notification_groups_post_v1(channels=channels,
                                                       description="string",
                                                       name="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "channels": [
        {
            "config_id": "string",
            "config_name": "string",
            "recipients": ["string"],
            "severity": "string",
            "type": "string"
        }
    ],
    "description": "string",
    "name": "string"
}

response = falcon.command("entities_notification_groups_post_v1", body=body_payload)
print(response)

PowerShell

New-FalconNgsCaseNotificationGroup -Name "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  config_id := "string"
  config_name := "string"
  severity := "string"
  typeVar := "string"
  description := "string"
  name := "string"

  response, err := client.CaseManagement.EntitiesNotificationGroupsPostV1(
    &case_management.EntitiesNotificationGroupsPostV1Params{
      Body: &models.APINotificationGroupV1CreateRequest{
        Channels: []interface{}{
          {
          ConfigID: &config_id,
          ConfigName: &config_name,
          Recipients: []string{"string"},
          Severity: &severity,
          Type: &typeVar,
          },
        },
        Description: &description,
        Name: &name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.entitiesNotificationGroupsPostV1(
  {
    channels: [{
        configId: "string",
        configName: "string",
        recipients: [],
        severity: "string",
        type: "string"
      }],
    description: "string",
    name: "string"
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::case_management_api::entities_notification_groups_post_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApiNotificationGroupV1CreateRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ApiNotificationGroupV1CreateRequest {
        channels: vec![NotificationChannelV1 {
            config_name: Some("string".to_string()),
            type: Some("string".to_string()),
            ..Default::default()
        }],
        description: Some("string".to_string()),
        name: Some("string".to_string()),
        ..Default::default()
    };

    let response = entities_notification_groups_post_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

body = Falcon::ApiNotificationGroupV1CreateRequest.new(
  channels: [{
      config_id: 'string',
      config_name: 'string',
      recipients: [],
      severity: 'string',
      type: 'string'
    }],
  description: 'string',
  name: 'string'
)

response = api.entities_notification_groups_post_v1(body)

puts response

Responses

200 OK

[
  {
    "channels": [],
    "cid": "string",
    "created_by": {},
    "created_by_name": "string",
    "created_timestamp": "string",
    "description": "string",
    "id": "string",
    "name": "string",
    "updated_by": {},
    "updated_by_name": "string",
    "updated_timestamp": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.notification-groups.post.v2

Create notification group

Method POST

Route /casemgmt/entities/notification-groups/v2

Scope Case Templates: WRITE

PEP 8 create_notification_group_v2

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

channels body · array

The notification group channel configuration parameters.

description body · string

Notification group description.

name body · string

Notification group name.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

channels = [
    {
        "config_id": "string",
        "config_name": "string",
        "params": {},
        "type": "email"
    }
]

response = falcon.create_notification_group_v2(channels=channels,
                                               description="string",
                                               name="string")
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

channels = [
    {
        "config_id": "string",
        "config_name": "string",
        "params": {},
        "type": "email"
    }
]

response = falcon.entities_notification_groups_post_v2(channels=channels,
                                                       description="string",
                                                       name="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "channels": [
        {
            "config_id": "string",
            "config_name": "string",
            "params": {},
            "type": "string"
        }
    ],
    "description": "string",
    "name": "string"
}

response = falcon.command("entities_notification_groups_post_v2", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  config_id := "string"
  config_name := "string"
  typeVar := "string"
  description := "string"
  name := "string"

  response, err := client.CaseManagement.EntitiesNotificationGroupsPostV2(
    &case_management.EntitiesNotificationGroupsPostV2Params{
      Body: &models.APINotificationGroupV2CreateRequest{
        Channels: []interface{}{
          {
          ConfigID: &config_id,
          ConfigName: &config_name,
          Params: &struct{}{},
          Type: &typeVar,
          },
        },
        Description: &description,
        Name: &name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.entitiesNotificationGroupsPostV2(
  {
    channels: [{
        configId: "string",
        configName: "string",
        params: {},
        type: "string"
      }],
    description: "string",
    name: "string"
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

body = Falcon::ApiNotificationGroupV2CreateRequest.new(
  channels: [{
      config_id: 'string',
      config_name: 'string',
      params: {},
      type: 'string'
    }],
  description: 'string',
  name: 'string'
)

response = api.entities_notification_groups_post_v2(body)

puts response

Responses

200 OK

[
  {
    "channels": [],
    "cid": "string",
    "created_by": {},
    "created_by_name": "string",
    "created_timestamp": "string",
    "description": "string",
    "id": "string",
    "name": "string",
    "updated_by": {},
    "updated_by_name": "string",
    "updated_timestamp": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.retrieve-rtr-file.post.v1

retrieves a file from host using RTR and adds it to a case

Method POST

Route /case-files/entities/retrieve-rtr-file/v1

Scope Cases: WRITE

PEP 8 retrieve_rtr_file

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

aid body · string

The agent ID of the host to retrieve the file from.

case_id body · string

The ID of the case to add the file to.

description body · string

A description of the file being retrieved.

file_path body · string

The path to the file on the host.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.retrieve_rtr_file(aid="string",
                                    case_id="string",
                                    description="string",
                                    file_path="string")
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.entities_retrieve_rtr_file_post_v1(aid="string",
                                                     case_id="string",
                                                     description="string",
                                                     file_path="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "aid": "string",
    "case_id": "string",
    "description": "string",
    "file_path": "string"
}

response = falcon.command("entities_retrieve_rtr_file_post_v1", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_files"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  aid := "string"
  case_id := "string"
  description := "string"
  file_path := "string"

  response, err := client.CaseFiles.EntitiesRetrieveRtrFilePostV1(
    &case_files.EntitiesRetrieveRtrFilePostV1Params{
      Body: &models.CasefilesapiRetrieveRTRFileRequestV1{
        Aid: &aid,
        CaseID: &case_id,
        Description: &description,
        FilePath: &file_path,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseFiles.entitiesRetrieveRtrFilePostV1(
  {
    aid: "string",
    caseId: "string",
    description: "string",
    filePath: "string"
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseFiles.new

body = Falcon::CasefilesapiRetrieveRTRFileRequestV1.new(
  aid: 'string',
  case_id: 'string',
  description: 'string',
  file_path: 'string'
)

response = api.entities_retrieve_rtr_file_post_v1(body)

puts response

Responses

200 OK

[
  {
    "case_id": "string",
    "cid": "string",
    "description": "string",
    "file_size": "string",
    "file_size_bytes": 0,
    "file_type": "string",
    "hash_value": "string",
    "id": "string",
    "name": "string",
    "source": "string",
    "uploaded_by": "string",
    "uploaded_on": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.retrieve-rtr-recent-file.post.v1

RetrieveRecentRTRFile retrieves a recently fetched RTR file and adds it to a case

Method POST

Route /case-files/entities/retrieve-rtr-recent-file/v1

Scope Cases: WRITE

PEP 8 retrieve_rtr_recent_file

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

aid body · string

The agent ID of the host.

case_id body · string

The ID of the case to add the file to.

description body · string

A description of the file being retrieved.

session_id body · string

The RTR session ID for the file retrieval.

sha256 body · string

The SHA256 hash of the file to retrieve.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.retrieve_rtr_recent_file(aid="string",
                                           case_id="string",
                                           description="string",
                                           session_id="string",
                                           sha256="string")
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.entities_retrieve_rtr_recent_file_post_v1(aid="string",
                                                            case_id="string",
                                                            description="string",
                                                            session_id="string",
                                                            sha256="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "aid": "string",
    "case_id": "string",
    "description": "string",
    "session_id": "string",
    "sha256": "string"
}

response = falcon.command("entities_retrieve_rtr_recent_file_post_v1", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_files"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  aid := "string"
  case_id := "string"
  description := "string"
  session_id := "string"
  sha256 := "string"

  response, err := client.CaseFiles.EntitiesRetrieveRtrRecentFilePostV1(
    &case_files.EntitiesRetrieveRtrRecentFilePostV1Params{
      Body: &models.CasefilesapiRetrieveRTRRecentFileRequestV1{
        Aid: &aid,
        CaseID: &case_id,
        Description: &description,
        SessionID: &session_id,
        Sha256: &sha256,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseFiles.entitiesRetrieveRtrRecentFilePostV1(
  {
    aid: "string",
    caseId: "string",
    description: "string",
    sessionId: "string",
    sha256: "string"
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseFiles.new

body = Falcon::CasefilesapiRetrieveRTRRecentFileRequestV1.new(
  aid: 'string',
  case_id: 'string',
  description: 'string',
  session_id: 'string',
  sha256: 'string'
)

response = api.entities_retrieve_rtr_recent_file_post_v1(body)

puts response

Responses

200 OK

[
  {
    "case_id": "string",
    "cid": "string",
    "description": "string",
    "file_size": "string",
    "file_size_bytes": 0,
    "file_type": "string",
    "hash_value": "string",
    "id": "string",
    "name": "string",
    "source": "string",
    "uploaded_by": "string",
    "uploaded_on": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.slas.delete.v1

Delete SLAs

Method DELETE

Route /casemgmt/entities/slas/v1

Scope Case Templates: WRITE

PEP 8 delete_sla

Parameters

ids query · string or list of strings

Resource IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_sla(ids=id_list)
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_slas_delete_v1(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_slas_delete_v1",
                          ids=id_list)
print(response)

PowerShell

Remove-FalconNgsCaseSla -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CaseManagement.EntitiesSlasDeleteV1(
    &case_management.EntitiesSlasDeleteV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.entitiesSlasDeleteV1("string");  // ids

console.log(response);

Rust

use rusty_falcon::apis::case_management_api::entities_slas_delete_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = entities_slas_delete_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

response = api.entities_slas_delete_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.slas.get.v1

Get SLAs by ID

Method GET

Route /casemgmt/entities/slas/v1

Scope Case Templates: READ

PEP 8 get_slas

Parameters

ids query · string or list of strings

Resource IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_slas(ids=id_list)
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_slas_get_v1(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_slas_get_v1",
                          ids=id_list)
print(response)

PowerShell

Get-FalconNgsCaseSla -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CaseManagement.EntitiesSlasGetV1(
    &case_management.EntitiesSlasGetV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.entitiesSlasGetV1("string");  // ids

console.log(response);

Rust

use rusty_falcon::apis::case_management_api::entities_slas_get_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = entities_slas_get_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

response = api.entities_slas_get_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "created_by": {},
    "created_by_name": "string",
    "created_timestamp": "string",
    "description": "string",
    "goals": [],
    "id": "string",
    "name": "string",
    "updated_by": {},
    "updated_by_name": "string",
    "updated_timestamp": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.slas.patch.v1

Update SLA

Method PATCH

Route /casemgmt/entities/slas/v1

Scope Case Templates: WRITE

PEP 8 update_sla

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

description body · string

The description of the SLA.

goals body · array

The SLA goals.

id body · string

name body · string

The name of the SLA.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

goals = [
    {
        "duration_seconds": 0,
        "escalation_policy": {
            "steps": [
                {
                    "escalate_after_seconds": 0,
                    "notification_group_id": "string"
                }
            ]
        },
        "type": "string"
    }
]

response = falcon.update_sla(description="string", goals=goals, name="string")
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

goals = [
    {
        "duration_seconds": 0,
        "escalation_policy": {
            "steps": [
                {
                    "escalate_after_seconds": 0,
                    "notification_group_id": "string"
                }
            ]
        },
        "type": "string"
    }
]

response = falcon.entities_slas_patch_v1(description="string",
                                         goals=goals,
                                         name="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "goals": [
        {
            "duration_seconds": integer,
            "escalation_policy": {
                "steps": ["string"]
            },
            "type": "string"
        }
    ],
    "id": "string",
    "name": "string"
}

response = falcon.command("entities_slas_patch_v1", body=body_payload)
print(response)

PowerShell

Edit-FalconNgsCaseSla -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  duration_seconds := integer
  typeVar := "string"
  id := "string"
  name := "string"

  response, err := client.CaseManagement.EntitiesSlasPatchV1(
    &case_management.EntitiesSlasPatchV1Params{
      Body: &models.APISLAV1UpdateRequest{
        Description: &description,
        Goals: []interface{}{
          {
          DurationSeconds: &duration_seconds,
          EscalationPolicy: &struct{}{},
          Type: &typeVar,
          },
        },
        ID: &id,
        Name: &name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.entitiesSlasPatchV1(
  {
    description: "string",
    goals: [{
        durationSeconds: integer,
        escalationPolicy: {
          steps: []
        },
        type: "string"
      }],
    id: "string",
    name: "string"
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::case_management_api::entities_slas_patch_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApiSlav1UpdateRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ApiSlav1UpdateRequest {
        description: Some("string".to_string()),
        goals: vec![goals {
            duration_seconds: Some(integer),
            type: Some("string".to_string()),
            ..Default::default()
        }],
        id: Some("string".to_string()),
        name: Some("string".to_string()),
        ..Default::default()
    };

    let response = entities_slas_patch_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

body = Falcon::ApiSLAV1UpdateRequest.new(
  description: 'string',
  goals: [{
      duration_seconds: integer,
      escalation_policy: {
        steps: []
      },
      type: 'string'
    }],
  id: 'string',
  name: 'string'
)

response = api.entities_slas_patch_v1(body)

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "created_by": {},
    "created_by_name": "string",
    "created_timestamp": "string",
    "description": "string",
    "goals": [],
    "id": "string",
    "name": "string",
    "updated_by": {},
    "updated_by_name": "string",
    "updated_timestamp": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.slas.post.v1

Create SLA

Method POST

Route /casemgmt/entities/slas/v1

Scope Case Templates: WRITE

PEP 8 create_sla

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

description body · string

The description of the SLA.

goals body · array

The SLA goals.

name body · string

The name of the SLA.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

goals = [
    {
        "duration_seconds": 0,
        "escalation_policy": {
            "steps": [
                {
                    "escalate_after_seconds": 0,
                    "notification_group_id": "string"
                }
            ]
        },
        "type": "string"
    }
]

response = falcon.create_sla(description="string", goals=goals, name="string")
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

goals = [
    {
        "duration_seconds": 0,
        "escalation_policy": {
            "steps": [
                {
                    "escalate_after_seconds": 0,
                    "notification_group_id": "string"
                }
            ]
        },
        "type": "string"
    }
]

response = falcon.entities_slas_post_v1(description="string",
                                        goals=goals,
                                        name="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "goals": [
        {
            "duration_seconds": integer,
            "escalation_policy": {
                "steps": ["string"]
            },
            "type": "string"
        }
    ],
    "name": "string"
}

response = falcon.command("entities_slas_post_v1", body=body_payload)
print(response)

PowerShell

New-FalconNgsCaseSla -Name "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  duration_seconds := integer
  typeVar := "string"
  name := "string"

  response, err := client.CaseManagement.EntitiesSlasPostV1(
    &case_management.EntitiesSlasPostV1Params{
      Body: &models.APISLAV1CreateRequest{
        Description: &description,
        Goals: []interface{}{
          {
          DurationSeconds: &duration_seconds,
          EscalationPolicy: &struct{}{},
          Type: &typeVar,
          },
        },
        Name: &name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.entitiesSlasPostV1(
  {
    description: "string",
    goals: [{
        durationSeconds: integer,
        escalationPolicy: {
          steps: []
        },
        type: "string"
      }],
    name: "string"
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::case_management_api::entities_slas_post_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApiSlav1CreateRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ApiSlav1CreateRequest {
        description: Some("string".to_string()),
        goals: vec![goals {
            duration_seconds: Some(integer),
            type: Some("string".to_string()),
            ..Default::default()
        }],
        name: Some("string".to_string()),
        ..Default::default()
    };

    let response = entities_slas_post_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

body = Falcon::ApiSLAV1CreateRequest.new(
  description: 'string',
  goals: [{
      duration_seconds: integer,
      escalation_policy: {
        steps: []
      },
      type: 'string'
    }],
  name: 'string'
)

response = api.entities_slas_post_v1(body)

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "created_by": {},
    "created_by_name": "string",
    "created_timestamp": "string",
    "description": "string",
    "goals": [],
    "id": "string",
    "name": "string",
    "updated_by": {},
    "updated_by_name": "string",
    "updated_timestamp": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.template-snapshots.get.v1

Get template snapshots

Method GET

Route /casemgmt/entities/template-snapshots/v1

Scope Case Templates: READ

PEP 8 get_template_snapshots

Parameters

ids query · string or list of strings

Snapshot IDs

template_ids query · string or list of strings

Retrieves the latest snapshot for all Template IDs

versions query · integer or list of integers

Retrieve a specific version of the template from the parallel array template_ids. A value of zero will return the latest snapshot.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_template_snapshots(ids=id_list,
                                         template_ids=id_list,
                                         versions=id_list)
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_template_snapshots_get_v1(ids=id_list,
                                                     template_ids=id_list,
                                                     versions=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_template_snapshots_get_v1",
                          ids=id_list,
                          template_ids=id_list,
                          versions=id_list)
print(response)

PowerShell

Get-FalconNgsCaseTemplateSnapshot -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CaseManagement.EntitiesTemplateSnapshotsGetV1(
    &case_management.EntitiesTemplateSnapshotsGetV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      TemplateIds: []string{"ID1", "ID2", "ID3"},
      Versions: []integer{0},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.entitiesTemplateSnapshotsGetV1(
  "string",  // ids
  "string",  // templateIds
  integer  // versions
);

console.log(response);

Rust

use rusty_falcon::apis::case_management_api::entities_template_snapshots_get_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = entities_template_snapshots_get_v1(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
        Some(vec!["string".to_string()]),  // template_ids
        Some(vec![]),  // versions
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

response = api.entities_template_snapshots_get_v1(ids: ['ID1', 'ID2', 'ID3'],
                                                  template_ids: ['ID1', 'ID2', 'ID3'],
                                                  versions: ['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "created_by": {},
    "created_by_name": "string",
    "created_timestamp": "string",
    "id": "string",
    "template": "string",
    "template_id": "string",
    "updated_by": {},
    "updated_by_name": "string",
    "updated_timestamp": "string",
    "version": 0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.templates.delete.v1

Delete templates

Method DELETE

Route /casemgmt/entities/templates/v1

Scope Case Templates: WRITE

PEP 8 delete_templates

Parameters

ids query · string or list of strings

Resource IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_templates(ids=id_list)
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_templates_delete_v1(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_templates_delete_v1",
                          ids=id_list)
print(response)

PowerShell

Remove-FalconNgsCaseTemplate -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CaseManagement.EntitiesTemplatesDeleteV1(
    &case_management.EntitiesTemplatesDeleteV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.entitiesTemplatesDeleteV1("string");  // ids

console.log(response);

Rust

use rusty_falcon::apis::case_management_api::entities_templates_delete_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = entities_templates_delete_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

response = api.entities_templates_delete_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.templates.get.v1

Get templates by ID

Method GET

Route /casemgmt/entities/templates/v1

Scope Case Templates: READ

PEP 8 get_templates

Parameters

ids query · string or list of strings

Resource IDs

with_has_access query · boolean

Evaluate FGAC and return has_access property

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_templates(ids=id_list, with_has_access=boolean)
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_templates_get_v1(ids=id_list,
                                            with_has_access=boolean)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_templates_get_v1",
                          ids=id_list,
                          with_has_access=boolean)
print(response)

PowerShell

Get-FalconNgsCaseTemplate -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  withHasAccess := boolean

  response, err := client.CaseManagement.EntitiesTemplatesGetV1(
    &case_management.EntitiesTemplatesGetV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      WithHasAccess: &withHasAccess,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.entitiesTemplatesGetV1(
  "string",  // ids
  boolean  // withHasAccess
);

console.log(response);

Rust

use rusty_falcon::apis::case_management_api::entities_templates_get_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = entities_templates_get_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

response = api.entities_templates_get_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "access_tags": [],
    "cid": "string",
    "created_by": {},
    "created_by_name": "string",
    "created_timestamp": "string",
    "description": "string",
    "fields": [],
    "has_access": false,
    "id": "string",
    "name": "string",
    "sla_id": "string",
    "sla_method": "string",
    "sla_rules": [],
    "updated_by": {},
    "updated_by_name": "string",
    "updated_timestamp": "string",
    "workflows": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.templates.patch.v1

Update template

Method PATCH

Route /casemgmt/entities/templates/v1

Scope Case Templates: WRITE

PEP 8 update_template

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

access_tags body · array

description body · string

The description of the template.

fields body · array

The fields required to create a template.

id body · string

The ID of the template to update.

name body · string

The name of the template.

sla_id body · string

The ID of the SLA.

sla_rules body · array

workflows body · array

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

fields = [
    {
        "data_type": "string",
        "default_value": "string",
        "id": "string",
        "input_type": "string",
        "multivalued": True,
        "name": "string",
        "options": [
            {
                "id": "string",
                "value": "string"
            }
        ],
        "required": True
    }
]

response = falcon.update_template(description="string",
                                  fields=fields,
                                  id="string",
                                  name="string",
                                  sla_id="string")
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

fields = [
    {
        "data_type": "string",
        "default_value": "string",
        "id": "string",
        "input_type": "string",
        "multivalued": True,
        "name": "string",
        "options": [
            {
                "id": "string",
                "value": "string"
            }
        ],
        "required": True
    }
]

response = falcon.entities_templates_patch_v1(description="string",
                                              fields=fields,
                                              id="string",
                                              name="string",
                                              sla_id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "access_tags": [
        {
            "cid": "string",
            "has_access": boolean,
            "id": "string",
            "key": "string",
            "templates": [
                {
                    "id": "string",
                    "name": "string"
                }
            ]
        }
    ],
    "description": "string",
    "fields": [
        {
            "data_type": "string",
            "default_value": "string",
            "display_order": integer,
            "id": "string",
            "input_type": "string",
            "multivalued": boolean,
            "name": "string",
            "options": [
                {
                    "id": "string",
                    "value": "string"
                }
            ],
            "required": boolean
        }
    ],
    "id": "string",
    "name": "string",
    "sla_id": "string",
    "sla_rules": [
        {
            "condition": "string",
            "id": "string",
            "sla_id": "string",
            "type": "string"
        }
    ],
    "workflows": [
        {
            "display_order": integer,
            "id": "string"
        }
    ]
}

response = falcon.command("entities_templates_patch_v1", body=body_payload)
print(response)

PowerShell

Edit-FalconNgsCaseTemplate -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cid := "string"
  has_access := boolean
  id := "string"
  key := "string"
  name := "string"
  description := "string"
  data_type := "string"
  default_value := "string"
  display_order := integer
  input_type := "string"
  multivalued := boolean
  value := "string"
  required := boolean
  sla_id := "string"
  condition := "string"
  typeVar := "string"

  response, err := client.CaseManagement.EntitiesTemplatesPatchV1(
    &case_management.EntitiesTemplatesPatchV1Params{
      Body: &models.APITemplateV1UpdateRequest{
        AccessTags: []interface{}{
          {
          CID: &cid,
          HasAccess: &has_access,
          ID: &id,
          Key: &key,
          Templates: []interface{}{
            {
            ID: &id,
            Name: &name,
            },
          },
          },
        },
        Description: &description,
        Fields: []interface{}{
          {
          DataType: &data_type,
          DefaultValue: &default_value,
          DisplayOrder: &display_order,
          ID: &id,
          InputType: &input_type,
          Multivalued: &multivalued,
          Name: &name,
          Options: []interface{}{
            {
            ID: &id,
            Value: &value,
            },
          },
          Required: &required,
          },
        },
        ID: &id,
        Name: &name,
        SlaID: &sla_id,
        SlaRules: []interface{}{
          {
          Condition: &condition,
          ID: &id,
          SlaID: &sla_id,
          Type: &typeVar,
          },
        },
        Workflows: []interface{}{
          {
          DisplayOrder: &display_order,
          ID: &id,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.entitiesTemplatesPatchV1(
  {
    accessTags: [{
        cid: "string",
        hasAccess: boolean,
        id: "string",
        key: "string",
        templates: [{
            id: "string",
            name: "string"
          }]
      }],
    description: "string",
    fields: [{
        dataType: "string",
        defaultValue: "string",
        displayOrder: integer,
        id: "string",
        inputType: "string",
        multivalued: boolean,
        name: "string",
        options: [{
            id: "string",
            value: "string"
          }],
        required: boolean
      }],
    id: "string",
    name: "string",
    slaId: "string",
    slaRules: [{
        condition: "string",
        id: "string",
        slaId: "string",
        type: "string"
      }],
    workflows: [{
        displayOrder: integer,
        id: "string"
      }]
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::case_management_api::entities_templates_patch_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApiTemplateV1UpdateRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ApiTemplateV1UpdateRequest {
        id: Some("string".to_string()),
        name: Some("string".to_string()),
        ..Default::default()
    };

    let response = entities_templates_patch_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

body = Falcon::ApiTemplateV1UpdateRequest.new(
  access_tags: [{
      cid: 'string',
      has_access: boolean,
      id: 'string',
      key: 'string',
      templates: [{
          id: 'string',
          name: 'string'
        }]
    }],
  description: 'string',
  fields: [{
      data_type: 'string',
      default_value: 'string',
      display_order: integer,
      id: 'string',
      input_type: 'string',
      multivalued: boolean,
      name: 'string',
      options: [{
          id: 'string',
          value: 'string'
        }],
      required: boolean
    }],
  id: 'string',
  name: 'string',
  sla_id: 'string',
  sla_rules: [{
      condition: 'string',
      id: 'string',
      sla_id: 'string',
      type: 'string'
    }],
  workflows: [{
      display_order: integer,
      id: 'string'
    }]
)

response = api.entities_templates_patch_v1(body)

puts response

Responses

200 OK

[
  {
    "access_tags": [],
    "cid": "string",
    "created_by": {},
    "created_by_name": "string",
    "created_timestamp": "string",
    "description": "string",
    "fields": [],
    "has_access": false,
    "id": "string",
    "name": "string",
    "sla_id": "string",
    "sla_method": "string",
    "sla_rules": [],
    "updated_by": {},
    "updated_by_name": "string",
    "updated_timestamp": "string",
    "workflows": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.templates.post.v1

Create template

Method POST

Route /casemgmt/entities/templates/v1

Scope Case Templates: WRITE

PEP 8 create_template

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

access_tags body · array

description body · string

The description of the template.

fields body · array

The fields required to create a template.

name body · string

The name of the template.

sla_id body · string

The ID of the SLA.

sla_rules body · array

workflows body · array

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

fields = [
    {
        "data_type": "string",
        "default_value": "string",
        "input_type": "string",
        "multivalued": True,
        "name": "string",
        "options": [
            {
                "value": "string"
            }
        ],
        "required": True
    }
]

response = falcon.create_template(description="string",
                                  fields=fields,
                                  name="string",
                                  sla_id="string")
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

fields = [
    {
        "data_type": "string",
        "default_value": "string",
        "input_type": "string",
        "multivalued": True,
        "name": "string",
        "options": [
            {
                "value": "string"
            }
        ],
        "required": True
    }
]

response = falcon.entities_templates_post_v1(description="string",
                                             fields=fields,
                                             name="string",
                                             sla_id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "access_tags": [
        {
            "cid": "string",
            "has_access": boolean,
            "id": "string",
            "key": "string",
            "templates": [
                {
                    "id": "string",
                    "name": "string"
                }
            ]
        }
    ],
    "description": "string",
    "fields": [
        {
            "data_type": "string",
            "default_value": "string",
            "display_order": integer,
            "input_type": "string",
            "multivalued": boolean,
            "name": "string",
            "options": [
                {
                    "value": "string"
                }
            ],
            "required": boolean
        }
    ],
    "name": "string",
    "sla_id": "string",
    "sla_rules": [
        {
            "condition": "string",
            "sla_id": "string",
            "type": "string"
        }
    ],
    "workflows": [
        {
            "display_order": integer,
            "id": "string"
        }
    ]
}

response = falcon.command("entities_templates_post_v1", body=body_payload)
print(response)

PowerShell

New-FalconNgsCaseTemplate -Name "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cid := "string"
  has_access := boolean
  id := "string"
  key := "string"
  name := "string"
  description := "string"
  data_type := "string"
  default_value := "string"
  display_order := integer
  input_type := "string"
  multivalued := boolean
  value := "string"
  required := boolean
  sla_id := "string"
  condition := "string"
  typeVar := "string"

  response, err := client.CaseManagement.EntitiesTemplatesPostV1(
    &case_management.EntitiesTemplatesPostV1Params{
      Body: &models.APITemplateV1CreateRequest{
        AccessTags: []interface{}{
          {
          CID: &cid,
          HasAccess: &has_access,
          ID: &id,
          Key: &key,
          Templates: []interface{}{
            {
            ID: &id,
            Name: &name,
            },
          },
          },
        },
        Description: &description,
        Fields: []interface{}{
          {
          DataType: &data_type,
          DefaultValue: &default_value,
          DisplayOrder: &display_order,
          InputType: &input_type,
          Multivalued: &multivalued,
          Name: &name,
          Options: []interface{}{
            {
            Value: &value,
            },
          },
          Required: &required,
          },
        },
        Name: &name,
        SlaID: &sla_id,
        SlaRules: []interface{}{
          {
          Condition: &condition,
          SlaID: &sla_id,
          Type: &typeVar,
          },
        },
        Workflows: []interface{}{
          {
          DisplayOrder: &display_order,
          ID: &id,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.entitiesTemplatesPostV1(
  {
    accessTags: [{
        cid: "string",
        hasAccess: boolean,
        id: "string",
        key: "string",
        templates: [{
            id: "string",
            name: "string"
          }]
      }],
    description: "string",
    fields: [{
        dataType: "string",
        defaultValue: "string",
        displayOrder: integer,
        inputType: "string",
        multivalued: boolean,
        name: "string",
        options: [{
            value: "string"
          }],
        required: boolean
      }],
    name: "string",
    slaId: "string",
    slaRules: [{
        condition: "string",
        slaId: "string",
        type: "string"
      }],
    workflows: [{
        displayOrder: integer,
        id: "string"
      }]
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::case_management_api::entities_templates_post_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApiTemplateV1CreateRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ApiTemplateV1CreateRequest {
        name: Some("string".to_string()),
        ..Default::default()
    };

    let response = entities_templates_post_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

body = Falcon::ApiTemplateV1CreateRequest.new(
  access_tags: [{
      cid: 'string',
      has_access: boolean,
      id: 'string',
      key: 'string',
      templates: [{
          id: 'string',
          name: 'string'
        }]
    }],
  description: 'string',
  fields: [{
      data_type: 'string',
      default_value: 'string',
      display_order: integer,
      input_type: 'string',
      multivalued: boolean,
      name: 'string',
      options: [{
          value: 'string'
        }],
      required: boolean
    }],
  name: 'string',
  sla_id: 'string',
  sla_rules: [{
      condition: 'string',
      sla_id: 'string',
      type: 'string'
    }],
  workflows: [{
      display_order: integer,
      id: 'string'
    }]
)

response = api.entities_templates_post_v1(body)

puts response

Responses

200 OK

[
  {
    "access_tags": [],
    "cid": "string",
    "created_by": {},
    "created_by_name": "string",
    "created_timestamp": "string",
    "description": "string",
    "fields": [],
    "has_access": false,
    "id": "string",
    "name": "string",
    "sla_id": "string",
    "sla_method": "string",
    "sla_rules": [],
    "updated_by": {},
    "updated_by_name": "string",
    "updated_timestamp": "string",
    "workflows": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.templates_export.get.v1

Export templates to files in a zip archive

Method GET

Route /casemgmt/entities/templates/export/v1

Scope Case Templates: READ

PEP 8 export_templates

Parameters

ids query · string or list of strings

Template IDs

filter query · string

FQL filter expression.

format query · string

Export file format

Available values (2)

yaml

json

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.export_templates(ids=id_list,
                                   filter="string",
                                   format="string")
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_templates_export_get_v1(ids=id_list,
                                                   filter="string",
                                                   format="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_templates_export_get_v1",
                          ids=id_list,
                          filter="string",
                          format="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  format := "string"

  response, err := client.CaseManagement.EntitiesTemplatesExportGetV1(
    &case_management.EntitiesTemplatesExportGetV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Filter: &filter,
      Format: &format,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.entitiesTemplatesExportGetV1(
  "string",  // ids
  "string",  // filter
  "string"  // format
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

response = api.entities_templates_export_get_v1(ids: ['ID1', 'ID2', 'ID3'],
                                                filter: 'string',
                                                format: 'string')

puts response

Responses

200 OK

{
  "link": "string"
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.templates_import.post.v1

Import a template from a file

Method POST

Route /casemgmt/entities/templates/import/v1

Scope Case Templates: WRITE

PEP 8 import_template

Parameters

file body · file

Local file

dry_run body · boolean

Run validation only

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.import_template(file="string", dry_run=boolean)
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.entities_templates_import_post_v1(file="string",
                                                    dry_run=boolean)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("entities_templates_import_post_v1",
                          file_data=open("filename", "rb").read(),
                          dry_run=boolean)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  dryRun := boolean

  response, err := client.CaseManagement.EntitiesTemplatesImportPostV1(
    &case_management.EntitiesTemplatesImportPostV1Params{
      DryRun: &dryRun,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.entitiesTemplatesImportPostV1(
  "string",  // file
  boolean  // dryRun
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

response = api.entities_templates_import_post_v1('string')

puts response

Responses

200 OK

[
  {
    "access_tags": [],
    "cid": "string",
    "created_by": {},
    "created_by_name": "string",
    "created_timestamp": "string",
    "description": "string",
    "fields": [],
    "has_access": false,
    "id": "string",
    "name": "string",
    "sla_id": "string",
    "sla_method": "string",
    "sla_rules": [],
    "updated_by": {},
    "updated_by_name": "string",
    "updated_timestamp": "string",
    "workflows": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

queries.access-tags.get.v1

Query access tags

Method GET

Route /casemgmt/queries/access-tags/v1

Scope Case Templates: READ

PEP 8 query_access_tags

Parameters

filter query · string

FQL filter expression.

sort query · string

Sort expression.

limit query · integer

Page size

after query · string

Pagination token

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.query_access_tags(filter="string",
                                    sort="string",
                                    limit=integer,
                                    after="string")
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.queries_access_tags_get_v1(filter="string",
                                             sort="string",
                                             limit=integer,
                                             after="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_access_tags_get_v1",
                          filter="string",
                          sort="string",
                          limit=integer,
                          after="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  after := "string"

  response, err := client.CaseManagement.QueriesAccessTagsGetV1(
    &case_management.QueriesAccessTagsGetV1Params{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      After: &after,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.queriesAccessTagsGetV1(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  "string"  // after
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

response = api.queries_access_tags_get_v1(filter: 'string',
                                          sort: 'string',
                                          limit: integer,
                                          after: 'string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

queries.cases.get.v1

Retrieves all Cases IDs that match a given query.

Method GET

Route /cases/queries/cases/v1

Scope Cases: READ

PEP 8 query_case_ids

Parameters

limit query · integer

The maximum number of Cases to return in this response (default: 100; max: 10000). Use this parameter together with the offset parameter to manage pagination of the results.

offset query · integer

The first case to return, where 0 is the latest case. Use with the offset parameter to manage pagination of results.

sort query · string

Sort parameter takes the form <field|direction>. Direction can be either asc (ascending) or desc (descending) order. For example: status|asc or status|desc. The sorting fields can be any keyword field that is part of #domain.Case except for the text based fields. Most commonly used fields are status, cid, created_timestamp, updated_timestamp, assigned_to_name, assigned_to_userid, assigned_to_uuid, tags. If the fields are missing from the Cases, the service will fallback to its default ordering.

filter query · string

Filter Cases using a query in Falcon Query Language (FQL). Filter fields can be any keyword field that is part of #domain.Case. An asterisk wildcard * includes all results. Empty value means to not filter on anything. Most commonly used filter fields that supports exact match: cid, id. Most commonly used filter fields that supports wildcard (*): assigned_to_name, assigned_to_uuid. Most commonly filter fields that supports range comparisons (>, <, >=, <=): created_timestamp, updated_timestamp. All filter fields and operations support negation (!). The full list of valid filter options is extensive. Review it in our documentation inside the Falcon console.

q query · string

Search all Case metadata for the provided string

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.query_case_ids(limit=integer,
                                 offset=integer,
                                 sort="string",
                                 filter="string",
                                 q="string")
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.queries_cases_get_v1(limit=integer,
                                       offset=integer,
                                       sort="string",
                                       filter="string",
                                       q="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_cases_get_v1",
                          limit=integer,
                          offset=integer,
                          sort="string",
                          filter="string",
                          q="string")
print(response)

PowerShell

Get-FalconNgsCase -Filter "string" `
  -Query "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cases"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)
  sort := "string"
  filter := "string"
  q := "string"

  response, err := client.Cases.QueriesCasesGetV1(
    &cases.QueriesCasesGetV1Params{
      Limit: &limit,
      Offset: &offset,
      Sort: &sort,
      Filter: &filter,
      Q: &q,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cases.queriesCasesGetV1(
  integer,  // limit
  integer,  // offset
  "string",  // sort
  "string",  // filter
  "string"  // q
);

console.log(response);

Rust

use rusty_falcon::apis::cases_api::queries_cases_get_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = queries_cases_get_v1(
        &falcon.cfg,  // configuration
        Some(integer),  // limit
        Some(integer),  // offset
        Some("string"),  // sort
        Some("string"),  // filter
        Some("string"),  // q
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

Examples coming soon.

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

---

---

queries.fields.get.v1

Query fields

Method GET

Route /casemgmt/queries/fields/v1

Scope Case Templates: READ

PEP 8 query_fields

Parameters

filter query · string

FQL filter expression.

limit query · integer

Page size

offset query · integer

Page offset

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.query_fields(filter="string", limit=integer, offset=integer)
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.queries_fields_get_v1(filter="string",
                                        limit=integer,
                                        offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_fields_get_v1",
                          filter="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconNgsCaseField -Filter "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.CaseManagement.QueriesFieldsGetV1(
    &case_management.QueriesFieldsGetV1Params{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.queriesFieldsGetV1(
  "string",  // filter
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::case_management_api::queries_fields_get_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = queries_fields_get_v1(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

response = api.queries_fields_get_v1(filter: 'string',
                                     limit: integer,
                                     offset: integer)

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

queries.file-details.get.v1

Query for ids of file details

Method GET

Route /case-files/queries/file-details/v1

Scope Cases: READ

PEP 8 query_file_detail_ids

Parameters

filter query · string

FQL filter expression.

limit query · integer

Page size

offset query · integer

Page offset

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.query_file_detail_ids(filter="string",
                                        limit=integer,
                                        offset=integer)
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.queries_file_details_get_v1(filter="string",
                                              limit=integer,
                                              offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_file_details_get_v1",
                          filter="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconNgsCaseFile -Filter "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_files"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.CaseFiles.QueriesFileDetailsGetV1(
    &case_files.QueriesFileDetailsGetV1Params{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseFiles.queriesFileDetailsGetV1(
  "string",  // filter
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::case_files_api::queries_file_details_get_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = queries_file_details_get_v1(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseFiles.new

response = api.queries_file_details_get_v1(filter: 'string',
                                           limit: integer,
                                           offset: integer)

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

queries.notification-groups.get.v1

Query notification groups

Deprecated

This operation is deprecated.

Method GET

Route /casemgmt/queries/notification-groups/v1

Scope Case Templates: READ

PEP 8 query_notification_groups

Parameters

filter query · string

FQL filter expression.

sort query · string

Sort expression.

limit query · integer

Page size

offset query · integer

Page offset

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.query_notification_groups(filter="string",
                                            sort="string",
                                            limit=integer,
                                            offset=integer)
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.queries_notification_groups_get_v1(filter="string",
                                                     sort="string",
                                                     limit=integer,
                                                     offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_notification_groups_get_v1",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconNgsCaseNotificationGroup -Filter "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.CaseManagement.QueriesNotificationGroupsGetV1(
    &case_management.QueriesNotificationGroupsGetV1Params{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.queriesNotificationGroupsGetV1(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::case_management_api::queries_notification_groups_get_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = queries_notification_groups_get_v1(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

response = api.queries_notification_groups_get_v1(filter: 'string',
                                                  sort: 'string',
                                                  limit: integer,
                                                  offset: integer)

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

queries.notification-groups.get.v2

Query notification groups

Method GET

Route /casemgmt/queries/notification-groups/v2

Scope Case Templates: READ

PEP 8 query_notification_groups_v2

Parameters

filter query · string

FQL filter expression.

sort query · string

Sort expression.

limit query · integer

Page size

offset query · integer

Page offset

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.query_notification_groups_v2(filter="string",
                                               sort="string",
                                               limit=integer,
                                               offset=integer)
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.queries_notification_groups_get_v2(filter="string",
                                                     sort="string",
                                                     limit=integer,
                                                     offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_notification_groups_get_v2",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.CaseManagement.QueriesNotificationGroupsGetV2(
    &case_management.QueriesNotificationGroupsGetV2Params{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.queriesNotificationGroupsGetV2(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

response = api.queries_notification_groups_get_v2(filter: 'string',
                                                  sort: 'string',
                                                  limit: integer,
                                                  offset: integer)

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

queries.slas.get.v1

Query SLAs

Method GET

Route /casemgmt/queries/slas/v1

Scope Case Templates: READ

PEP 8 query_slas

Parameters

filter query · string

FQL filter expression.

sort query · string

Sort expression.

limit query · integer

Page size

offset query · integer

Page offset

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.query_slas(filter="string",
                             sort="string",
                             limit=integer,
                             offset=integer)
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.queries_slas_get_v1(filter="string",
                                      sort="string",
                                      limit=integer,
                                      offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_slas_get_v1",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconNgsCaseSla -Filter "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.CaseManagement.QueriesSlasGetV1(
    &case_management.QueriesSlasGetV1Params{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.queriesSlasGetV1(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::case_management_api::queries_slas_get_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = queries_slas_get_v1(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

response = api.queries_slas_get_v1(filter: 'string',
                                   sort: 'string',
                                   limit: integer,
                                   offset: integer)

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

queries.template-snapshots.get.v1

Query template snapshots

Method GET

Route /casemgmt/queries/template-snapshots/v1

Scope Case Templates: READ

PEP 8 query_template_snapshots

Parameters

filter query · string

FQL filter expression.

limit query · integer

Page size

offset query · integer

Page offset

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.query_template_snapshots(filter="string",
                                           limit=integer,
                                           offset=integer)
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.queries_template_snapshots_get_v1(filter="string",
                                                    limit=integer,
                                                    offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_template_snapshots_get_v1",
                          filter="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconNgsCaseTemplateSnapshot -Filter "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.CaseManagement.QueriesTemplateSnapshotsGetV1(
    &case_management.QueriesTemplateSnapshotsGetV1Params{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.queriesTemplateSnapshotsGetV1(
  "string",  // filter
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::case_management_api::queries_template_snapshots_get_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = queries_template_snapshots_get_v1(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

response = api.queries_template_snapshots_get_v1(filter: 'string',
                                                 limit: integer,
                                                 offset: integer)

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

queries.templates.get.v1

Query templates

Method GET

Route /casemgmt/queries/templates/v1

Scope Case Templates: READ

PEP 8 query_templates

Parameters

filter query · string

FQL filter expression.

sort query · string

Sort expression.

limit query · integer

Page size

offset query · integer

Page offset

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.query_templates(filter="string",
                                  sort="string",
                                  limit=integer,
                                  offset=integer)
print(response)

Operation ID

from falconpy import CaseManagement

falcon = CaseManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.queries_templates_get_v1(filter="string",
                                           sort="string",
                                           limit=integer,
                                           offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_templates_get_v1",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconNgsCaseTemplate -Filter "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/case_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.CaseManagement.QueriesTemplatesGetV1(
    &case_management.QueriesTemplatesGetV1Params{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.caseManagement.queriesTemplatesGetV1(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::case_management_api::queries_templates_get_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = queries_templates_get_v1(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CaseManagement.new

response = api.queries_templates_get_v1(filter: 'string',
                                        sort: 'string',
                                        limit: integer,
                                        offset: integer)

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}