Cloud Azure Registration

The Cloud Azure Registration service collection provides operations for managing Azure cloud registrations. Create, update, delete, and validate Azure tenant registrations, download deployment scripts, manage legacy subscriptions, and trigger health checks.

Language	Last Update
Python	v1.6.5
PowerShell
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
cloud-registration-azure-create-registration create_registration	Create an Azure registration for a tenant.
cloud-registration-azure-create-suppressions cloud_registration_azure_create_suppressions	Create new issue suppression rules
cloud-registration-azure-delete-legacy-subscription delete_legacy_subscription	Delete existing legacy Azure subscriptions.
cloud-registration-azure-delete-registration delete_registration	Deletes existing Azure registrations.
cloud-registration-azure-delete-suppressions cloud_registration_azure_delete_suppressions	Remove/revoke suppression rules
cloud-registration-azure-download-script download_script	Retrieve script to create resources
cloud-registration-azure-get-issue-suppression-values-by-field cloud_registration_azure_get_issue_suppression_values_by_field	Retrieve distinct filterable values for issue suppression fields
cloud-registration-azure-get-issue-values-by-field cloud_registration_azure_get_issue_values_by_field	Retrieve distinct filterable values for issue fields
cloud-registration-azure-get-issues cloud_registration_azure_get_issues	Retrieve issues for Azure registrations
cloud-registration-azure-get-registration get_registration	Retrieve existing Azure registration for a tenant.
cloud-registration-azure-get-script cloud_registration_azure_get_script	Download Azure deployment script (Terraform or Bicep)
cloud-registration-azure-get-script-versions cloud_registration_azure_get_script_versions	Retrieve all available script versions with filtering and sorting
cloud-registration-azure-get-suppressions cloud_registration_azure_get_suppressions	Retrieve existing suppression rules with filtering
cloud-registration-azure-trigger-health-check health_check	Trigger health check scan for Azure registrations
cloud-registration-azure-update-registration update_registration	Update an existing Azure registration for a tenant.
cloud-registration-azure-update-suppressions cloud_registration_azure_update_suppressions	Update existing suppression rules
cloud-registration-azure-validate-registration validate_registration	Validate an Azure registration by checking service principal, role assignments and deployment stack (if the deployment method is Bicep)

---

cloud-registration-azure-create-registration

Create an Azure registration for a tenant.

Method POST

Route /cloud-security-registration-azure/entities/registrations/v1

Scope Cloud Security Azure Registration: WRITE

PEP 8 create_registration

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resource body · object

account_type body · string

Azure account type.

additional_features body · list of dictionaries

Additional features.

additional_properties body · dictionary

Additional properties.

api_client_key_id body · string

Azure API client key ID.

api_client_key_type body · string

Azure API client key type.

cs_infra_region body · string

CrowdStrike infrastructure region.

cs_infra_subscription_id body · string

CrowdStrike infrastructure subscription ID.

deployment_method body · string

Deployment method.

deployment_stack_host_id body · string

Azure deployment stack host ID.

deployment_stack_name body · string

Azure deployment stack name.

dspm_regions body · string or list of strings

DSPM regions.

environment body · string

Azure environment.

event_hub_settings body · list of dictionaries

Azure Event Hub settings.

management_group_ids body · string or list of strings

Azure management group IDs.

microsoft_graph_permission_ids body · string or list of strings

Microsoft Graph permission IDs.

microsoft_graph_permissions_ids_readonly body · boolean

Flag indicating if Microsoft Graph permission IDs are read-only.

products body · list of dictionaries

Products.

resource_name_prefix body · string

Resource naming prefix.

resource_name_suffix body · string

Resource naming suffix.

status body · string

Registration status.

subscription_ids body · string or list of strings

Azure subscription IDs.

tags body · dictionary

Additional tags.

template_version body · string

Deployment template version.

tenant_id body · string

Azure tenant ID.

Code Examples

Python

PEP 8

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

additional_features = [
    {
        "feature": "string",
        "product": "string",
        "subscription_ids": [
            "string"
        ]
    }
]

additional_properties = {}

event_hub_settings = [
    {
        "cid": "string",
        "consumer_group": "string",
        "event_hub_id": "string",
        "purpose": "string",
        "tenant_id": "string"
    }
]

products = [
    {
        "features": [
            "string"
        ],
        "product": "string"
    }
]

tags = {
    "additionalProp1": "string",
    "additionalProp2": "string",
    "additionalProp3": "string"
}

response = falcon.create_registration(account_type="string",
                                      additional_features=additional_features,
                                      additional_properties=additional_properties,
                                      api_client_key_id="string",
                                      api_client_key_type="string",
                                      cs_infra_region="string",
                                      cs_infra_subscription_id="string",
                                      deployment_method="string",
                                      deployment_stack_host_id="string",
                                      deployment_stack_name="string",
                                      dspm_regions=id_list,
                                      environment="string",
                                      event_hub_settings=event_hub_settings,
                                      management_group_ids=id_list,
                                      microsoft_graph_permission_ids=id_list,
                                      microsoft_graph_permissions_ids_readonly=boolean,
                                      products=products,
                                      resource_name_prefix="string",
                                      resource_name_suffix="string",
                                      status="string",
                                      subscription_ids=id_list,
                                      tags=tags,
                                      template_version="string",
                                      tenant_id="string")
print(response)

Operation ID

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

additional_features = [
    {
        "feature": "string",
        "product": "string",
        "subscription_ids": [
            "string"
        ]
    }
]

additional_properties = {}

event_hub_settings = [
    {
        "cid": "string",
        "consumer_group": "string",
        "event_hub_id": "string",
        "purpose": "string",
        "tenant_id": "string"
    }
]

products = [
    {
        "features": [
            "string"
        ],
        "product": "string"
    }
]

tags = {
    "additionalProp1": "string",
    "additionalProp2": "string",
    "additionalProp3": "string"
}

response = falcon.cloud_registration_azure_create_registration(account_type="string",
                                                               additional_features=additional_features,
                                                               additional_properties=additional_properties,
                                                               api_client_key_id="string",
                                                               api_client_key_type="string",
                                                               cs_infra_region="string",
                                                               cs_infra_subscription_id="string",
                                                               deployment_method="string",
                                                               deployment_stack_host_id="string",
                                                               deployment_stack_name="string",
                                                               dspm_regions=id_list,
                                                               environment="string",
                                                               event_hub_settings=event_hub_settings,
                                                               management_group_ids=id_list,
                                                               microsoft_graph_permission_ids=id_list,
                                                               microsoft_graph_permissions_ids_readonly=boolean,
                                                               products=products,
                                                               resource_name_prefix="string",
                                                               resource_name_suffix="string",
                                                               status="string",
                                                               subscription_ids=id_list,
                                                               tags=tags,
                                                               template_version="string",
                                                               tenant_id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "resource": {
        "account_type": "string",
        "additional_features": [
            {
                "feature": "string",
                "product": "string",
                "subscription_ids": ["string"]
            }
        ],
        "additional_properties": {},
        "api_client_key_id": "string",
        "api_client_key_type": "string",
        "cs_infra_region": "string",
        "cs_infra_subscription_id": "string",
        "cs_infra_subscription_name": "string",
        "deployment_method": "string",
        "deployment_stack_host_id": "string",
        "deployment_stack_host_region": "string",
        "deployment_stack_name": "string",
        "dspm_custom_vnet_configuration": {},
        "dspm_host_subscription_id": "string",
        "dspm_network_configuration_type": "string",
        "dspm_regions": ["string"],
        "environment": "string",
        "event_hub_settings": [
            {
                "cid": "string",
                "consumer_group": "string",
                "event_hub_id": "string",
                "management_type": "string",
                "purpose": "string",
                "tenant_id": "string"
            }
        ],
        "management_group_ids": ["string"],
        "microsoft_graph_permission_ids": ["string"],
        "microsoft_graph_permission_ids_readonly": boolean,
        "primary_domain": "string",
        "products": [
            {
                "features": ["string"],
                "product": "string"
            }
        ],
        "registration_description": "string",
        "registration_name": "string",
        "resource_name_prefix": "string",
        "resource_name_suffix": "string",
        "status": "string",
        "subscription_ids": ["string"],
        "tags": {},
        "template_version": "string",
        "tenant_id": "string",
        "tenant_name": "string",
        "vulnerability_scanning_custom_vnet_configuration": {},
        "vulnerability_scanning_host_subscription_id": "string",
        "vulnerability_scanning_network_configuration_type": "string",
        "vulnerability_scanning_regions": ["string"]
    }
}

response = falcon.command("cloud_registration_azure_create_registration", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_azure_registration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudAzureRegistration.CloudRegistrationAzureCreateRegistration(
    &cloud_azure_registration.CloudRegistrationAzureCreateRegistrationParams{
      Body: &models.AzureAzureRegistrationCreateRequestExtV1{
        Resource: &struct{}{},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudAzureRegistration.cloudRegistrationAzureCreateRegistration(
  {
    resource: {
      accountType: "string",
      additionalFeatures: [{
          feature: "string",
          product: "string",
          subscriptionIds: []
        }],
      additionalProperties: {},
      apiClientKeyId: "string",
      apiClientKeyType: "string",
      csInfraRegion: "string",
      csInfraSubscriptionId: "string",
      csInfraSubscriptionName: "string",
      deploymentMethod: "string",
      deploymentStackHostId: "string",
      deploymentStackHostRegion: "string",
      deploymentStackName: "string",
      dspmCustomVnetConfiguration: {},
      dspmHostSubscriptionId: "string",
      dspmNetworkConfigurationType: "string",
      dspmRegions: [],
      environment: "string",
      eventHubSettings: [{
          cid: "string",
          consumerGroup: "string",
          eventHubId: "string",
          managementType: "string",
          purpose: "string",
          tenantId: "string"
        }],
      managementGroupIds: [],
      microsoftGraphPermissionIds: [],
      microsoftGraphPermissionIdsReadonly: boolean,
      primaryDomain: "string",
      products: [{
          features: [],
          product: "string"
        }],
      registrationDescription: "string",
      registrationName: "string",
      resourceNamePrefix: "string",
      resourceNameSuffix: "string",
      status: "string",
      subscriptionIds: [],
      tags: {},
      templateVersion: "string",
      tenantId: "string",
      tenantName: "string",
      vulnerabilityScanningCustomVnetConfiguration: {},
      vulnerabilityScanningHostSubscriptionId: "string",
      vulnerabilityScanningNetworkConfigurationType: "string",
      vulnerabilityScanningRegions: []
    }
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::cloud_azure_registration_api::cloud_registration_azure_create_registration;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::AzureAzureRegistrationCreateRequestExtV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = AzureAzureRegistrationCreateRequestExtV1 {
        resource: Default::default(),
        ..Default::default()
    };

    let response = cloud_registration_azure_create_registration(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudAzureRegistration.new

body = Falcon::AzureAzureRegistrationCreateRequestExtV1.new(
  resource: {
    account_type: 'string',
    additional_features: [{
        feature: 'string',
        product: 'string',
        subscription_ids: []
      }],
    additional_properties: {},
    api_client_key_id: 'string',
    api_client_key_type: 'string',
    cs_infra_region: 'string',
    cs_infra_subscription_id: 'string',
    cs_infra_subscription_name: 'string',
    deployment_method: 'string',
    deployment_stack_host_id: 'string',
    deployment_stack_host_region: 'string',
    deployment_stack_name: 'string',
    dspm_custom_vnet_configuration: {},
    dspm_host_subscription_id: 'string',
    dspm_network_configuration_type: 'string',
    dspm_regions: [],
    environment: 'string',
    event_hub_settings: [{
        cid: 'string',
        consumer_group: 'string',
        event_hub_id: 'string',
        management_type: 'string',
        purpose: 'string',
        tenant_id: 'string'
      }],
    management_group_ids: [],
    microsoft_graph_permission_ids: [],
    microsoft_graph_permission_ids_readonly: boolean,
    primary_domain: 'string',
    products: [{
        features: [],
        product: 'string'
      }],
    registration_description: 'string',
    registration_name: 'string',
    resource_name_prefix: 'string',
    resource_name_suffix: 'string',
    status: 'string',
    subscription_ids: [],
    tags: {},
    template_version: 'string',
    tenant_id: 'string',
    tenant_name: 'string',
    vulnerability_scanning_custom_vnet_configuration: {},
    vulnerability_scanning_host_subscription_id: 'string',
    vulnerability_scanning_network_configuration_type: 'string',
    vulnerability_scanning_regions: []
  }
)

response = api.cloud_registration_azure_create_registration(body)

puts response

Responses

201 Created

[
  {
    "account_type": "string",
    "additional_features": [],
    "additional_properties": {},
    "admin_consent_url": "string",
    "api_client_key_id": "string",
    "api_client_key_type": "string",
    "app_registration_id": "string",
    "app_registration_name": "string",
    "cid": "string",
    "created": "string",
    "cs_infra_region": "string",
    "cs_infra_subscription_id": "string",
    "cs_infra_subscription_name": "string",
    "deleted": "string",
    "deployment_method": "string",
    "deployment_stack_host_id": "string",
    "deployment_stack_host_region": "string",
    "deployment_stack_host_type": "string",
    "deployment_stack_host_url": "string",
    "deployment_stack_name": "string",
    "dspm_custom_vnet_configuration": {},
    "dspm_host_subscription_id": "string",
    "dspm_network_configuration_type": "string",
    "dspm_regions": [],
    "enterprise_app_url": "string",
    "environment": "string",
    "event_hub_settings": [],
    "key_info": {},
    "last_healthcheck_completed_at": "string",
    "management_group_ids": [],
    "microsoft_graph_permission_ids": [],
    "microsoft_graph_permission_ids_readonly": false,
    "primary_domain": "string",
    "products": [],
    "registration_description": "string",
    "registration_id": "string",
    "registration_name": "string",
    "resource_name_prefix": "string",
    "resource_name_suffix": "string",
    "status": "string",
    "subscription_ids": [],
    "tags": {},
    "template_version": "string",
    "tenant_id": "string",
    "tenant_name": "string",
    "updated": "string",
    "vulnerability_scanning_custom_vnet_configuration": {},
    "vulnerability_scanning_host_subscription_id": "string",
    "vulnerability_scanning_network_configuration_type": "string",
    "vulnerability_scanning_regions": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

409 Conflict

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

cloud-registration-azure-create-suppressions

Create new issue suppression rules

Method POST

Route /cloud-security-registration-azure/entities/issue-suppressions/v1

Scope Cloud Security Azure Registration: WRITE

PEP 8 cloud_registration_azure_create_suppressions

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

The resources value.

Code Examples

Python

PEP 8

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_create_suppressions(resources=["string"])
print(response)

Operation ID

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_create_suppressions(resources=["string"])
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "reason": "string",
            "registration_id": "string",
            "target": {
                "entity_id": "string",
                "entity_type": "string",
                "issue_name": "string"
            },
            "type": "string"
        }
    ]
}

response = falcon.command("cloud_registration_azure_create_suppressions", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_azure_registration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  reason := "string"
  registration_id := "string"
  typeVar := "string"

  response, err := client.CloudAzureRegistration.CloudRegistrationAzureCreateSuppressions(
    &cloud_azure_registration.CloudRegistrationAzureCreateSuppressionsParams{
      Body: &models.AzureSuppressionCreateRequest{
        Resources: []interface{}{
          {
          Reason: &reason,
          RegistrationID: &registration_id,
          Target: &struct{}{},
          Type: &typeVar,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudAzureRegistration.cloudRegistrationAzureCreateSuppressions(
  {
    resources: [{
        reason: "string",
        registrationId: "string",
        target: {
          entityId: "string",
          entityType: "string",
          issueName: "string"
        },
        type: "string"
      }]
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudAzureRegistration.new

body = Falcon::AzureSuppressionCreateRequest.new(
  resources: [{
      reason: 'string',
      registration_id: 'string',
      target: {
        entity_id: 'string',
        entity_type: 'string',
        issue_name: 'string'
      },
      type: 'string'
    }]
)

response = api.cloud_registration_azure_create_suppressions(body)

puts response

Responses

201 Created

[
  {
    "category": "string",
    "created_at": "string",
    "entity_id": "string",
    "entity_type": "string",
    "impact": "string",
    "issue_name": "string",
    "reason": "string",
    "registration_id": "string",
    "severity": "string",
    "suppressed_by": "string",
    "suppression_id": "string",
    "type": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

cloud-registration-azure-delete-legacy-subscription

Delete existing legacy Azure subscriptions.

Method DELETE

Route /cloud-security-registration-azure/entities/accounts/legacy/v1

Scope Cloud Security Azure Registration: WRITE

PEP 8 delete_legacy_subscription

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

retain_client body · boolean

subscription_id body · string

tenant_id body · string

Code Examples

Python

PEP 8

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.delete_legacy_subscription(retain_client=boolean,
                                             subscription_id="string",
                                             tenant_id="string")
print(response)

Operation ID

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_delete_legacy_subscription(retain_client=boolean,
                                                                      subscription_id="string",
                                                                      tenant_id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "retain_client": boolean,
            "subscription_id": "string",
            "tenant_id": "string"
        }
    ]
}

response = falcon.command("cloud_registration_azure_delete_legacy_subscription", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_azure_registration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  retain_client := boolean
  subscription_id := "string"
  tenant_id := "string"

  response, err := client.CloudAzureRegistration.CloudRegistrationAzureDeleteLegacySubscription(
    &cloud_azure_registration.CloudRegistrationAzureDeleteLegacySubscriptionParams{
      Body: &models.AzureLegacySubscriptionDeleteRequestExtV1{
        Resources: []interface{}{
          {
          RetainClient: &retain_client,
          SubscriptionID: &subscription_id,
          TenantID: &tenant_id,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudAzureRegistration.cloudRegistrationAzureDeleteLegacySubscription(
  {
    resources: [{
        retainClient: boolean,
        subscriptionId: "string",
        tenantId: "string"
      }]
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudAzureRegistration.new

body = Falcon::AzureLegacySubscriptionDeleteRequestExtV1.new(
  resources: [{
      retain_client: boolean,
      subscription_id: 'string',
      tenant_id: 'string'
    }]
)

response = api.cloud_registration_azure_delete_legacy_subscription(body)

puts response

Responses

200 OK

[
  {
    "management_group_id": "string",
    "subscription_id": "string",
    "subscription_name": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

cloud-registration-azure-delete-registration

Deletes existing Azure registrations.

Method DELETE

Route /cloud-security-registration-azure/entities/registrations/v1

Scope Cloud Security Azure Registration: WRITE

PEP 8 delete_registration

Parameters

tenant_ids query · string or list of strings

Azure tenant IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_registration(tenant_ids=id_list)
print(response)

Operation ID

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.cloud_registration_azure_delete_registration(tenant_ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("cloud_registration_azure_delete_registration",
                          tenant_ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_azure_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudAzureRegistration.CloudRegistrationAzureDeleteRegistration(
    &cloud_azure_registration.CloudRegistrationAzureDeleteRegistrationParams{
      TenantIds: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudAzureRegistration.cloudRegistrationAzureDeleteRegistration(["ID1", "ID2", "ID3"]);  // tenantIds

console.log(response);

Rust

use rusty_falcon::apis::cloud_azure_registration_api::cloud_registration_azure_delete_registration;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = cloud_registration_azure_delete_registration(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // tenant_ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudAzureRegistration.new

response = api.cloud_registration_azure_delete_registration(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "activity_log_diagnostic_settings_name": "string",
    "cs_infra_subscription_id": "string",
    "deleted": false,
    "deployment_method": "string",
    "deployment_stack_location": "string",
    "deployment_stack_name": "string",
    "deployment_stack_scope": "string",
    "deprovision_scripts": {},
    "enterprise_app_url": "string",
    "products": [],
    "status": "string",
    "subscriptions": [],
    "tenant_id": "string",
    "tenant_name": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

cloud-registration-azure-delete-suppressions

Remove/revoke suppression rules

Method DELETE

Route /cloud-security-registration-azure/entities/issue-suppressions/v1

Scope Cloud Security Azure Registration: WRITE

PEP 8 cloud_registration_azure_delete_suppressions

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

suppression_ids body · array

Code Examples

Python

PEP 8

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_delete_suppressions(suppression_ids=["string"])
print(response)

Operation ID

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_delete_suppressions(suppression_ids=["string"])
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "suppression_ids": ["string"]
}

response = falcon.command("cloud_registration_azure_delete_suppressions", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_azure_registration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudAzureRegistration.CloudRegistrationAzureDeleteSuppressions(
    &cloud_azure_registration.CloudRegistrationAzureDeleteSuppressionsParams{
      Body: &models.AzureSuppressionDeleteRequest{
        SuppressionIds: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudAzureRegistration.cloudRegistrationAzureDeleteSuppressions(
  {
    suppressionIds: []
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudAzureRegistration.new

body = Falcon::AzureSuppressionDeleteRequest.new(
  suppression_ids: []
)

response = api.cloud_registration_azure_delete_suppressions(body)

puts response

Responses

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

cloud-registration-azure-download-script

Retrieve script to create resources

Method POST

Route /cloud-security-registration-azure/entities/scripts/v1

Scope Cloud Security Azure Registration: WRITE

PEP 8 download_script

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

tenant_id body · string

Azure Tenant ID.

Code Examples

Python

PEP 8

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.download_script(tenant_id="string")
print(response)

Operation ID

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_download_script(tenant_id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "tenant_id": "string"
        }
    ]
}

response = falcon.command("cloud_registration_azure_download_script", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_azure_registration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  tenantId := "string"

  response, err := client.CloudAzureRegistration.CloudRegistrationAzureDownloadScript(
    &cloud_azure_registration.CloudRegistrationAzureDownloadScriptParams{
      Body: &models.AzureAzureDownloadScriptRequestV1{
        Resources: []interface{}{
          {
          Tenantid: &tenantId,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudAzureRegistration.cloudRegistrationAzureDownloadScript(
  {
    resources: [{
        tenantId: "string"
      }]
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::cloud_azure_registration_api::cloud_registration_azure_download_script;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::AzureAzureDownloadScriptRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = AzureAzureDownloadScriptRequestV1 {
        resources: vec![AzureDownloadScriptRequestData {
            tenant_id: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = cloud_registration_azure_download_script(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudAzureRegistration.new

body = Falcon::AzureAzureDownloadScriptRequestV1.new(
  resources: [{
      tenantId: 'string'
    }]
)

response = api.cloud_registration_azure_download_script(body)

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "tenantId": "string",
    "url": "string",
    "version": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

cloud-registration-azure-get-issue-suppression-values-by-field

Retrieve distinct filterable values for issue suppression fields

Method GET

Route /cloud-security-registration-azure/aggregates/issue-suppressions-values-by-fields/v1

Scope Cloud Security Azure Registration: READ

PEP 8 cloud_registration_azure_get_issue_suppression_values_by_field

Parameters

registration_id query · string

Registration ID to filter values by

field query · string

Field to get values for

Available values (5)

issue_name	entity_id	suppressed_by
created_at	reason

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_get_issue_suppression_values_by_field(registration_id="string",
                                                                                 field="string")
print(response)

Operation ID

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_get_issue_suppression_values_by_field(registration_id="string",
                                                                                 field="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("cloud_registration_azure_get_issue_suppression_values_by_field",
                          registration_id="string",
                          field="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_azure_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudAzureRegistration.CloudRegistrationAzureGetIssueSuppressionValuesByField(
    &cloud_azure_registration.CloudRegistrationAzureGetIssueSuppressionValuesByFieldParams{
      RegistrationID: "string",
      Field: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudAzureRegistration.cloudRegistrationAzureGetIssueSuppressionValuesByField(
  "string",  // registrationId
  "string"  // field
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudAzureRegistration.new

response = api.cloud_registration_azure_get_issue_suppression_values_by_field('string', 'string')

puts response

Responses

200 OK

[
  {
    "count": 0,
    "value": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

cloud-registration-azure-get-issue-values-by-field

Retrieve distinct filterable values for issue fields

Method GET

Route /cloud-security-registration-azure/aggregates/issues-values-by-fields/v1

Scope Cloud Security Azure Registration: READ

PEP 8 cloud_registration_azure_get_issue_values_by_field

Parameters

registration_id query · string

Registration ID to filter values by

filter query · string

FQL (Falcon Query Language) string for filtering results. Allowed filters are:

Available values (9)

name	issue	severity
category	impact	entity_type
entity_id	entity_name	status

field query · string

Field to get values for

Available values (10)

issue	name	severity
category	impact	entity_type
entity_id	entity_name	status
feature

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_get_issue_values_by_field(registration_id="string",
                                                                     filter="string",
                                                                     field="string")
print(response)

Operation ID

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_get_issue_values_by_field(registration_id="string",
                                                                     filter="string",
                                                                     field="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("cloud_registration_azure_get_issue_values_by_field",
                          registration_id="string",
                          filter="string",
                          field="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_azure_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.CloudAzureRegistration.CloudRegistrationAzureGetIssueValuesByField(
    &cloud_azure_registration.CloudRegistrationAzureGetIssueValuesByFieldParams{
      RegistrationID: "string",
      Filter: &filter,
      Field: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudAzureRegistration.cloudRegistrationAzureGetIssueValuesByField(
  "string",  // registrationId
  "string",  // field
  "string"  // filter
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudAzureRegistration.new

response = api.cloud_registration_azure_get_issue_values_by_field('string', 'string')

puts response

Responses

200 OK

[
  {
    "count": 0,
    "value": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

cloud-registration-azure-get-issues

Retrieve issues for Azure registrations

Method GET

Route /cloud-security-registration-azure/entities/issues/v1

Scope Cloud Security Azure Registration: READ

PEP 8 cloud_registration_azure_get_issues

Parameters

registration_id query · string

Registration ID

filter query · string

FQL (Falcon Query Language) string for filtering results. Allowed filters are:

Available values (9)

name	issue	severity
category	impact	entity_type
entity_id	entity_name	status

sort query · string

Field and direction for sorting results - allowed sort fields are issue,name,severity,category,impact,entity_type,entity_id,entity_name,impacted_entities

group_by query · string

Grouping method: ‘name’ (optional, default: ungrouped)

Available values (1)

name

limit query · integer

Maximum number of records to return (default: 100, max: 1000)

offset query · integer

Starting index of result

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_get_issues(registration_id="string",
                                                      filter="string",
                                                      sort="string",
                                                      group_by="string",
                                                      limit=integer,
                                                      offset=integer)
print(response)

Operation ID

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_get_issues(registration_id="string",
                                                      filter="string",
                                                      sort="string",
                                                      group_by="string",
                                                      limit=integer,
                                                      offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("cloud_registration_azure_get_issues",
                          registration_id="string",
                          filter="string",
                          sort="string",
                          group_by="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_azure_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  groupBy := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.CloudAzureRegistration.CloudRegistrationAzureGetIssues(
    &cloud_azure_registration.CloudRegistrationAzureGetIssuesParams{
      RegistrationID: "string",
      Filter: &filter,
      Sort: &sort,
      GroupBy: &groupBy,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudAzureRegistration.cloudRegistrationAzureGetIssues(
  "string",  // registrationId
  "string",  // filter
  "string",  // sort
  "string",  // groupBy
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudAzureRegistration.new

response = api.cloud_registration_azure_get_issues('string')

puts response

Responses

200 OK

[
  {
    "category": "string",
    "entity_id": "string",
    "entity_name": "string",
    "entity_type": "string",
    "feature": "string",
    "first_seen": "string",
    "impact": "string",
    "impacted_entities": {},
    "issue": "string",
    "last_seen": "string",
    "name": "string",
    "region": "string",
    "severity": "string",
    "status": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

cloud-registration-azure-get-registration

Retrieve existing Azure registration for a tenant.

Method GET

Route /cloud-security-registration-azure/entities/registrations/v1

Scope Cloud Security Azure Registration: READ

PEP 8 get_registration

Parameters

tenant_id query · string

Tenant ID

registration_id query · string

Registration ID

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.get_registration(tenant_id="string", registration_id="string")
print(response)

Operation ID

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_get_registration(tenant_id="string",
                                                            registration_id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("cloud_registration_azure_get_registration",
                          tenant_id="string",
                          registration_id="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_azure_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  tenantID := "string"
  registrationID := "string"

  response, err := client.CloudAzureRegistration.CloudRegistrationAzureGetRegistration(
    &cloud_azure_registration.CloudRegistrationAzureGetRegistrationParams{
      TenantID: &tenantID,
      RegistrationID: &registrationID,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudAzureRegistration.cloudRegistrationAzureGetRegistration(
  "string",  // tenantId
  "string"  // registrationId
);

console.log(response);

Rust

use rusty_falcon::apis::cloud_azure_registration_api::cloud_registration_azure_get_registration;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = cloud_registration_azure_get_registration(
        &falcon.cfg,  // configuration
        "string",  // tenant_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudAzureRegistration.new

response = api.cloud_registration_azure_get_registration(tenant_id: 'string',
                                                         registration_id: 'string')

puts response

Responses

200 OK

[
  {
    "account_type": "string",
    "additional_features": [],
    "additional_properties": {},
    "admin_consent_url": "string",
    "api_client_key_id": "string",
    "api_client_key_type": "string",
    "app_registration_id": "string",
    "app_registration_name": "string",
    "cid": "string",
    "created": "string",
    "cs_infra_region": "string",
    "cs_infra_subscription_id": "string",
    "cs_infra_subscription_name": "string",
    "deleted": "string",
    "deployment_method": "string",
    "deployment_stack_host_id": "string",
    "deployment_stack_host_region": "string",
    "deployment_stack_host_type": "string",
    "deployment_stack_host_url": "string",
    "deployment_stack_name": "string",
    "dspm_custom_vnet_configuration": {},
    "dspm_host_subscription_id": "string",
    "dspm_network_configuration_type": "string",
    "dspm_regions": [],
    "enterprise_app_url": "string",
    "environment": "string",
    "event_hub_settings": [],
    "key_info": {},
    "last_healthcheck_completed_at": "string",
    "management_group_ids": [],
    "microsoft_graph_permission_ids": [],
    "microsoft_graph_permission_ids_readonly": false,
    "primary_domain": "string",
    "products": [],
    "registration_description": "string",
    "registration_id": "string",
    "registration_name": "string",
    "resource_name_prefix": "string",
    "resource_name_suffix": "string",
    "status": "string",
    "subscription_ids": [],
    "tags": {},
    "template_version": "string",
    "tenant_id": "string",
    "tenant_name": "string",
    "updated": "string",
    "vulnerability_scanning_custom_vnet_configuration": {},
    "vulnerability_scanning_host_subscription_id": "string",
    "vulnerability_scanning_network_configuration_type": "string",
    "vulnerability_scanning_regions": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

cloud-registration-azure-get-script

Download Azure deployment script (Terraform or Bicep)

Method GET

Route /cloud-security-registration-azure/entities/scripts/v1

Scope Cloud Security Azure Registration: READ

PEP 8 cloud_registration_azure_get_script

Parameters

tenant_id query · string

Azure tenant ID

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_get_script(tenant_id="string")
print(response)

Operation ID

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_get_script(tenant_id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("cloud_registration_azure_get_script",
                          tenant_id="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_azure_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudAzureRegistration.CloudRegistrationAzureGetScript(
    &cloud_azure_registration.CloudRegistrationAzureGetScriptParams{
      TenantID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudAzureRegistration.cloudRegistrationAzureGetScript("string");  // tenantId

console.log(response);

Rust

use rusty_falcon::apis::cloud_azure_registration_api::download_azure_script;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = download_azure_script(
        &falcon.cfg,  // configuration
        "string",  // tenant_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudAzureRegistration.new

response = api.cloud_registration_azure_get_script('string')

puts response

Responses

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

cloud-registration-azure-get-script-versions

Retrieve all available script versions with filtering and sorting

Method GET

Route /cloud-security-registration-azure/entities/script-versions/v1

Scope Cloud Security Azure Registration: READ

PEP 8 cloud_registration_azure_get_script_versions

Parameters

deployment_method query · string

Filter by deployment method (e.g., ‘bicep-legacy’, ‘bicep-deployment-stack’)

sort query · string

Field and direction for sorting results - allowed sort fields are version,deployment_method,published_date

limit query · integer

Maximum number of records to return (default: 100, max: 1000)

offset query · integer

Starting index of result

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_get_script_versions(deployment_method="string",
                                                               sort="string",
                                                               limit=integer,
                                                               offset=integer)
print(response)

Operation ID

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_get_script_versions(deployment_method="string",
                                                               sort="string",
                                                               limit=integer,
                                                               offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("cloud_registration_azure_get_script_versions",
                          deployment_method="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_azure_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.CloudAzureRegistration.CloudRegistrationAzureGetScriptVersions(
    &cloud_azure_registration.CloudRegistrationAzureGetScriptVersionsParams{
      DeploymentMethod: "string",
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudAzureRegistration.cloudRegistrationAzureGetScriptVersions(
  "string",  // deploymentMethod
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudAzureRegistration.new

response = api.cloud_registration_azure_get_script_versions('string')

puts response

Responses

200 OK

[
  {
    "deployment_method": "string",
    "download_url": "string",
    "published_date": "string",
    "version": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

cloud-registration-azure-get-suppressions

Retrieve existing suppression rules with filtering

Method GET

Route /cloud-security-registration-azure/entities/issue-suppressions/v1

Scope Cloud Security Azure Registration: READ

PEP 8 cloud_registration_azure_get_suppressions

Parameters

registration_id query · string

Registration ID

filter query · string

FQL (Falcon Query Language) string for filtering results. Allowed filters are:

Available values (5)

issue_name	entity_id	suppressed_by
created_at	reason

sort query · string

Field and direction for sorting results - allowed sort fields are issue_name,entity_id,suppressed_by,created_at,reason

limit query · integer

Maximum number of records to return (default: 100, max: 1000)

offset query · integer

Starting index of result

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_get_suppressions(registration_id="string",
                                                            filter="string",
                                                            sort="string",
                                                            limit=integer,
                                                            offset=integer)
print(response)

Operation ID

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_get_suppressions(registration_id="string",
                                                            filter="string",
                                                            sort="string",
                                                            limit=integer,
                                                            offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("cloud_registration_azure_get_suppressions",
                          registration_id="string",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_azure_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.CloudAzureRegistration.CloudRegistrationAzureGetSuppressions(
    &cloud_azure_registration.CloudRegistrationAzureGetSuppressionsParams{
      RegistrationID: "string",
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudAzureRegistration.cloudRegistrationAzureGetSuppressions(
  "string",  // registrationId
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudAzureRegistration.new

response = api.cloud_registration_azure_get_suppressions('string')

puts response

Responses

200 OK

[
  {
    "category": "string",
    "created_at": "string",
    "entity_id": "string",
    "entity_type": "string",
    "impact": "string",
    "issue_name": "string",
    "reason": "string",
    "registration_id": "string",
    "severity": "string",
    "suppressed_by": "string",
    "suppression_id": "string",
    "type": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

cloud-registration-azure-trigger-health-check

Trigger health check scan for Azure registrations

Method POST

Route /cloud-security-registration-azure/entities/registrations/healthcheck/v1

Scope Cloud Security Azure Registration: READ

PEP 8 health_check

Parameters

tenant_ids query · string or list of strings

Azure tenant IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.health_check(tenant_ids=id_list)
print(response)

Operation ID

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.cloud_registration_azure_trigger_health_check(tenant_ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("cloud_registration_azure_trigger_health_check",
                          tenant_ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_azure_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudAzureRegistration.CloudRegistrationAzureTriggerHealthCheck(
    &cloud_azure_registration.CloudRegistrationAzureTriggerHealthCheckParams{
      TenantIds: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudAzureRegistration.cloudRegistrationAzureTriggerHealthCheck(["ID1", "ID2", "ID3"]);  // tenantIds

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudAzureRegistration.new

response = api.cloud_registration_azure_trigger_health_check(tenant_ids: ['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "tenant_id": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

cloud-registration-azure-update-registration

Update an existing Azure registration for a tenant.

Method PATCH

Route /cloud-security-registration-azure/entities/registrations/v1

Scope Cloud Security Azure Registration: WRITE

PEP 8 update_registration

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resource body · object

account_type body · string

Azure account type.

additional_features body · list of dictionaries

Additional features.

additional_properties body · dictionary

Additional properties.

api_client_key_id body · string

Azure API client key ID.

api_client_key_type body · string

Azure API client key type.

cs_infra_region body · string

CrowdStrike infrastructure region.

cs_infra_subscription_id body · string

CrowdStrike infrastructure subscription ID.

deployment_method body · string

Deployment method.

deployment_stack_host_id body · string

Azure deployment stack host ID.

deployment_stack_name body · string

Azure deployment stack name.

dspm_regions body · string or list of strings

DSPM regions.

environment body · string

Azure environment.

event_hub_settings body · list of dictionaries

Azure Event Hub settings.

management_group_ids body · string or list of strings

Azure management group IDs.

microsoft_graph_permission_ids body · string or list of strings

Microsoft Graph permission IDs.

microsoft_graph_permissions_ids_readonly body · boolean

Flag indicating if Microsoft Graph permission IDs are read-only.

products body · list of dictionaries

Products.

resource_name_prefix body · string

Resource naming prefix.

resource_name_suffix body · string

Resource naming suffix.

status body · string

Registration status.

subscription_ids body · string or list of strings

Azure subscription IDs.

tags body · dictionary

Additional tags.

template_version body · string

Deployment template version.

tenant_id body · string

Azure tenant ID.

Code Examples

Python

PEP 8

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

additional_features = [
    {
        "feature": "string",
        "product": "string",
        "subscription_ids": [
            "string"
        ]
    }
]

additional_properties = {}

event_hub_settings = [
    {
        "cid": "string",
        "consumer_group": "string",
        "event_hub_id": "string",
        "purpose": "string",
        "tenant_id": "string"
    }
]

products = [
    {
        "features": [
            "string"
        ],
        "product": "string"
    }
]

tags = {
    "additionalProp1": "string",
    "additionalProp2": "string",
    "additionalProp3": "string"
}

response = falcon.update_registration(account_type="string",
                                      additional_features=additional_features,
                                      additional_properties=additional_properties,
                                      api_client_key_id="string",
                                      api_client_key_type="string",
                                      cs_infra_region="string",
                                      cs_infra_subscription_id="string",
                                      deployment_method="string",
                                      deployment_stack_host_id="string",
                                      deployment_stack_name="string",
                                      dspm_regions=id_list,
                                      environment="string",
                                      event_hub_settings=event_hub_settings,
                                      management_group_ids=id_list,
                                      microsoft_graph_permission_ids=id_list,
                                      microsoft_graph_permissions_ids_readonly=boolean,
                                      products=products,
                                      resource_name_prefix="string",
                                      resource_name_suffix="string",
                                      status="string",
                                      subscription_ids=id_list,
                                      tags=tags,
                                      template_version="string",
                                      tenant_id="string")
print(response)

Operation ID

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

additional_features = [
    {
        "feature": "string",
        "product": "string",
        "subscription_ids": [
            "string"
        ]
    }
]

additional_properties = {}

event_hub_settings = [
    {
        "cid": "string",
        "consumer_group": "string",
        "event_hub_id": "string",
        "purpose": "string",
        "tenant_id": "string"
    }
]

products = [
    {
        "features": [
            "string"
        ],
        "product": "string"
    }
]

tags = {
    "additionalProp1": "string",
    "additionalProp2": "string",
    "additionalProp3": "string"
}

response = falcon.cloud_registration_azure_update_registration(account_type="string",
                                                               additional_features=additional_features,
                                                               additional_properties=additional_properties,
                                                               api_client_key_id="string",
                                                               api_client_key_type="string",
                                                               cs_infra_region="string",
                                                               cs_infra_subscription_id="string",
                                                               deployment_method="string",
                                                               deployment_stack_host_id="string",
                                                               deployment_stack_name="string",
                                                               dspm_regions=id_list,
                                                               environment="string",
                                                               event_hub_settings=event_hub_settings,
                                                               management_group_ids=id_list,
                                                               microsoft_graph_permission_ids=id_list,
                                                               microsoft_graph_permissions_ids_readonly=boolean,
                                                               products=products,
                                                               resource_name_prefix="string",
                                                               resource_name_suffix="string",
                                                               status="string",
                                                               subscription_ids=id_list,
                                                               tags=tags,
                                                               template_version="string",
                                                               tenant_id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "resource": {
        "account_type": "string",
        "additional_features": [
            {
                "feature": "string",
                "product": "string",
                "subscription_ids": ["string"]
            }
        ],
        "additional_properties": {},
        "api_client_key_id": "string",
        "api_client_key_type": "string",
        "cs_infra_region": "string",
        "cs_infra_subscription_id": "string",
        "cs_infra_subscription_name": "string",
        "deployment_method": "string",
        "deployment_stack_host_id": "string",
        "deployment_stack_host_region": "string",
        "deployment_stack_name": "string",
        "dspm_custom_vnet_configuration": {},
        "dspm_host_subscription_id": "string",
        "dspm_network_configuration_type": "string",
        "dspm_regions": ["string"],
        "environment": "string",
        "event_hub_settings": [
            {
                "cid": "string",
                "consumer_group": "string",
                "event_hub_id": "string",
                "management_type": "string",
                "purpose": "string",
                "tenant_id": "string"
            }
        ],
        "management_group_ids": ["string"],
        "microsoft_graph_permission_ids": ["string"],
        "microsoft_graph_permission_ids_readonly": boolean,
        "primary_domain": "string",
        "products": [
            {
                "features": ["string"],
                "product": "string"
            }
        ],
        "registration_description": "string",
        "registration_id": "string",
        "registration_name": "string",
        "resource_name_prefix": "string",
        "resource_name_suffix": "string",
        "status": "string",
        "subscription_ids": ["string"],
        "tags": {},
        "template_version": "string",
        "tenant_id": "string",
        "tenant_name": "string",
        "vulnerability_scanning_custom_vnet_configuration": {},
        "vulnerability_scanning_host_subscription_id": "string",
        "vulnerability_scanning_network_configuration_type": "string",
        "vulnerability_scanning_regions": ["string"]
    }
}

response = falcon.command("cloud_registration_azure_update_registration", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_azure_registration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudAzureRegistration.CloudRegistrationAzureUpdateRegistration(
    &cloud_azure_registration.CloudRegistrationAzureUpdateRegistrationParams{
      Body: &models.AzureAzureRegistrationUpdateRequestExtV1{
        Resource: &struct{}{},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudAzureRegistration.cloudRegistrationAzureUpdateRegistration(
  {
    resource: {
      accountType: "string",
      additionalFeatures: [{
          feature: "string",
          product: "string",
          subscriptionIds: []
        }],
      additionalProperties: {},
      apiClientKeyId: "string",
      apiClientKeyType: "string",
      csInfraRegion: "string",
      csInfraSubscriptionId: "string",
      csInfraSubscriptionName: "string",
      deploymentMethod: "string",
      deploymentStackHostId: "string",
      deploymentStackHostRegion: "string",
      deploymentStackName: "string",
      dspmCustomVnetConfiguration: {},
      dspmHostSubscriptionId: "string",
      dspmNetworkConfigurationType: "string",
      dspmRegions: [],
      environment: "string",
      eventHubSettings: [{
          cid: "string",
          consumerGroup: "string",
          eventHubId: "string",
          managementType: "string",
          purpose: "string",
          tenantId: "string"
        }],
      managementGroupIds: [],
      microsoftGraphPermissionIds: [],
      microsoftGraphPermissionIdsReadonly: boolean,
      primaryDomain: "string",
      products: [{
          features: [],
          product: "string"
        }],
      registrationDescription: "string",
      registrationId: "string",
      registrationName: "string",
      resourceNamePrefix: "string",
      resourceNameSuffix: "string",
      status: "string",
      subscriptionIds: [],
      tags: {},
      templateVersion: "string",
      tenantId: "string",
      tenantName: "string",
      vulnerabilityScanningCustomVnetConfiguration: {},
      vulnerabilityScanningHostSubscriptionId: "string",
      vulnerabilityScanningNetworkConfigurationType: "string",
      vulnerabilityScanningRegions: []
    }
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::cloud_azure_registration_api::cloud_registration_azure_update_registration;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::AzureAzureRegistrationUpdateRequestExtV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = AzureAzureRegistrationUpdateRequestExtV1 {
        resource: Default::default(),
        ..Default::default()
    };

    let response = cloud_registration_azure_update_registration(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudAzureRegistration.new

body = Falcon::AzureAzureRegistrationUpdateRequestExtV1.new(
  resource: {
    account_type: 'string',
    additional_features: [{
        feature: 'string',
        product: 'string',
        subscription_ids: []
      }],
    additional_properties: {},
    api_client_key_id: 'string',
    api_client_key_type: 'string',
    cs_infra_region: 'string',
    cs_infra_subscription_id: 'string',
    cs_infra_subscription_name: 'string',
    deployment_method: 'string',
    deployment_stack_host_id: 'string',
    deployment_stack_host_region: 'string',
    deployment_stack_name: 'string',
    dspm_custom_vnet_configuration: {},
    dspm_host_subscription_id: 'string',
    dspm_network_configuration_type: 'string',
    dspm_regions: [],
    environment: 'string',
    event_hub_settings: [{
        cid: 'string',
        consumer_group: 'string',
        event_hub_id: 'string',
        management_type: 'string',
        purpose: 'string',
        tenant_id: 'string'
      }],
    management_group_ids: [],
    microsoft_graph_permission_ids: [],
    microsoft_graph_permission_ids_readonly: boolean,
    primary_domain: 'string',
    products: [{
        features: [],
        product: 'string'
      }],
    registration_description: 'string',
    registration_id: 'string',
    registration_name: 'string',
    resource_name_prefix: 'string',
    resource_name_suffix: 'string',
    status: 'string',
    subscription_ids: [],
    tags: {},
    template_version: 'string',
    tenant_id: 'string',
    tenant_name: 'string',
    vulnerability_scanning_custom_vnet_configuration: {},
    vulnerability_scanning_host_subscription_id: 'string',
    vulnerability_scanning_network_configuration_type: 'string',
    vulnerability_scanning_regions: []
  }
)

response = api.cloud_registration_azure_update_registration(body)

puts response

Responses

200 OK

[
  {
    "account_type": "string",
    "additional_features": [],
    "additional_properties": {},
    "admin_consent_url": "string",
    "api_client_key_id": "string",
    "api_client_key_type": "string",
    "app_registration_id": "string",
    "app_registration_name": "string",
    "cid": "string",
    "created": "string",
    "cs_infra_region": "string",
    "cs_infra_subscription_id": "string",
    "cs_infra_subscription_name": "string",
    "deleted": "string",
    "deployment_method": "string",
    "deployment_stack_host_id": "string",
    "deployment_stack_host_region": "string",
    "deployment_stack_host_type": "string",
    "deployment_stack_host_url": "string",
    "deployment_stack_name": "string",
    "dspm_custom_vnet_configuration": {},
    "dspm_host_subscription_id": "string",
    "dspm_network_configuration_type": "string",
    "dspm_regions": [],
    "enterprise_app_url": "string",
    "environment": "string",
    "event_hub_settings": [],
    "key_info": {},
    "last_healthcheck_completed_at": "string",
    "management_group_ids": [],
    "microsoft_graph_permission_ids": [],
    "microsoft_graph_permission_ids_readonly": false,
    "primary_domain": "string",
    "products": [],
    "registration_description": "string",
    "registration_id": "string",
    "registration_name": "string",
    "resource_name_prefix": "string",
    "resource_name_suffix": "string",
    "status": "string",
    "subscription_ids": [],
    "tags": {},
    "template_version": "string",
    "tenant_id": "string",
    "tenant_name": "string",
    "updated": "string",
    "vulnerability_scanning_custom_vnet_configuration": {},
    "vulnerability_scanning_host_subscription_id": "string",
    "vulnerability_scanning_network_configuration_type": "string",
    "vulnerability_scanning_regions": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

409 Conflict

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

cloud-registration-azure-update-suppressions

Update existing suppression rules

Method PATCH

Route /cloud-security-registration-azure/entities/issue-suppressions/v1

Scope Cloud Security Azure Registration: WRITE

PEP 8 cloud_registration_azure_update_suppressions

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

The resources value.

Code Examples

Python

PEP 8

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_update_suppressions(resources=["string"])
print(response)

Operation ID

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_update_suppressions(resources=["string"])
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "reason": "string",
            "suppression_id": "string"
        }
    ]
}

response = falcon.command("cloud_registration_azure_update_suppressions", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_azure_registration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  reason := "string"
  suppression_id := "string"

  response, err := client.CloudAzureRegistration.CloudRegistrationAzureUpdateSuppressions(
    &cloud_azure_registration.CloudRegistrationAzureUpdateSuppressionsParams{
      Body: &models.AzureSuppressionUpdateRequest{
        Resources: []interface{}{
          {
          Reason: &reason,
          SuppressionID: &suppression_id,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudAzureRegistration.cloudRegistrationAzureUpdateSuppressions(
  {
    resources: [{
        reason: "string",
        suppressionId: "string"
      }]
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudAzureRegistration.new

body = Falcon::AzureSuppressionUpdateRequest.new(
  resources: [{
      reason: 'string',
      suppression_id: 'string'
    }]
)

response = api.cloud_registration_azure_update_suppressions(body)

puts response

Responses

200 OK

[
  {
    "category": "string",
    "created_at": "string",
    "entity_id": "string",
    "entity_type": "string",
    "impact": "string",
    "issue_name": "string",
    "reason": "string",
    "registration_id": "string",
    "severity": "string",
    "suppressed_by": "string",
    "suppression_id": "string",
    "type": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

cloud-registration-azure-validate-registration

Validate an Azure registration by checking service principal, role assignments and deployment stack (if the deployment method is Bicep)

Method POST

Route /cloud-security-registration-azure/entities/registrations/validate/v1

Scope Cloud Security Azure Registration: READ

PEP 8 validate_registration

Parameters

tenant_id query · string

Azure tenant ID to be validated

stack_name query · string

Azure deployment stack name to be validated

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.validate_registration(tenant_id="string", stack_name="string")
print(response)

Operation ID

from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_validate_registration(tenant_id="string",
                                                                 stack_name="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("cloud_registration_azure_validate_registration",
                          tenant_id="string",
                          stack_name="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_azure_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  stackName := "string"

  response, err := client.CloudAzureRegistration.CloudRegistrationAzureValidateRegistration(
    &cloud_azure_registration.CloudRegistrationAzureValidateRegistrationParams{
      TenantID: "string",
      StackName: &stackName,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudAzureRegistration.cloudRegistrationAzureValidateRegistration(
  "string",  // tenantId
  "string"  // stackName
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudAzureRegistration.new

response = api.cloud_registration_azure_validate_registration('string')

puts response

Responses

200 OK

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}