Cloud Policies

The Cloud Policies service collection provides operations for managing cloud security policies, compliance frameworks and controls, rules, rule overrides, enriched assets, evaluation results, and suppression rules across cloud environments.

Language	Last Update
Python	v1.5.5
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

Operation	Description
GetRuleInputSchema `get_rule_input_schema`	Get rule input schema for given resource type.
ReplaceControlRules `replace_control_rules`	Assign rules to a compliance control (full replace).
GetComplianceControls `get_compliance_controls`	Get compliance controls by ID.
CreateComplianceControl `create_compliance_control`	Create a new custom compliance control.
UpdateComplianceControl `update_compliance_control`	Update a custom compliance control.
DeleteComplianceControl `delete_compliance_control`	Delete custom compliance controls.
QueryComplianceControls `query_compliance_controls`	Query for compliance controls by various parameters.
GetRule `get_rule`	Get a rule by id.
RenameSectionComplianceFramework `rename_section_compliance_framework`	Rename a section in a custom compliance framework.
GetComplianceFrameworks `get_compliance_frameworks`	Get compliance frameworks by ID.
CreateComplianceFramework `create_compliance_framework`	Create a new custom compliance framework.
UpdateComplianceFramework `update_compliance_framework`	Update a custom compliance framework.
DeleteComplianceFramework `delete_compliance_framework`	Delete a custom compliance framework and all associated controls and rule assignments.
GetEnrichedAsset `get_enriched_asset`	Get enriched assets that combine a primary resource with all its related resources.
GetEvaluationResult `get_evaluation_result`	Get evaluation results based on the provided rule.
GetRuleOverride `get_rule_override`	Get a rule override by ID.
CreateRuleOverride `create_rule_override`	Create a new rule override.
UpdateRuleOverride `update_rule_override`	Update a rule override.
DeleteRuleOverride `delete_rule_override`	Delete a rule override.
CreateRuleMixin0 `create_rule`	Create a new rule.
UpdateRule `update_rule`	Update a rule.
DeleteRuleMixin0 `delete_rule`	Delete a rule.
QueryComplianceFrameworks `query_compliance_frameworks`	Query for compliance frameworks by various parameters.
QueryRule `query_rule`	Query for rules by various parameters.
GetSuppressionRules `get_suppression_rules`	Get Suppression Rules by ID.
CreateSuppressionRule `create_suppression_rule`	Create a new suppression rule.
UpdateSuppressionRule `update_suppression_rule`	Update a suppression rule.
DeleteSuppressionRules `delete_suppression_rules`	Delete Suppression Rules by ID.
QuerySuppressionRules `query_suppression_rules`	Query suppression rules with filtering, sorting and pagination.

GetRuleInputSchema

Get rule input schema for given resource type.

GET /cloud-policies/combined/rules/input-schema/v1

Scope Cloud Security Policies: READ Consumes · Produces application/json

PEP 8 get_rule_input_schema

Parameters

Name	Type	Data type	Description
domain	query	string	Domain.
subdomain	query	string	Subdomain.
cloud_provider	query	string	Cloud service provider for the resource type. Allowed values: `aws`, `azure`, `gcp`, `oci`.
resource_type	query	string	Selects the resource type for which to retrieve the rule input schema.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.get_rule_input_schema(domain="string",
                                        subdomain="string",
                                        cloud_provider="string",
                                        resource_type="string")
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.GetRuleInputSchema(domain="string",
                                     subdomain="string",
                                     cloud_provider="string",
                                     resource_type="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetRuleInputSchema",
                          domain="string",
                          subdomain="string",
                          cloud_provider="string",
                          resource_type="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cloudProvider := "string"

  response, err := client.CloudPolicies.GetRuleInputSchema(
    &cloud_policies.GetRuleInputSchemaParams{
      Domain: "string",
      Subdomain: "string",
      CloudProvider: &cloudProvider,
      ResourceType: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.getRuleInputSchema(
  "string",  // domain
  "string",  // subdomain
  "string",  // resourceType
  "string"  // cloudProvider
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.get_rule_input_schema('string', 'string', 'string')

puts response

ReplaceControlRules

Assign rules to a compliance control (full replace).

PUT /cloud-policies/entities/compliance/control-rule-assignments/v1

Scope Cloud Security Policies: WRITE Consumes · Produces application/json

PEP 8 replace_control_rules

Parameters

Name	Type	Data type	Description
ids	query	string	The UUID of the compliance control to assign rules to.
rule_ids	body	list of strings	The Rule ID.
body	body	dictionary	Full body payload in JSON format.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.replace_control_rules(ids=id_list, rule_ids=id_list)
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ReplaceControlRules(ids=id_list, rule_ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "rule_ids": ["string"]
}

response = falcon.command("ReplaceControlRules",
                          ids="string",
                          body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudPolicies.ReplaceControlRules(
    &cloud_policies.ReplaceControlRulesParams{
      Body: &models.CommonAssignRulesToControlRequest{
        RuleIds: []string{"string"},
      },
      Ids: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.replaceControlRules(
  "string",  // ids
  {  // body
      ruleIds: []
  }
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

body = Falcon::CommonAssignRulesToControlRequest.new(
  rule_ids: []
)

response = api.replace_control_rules(body, 'string')

puts response

GetComplianceControls

Get compliance controls by ID.

GET /cloud-policies/entities/compliance/controls/v1

Scope Cloud Security Policies: READ Consumes · Produces application/json

PEP 8 get_compliance_controls

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The uuids of compliance controls to retrieve.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_compliance_controls(ids=id_list)
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetComplianceControls(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetComplianceControls",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudPolicies.GetComplianceControls(
    &cloud_policies.GetComplianceControlsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.getComplianceControls(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::cloud_policies_api::get_compliance_controls;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_compliance_controls(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.get_compliance_controls(['ID1', 'ID2', 'ID3'])

puts response

CreateComplianceControl

Create a new custom compliance control.

POST /cloud-policies/entities/compliance/controls/v1

Scope Cloud Security Policies: WRITE Consumes · Produces application/json

PEP 8 create_compliance_control

Parameters

Name	Type	Data type	Description
description	body	string	The description of hte custom compliance control.
name	body	string	The name of the custom compliance control.
framework_id	body	string	The framework ID of the custom compliance control.
section_name	body	string	The section name of the custom compliance control.
body	body	dictionary	Full body payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.create_compliance_control(description="string",
                                            framework_id="string",
                                            name="string",
                                            section_name="string")
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.CreateComplianceControl(description="string",
                                          framework_id="string",
                                          name="string",
                                          section_name="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "framework_id": "string",
    "name": "string",
    "section_name": "string"
}

response = falcon.command("CreateComplianceControl", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  framework_id := "string"
  name := "string"
  section_name := "string"

  response, err := client.CloudPolicies.CreateComplianceControl(
    &cloud_policies.CreateComplianceControlParams{
      Body: &models.CommonCreateComplianceControlRequest{
        Description: &description,
        FrameworkID: &framework_id,
        Name: &name,
        SectionName: &section_name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.createComplianceControl(
  {
    description: "string",
    frameworkId: "string",
    name: "string",
    sectionName: "string"
}  // body
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

body = Falcon::CommonCreateComplianceControlRequest.new(
  description: 'string',
  framework_id: 'string',
  name: 'string',
  section_name: 'string'
)

response = api.create_compliance_control(body)

puts response

UpdateComplianceControl

Update a custom compliance control.

PATCH /cloud-policies/entities/compliance/controls/v1

Scope Cloud Security Policies: WRITE Consumes · Produces application/json

PEP 8 update_compliance_control

Parameters

Name	Type	Data type	Description
ids	query	string	The uuid of compliance control to update.
description	body	string	The description of hte custom compliance control.
name	body	string	The name of the custom compliance control.
body	body	dictionary	Full body payload in JSON format.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_compliance_control(ids=id_list,
                                            description="string",
                                            name="string")
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.UpdateComplianceControl(ids=id_list,
                                          description="string",
                                          name="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "description": "string",
    "name": "string"
}

response = falcon.command("UpdateComplianceControl",
                          ids="string",
                          body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  name := "string"

  response, err := client.CloudPolicies.UpdateComplianceControl(
    &cloud_policies.UpdateComplianceControlParams{
      Body: &models.CommonUpdateComplianceControlRequest{
        Description: &description,
        Name: &name,
      },
      Ids: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.updateComplianceControl(
  "string",  // ids
  {  // body
      description: "string",
      name: "string"
  }
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

body = Falcon::CommonUpdateComplianceControlRequest.new(
  description: 'string',
  name: 'string'
)

response = api.update_compliance_control(body, 'string')

puts response

DeleteComplianceControl

Delete custom compliance controls.

DELETE /cloud-policies/entities/compliance/controls/v1

Scope Cloud Security Policies: WRITE Consumes · Produces application/json

PEP 8 delete_compliance_control

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The uuids of compliance control to delete.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_compliance_control(ids=id_list)
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteComplianceControl(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteComplianceControl",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudPolicies.DeleteComplianceControl(
    &cloud_policies.DeleteComplianceControlParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.deleteComplianceControl(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.delete_compliance_control(['ID1', 'ID2', 'ID3'])

puts response

QueryComplianceControls

Query for compliance controls by various parameters.

GET /cloud-policies/queries/compliance/controls/v1

Scope Cloud Security Policies: READ Consumes · Produces application/json

PEP 8 query_compliance_controls

Parameters

Name	Type	Data type	Description
filter	query	string	FQL filter, allowed props: `compliance_control_name`, `compliance_control_authority`, `compliance_control_type`, `compliance_control_section`, `compliance_control_requirement`, `compliance_control_benchmark_name`, `compliance_control_benchmark_version`.
limit	query	integer	The maximum number of resources to return. The maximum allowed is 500. Default: 100.
offset	query	integer	The number of results to skip before starting to return results. Default: 0.
sort	query	string	Field to sort on. Sortable fields: `compliance_control_name`, `compliance_control_authority`, `compliance_control_type`, `compliance_control_section`, `compliance_control_requirement`, `compliance_control_benchmark_name`, `compliance_control_benchmark_version`. Use the \|asc or \|desc suffix to specify sort direction.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.query_compliance_controls(filter="string",
                                            limit=integer,
                                            offset=integer,
                                            sort="string")
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.QueryComplianceControls(filter="string",
                                          limit=integer,
                                          offset=integer,
                                          sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryComplianceControls",
                          filter="string",
                          limit=integer,
                          offset=integer,
                          sort="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)
  sort := "string"

  response, err := client.CloudPolicies.QueryComplianceControls(
    &cloud_policies.QueryComplianceControlsParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.queryComplianceControls(
  "string",  // filter
  integer,  // limit
  integer,  // offset
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::cloud_policies_api::query_compliance_controls;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_compliance_controls(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.query_compliance_controls(filter: 'string',
                                         limit: integer,
                                         offset: integer,
                                         sort: 'string')

puts response

GetRule

Get a rule by id.

GET /cloud-policies/entities/rules/v1

Scope Cloud Security Policies: READ Consumes · Produces application/json

PEP 8 get_rule

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The uuids of rules to retrieve.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rule(ids=id_list)
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetRule(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetRule",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudPolicies.GetRule(
    &cloud_policies.GetRuleParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.getRule(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::cloud_policies_api::get_rule;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_rule(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.get_rule(['ID1', 'ID2', 'ID3'])

puts response

RenameSectionComplianceFramework

Rename a section in a custom compliance framework.

PATCH /cloud-policies/entities/compliance/frameworks/section/v1

Scope Cloud Security Policies: WRITE Consumes · Produces application/json

PEP 8 rename_section_compliance_framework

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The uuid of compliance framework containing the section to rename.
sectionName	query	string	The current name of the section to rename.
section_name	body	string	The new section name of the custom compliance control.
body	body	dictionary	Full body payload in JSON format.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.rename_section_compliance_framework(ids=id_list,
                                                      sectionName="string",
                                                      section_name="string")
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RenameSectionComplianceFramework(ids=id_list,
                                                   sectionName="string",
                                                   section_name="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "section_name": "string"
}

response = falcon.command("RenameSectionComplianceFramework",
                          ids="string",
                          section_name="string",
                          body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  section_name := "string"

  response, err := client.CloudPolicies.RenameSectionComplianceFramework(
    &cloud_policies.RenameSectionComplianceFrameworkParams{
      Body: &models.CommonRenameSectionRequest{
        SectionName: &section_name,
      },
      Ids: "string",
      SectionName: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.renameSectionComplianceFramework(
  "string",  // ids
  "string",  // sectionName
  {  // body
      sectionName: "string"
  }
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

body = Falcon::CommonRenameSectionRequest.new(
  section_name: 'string'
)

response = api.rename_section_compliance_framework(body, 'string', 'string')

puts response

GetComplianceFrameworks

Get compliance frameworks by ID.

GET /cloud-policies/entities/compliance/frameworks/v1

Scope Cloud Security Policies: READ Consumes · Produces application/json

PEP 8 get_compliance_frameworks

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The uuids of compliance frameworks to retrieve.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_compliance_frameworks(ids=id_list)
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetComplianceFrameworks(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetComplianceFrameworks",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudPolicies.GetComplianceFrameworks(
    &cloud_policies.GetComplianceFrameworksParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.getComplianceFrameworks(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::cloud_policies_api::get_compliance_frameworks;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_compliance_frameworks(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.get_compliance_frameworks(['ID1', 'ID2', 'ID3'])

puts response

CreateComplianceFramework

Create a new custom compliance framework.

POST /cloud-policies/entities/compliance/frameworks/v1

Scope Cloud Security Policies: WRITE Consumes · Produces application/json

PEP 8 create_compliance_framework

Parameters

Name	Type	Data type	Description
active	body	boolean	Value to determine if the compliance framework will be active.
description	body	string	The description of the new compliance framework.
name	body	string	The name of the new compliance framework.
body	body	dictionary	Full body payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.create_compliance_framework(active=boolean,
                                              description="string",
                                              name="string")
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.CreateComplianceFramework(active=boolean,
                                            description="string",
                                            name="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "active": boolean,
    "description": "string",
    "name": "string"
}

response = falcon.command("CreateComplianceFramework", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  active := boolean
  description := "string"
  name := "string"

  response, err := client.CloudPolicies.CreateComplianceFramework(
    &cloud_policies.CreateComplianceFrameworkParams{
      Body: &models.CommonCreateComplianceFrameworkRequest{
        Active: &active,
        Description: &description,
        Name: &name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.createComplianceFramework(
  {
    active: boolean,
    description: "string",
    name: "string"
}  // body
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

body = Falcon::CommonCreateComplianceFrameworkRequest.new(
  active: boolean,
  description: 'string',
  name: 'string'
)

response = api.create_compliance_framework(body)

puts response

UpdateComplianceFramework

Update a custom compliance framework.

PATCH /cloud-policies/entities/compliance/frameworks/v1

Scope Cloud Security Policies: WRITE Consumes · Produces application/json

PEP 8 update_compliance_framework

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The uuids of compliance framework to update.
active	body	boolean	Value to determine if the compliance framework will be active.
description	body	string	The description of the new compliance framework.
name	body	string	The name of the new compliance framework.
body	body	dictionary	Full body payload in JSON format.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_compliance_framework(ids=id_list,
                                              active=boolean,
                                              description="string",
                                              name="string")
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.UpdateComplianceFramework(ids=id_list,
                                            active=boolean,
                                            description="string",
                                            name="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "active": boolean,
    "description": "string",
    "name": "string"
}

response = falcon.command("UpdateComplianceFramework",
                          ids="string",
                          body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  active := boolean
  description := "string"
  name := "string"

  response, err := client.CloudPolicies.UpdateComplianceFramework(
    &cloud_policies.UpdateComplianceFrameworkParams{
      Body: &models.CommonUpdateComplianceFrameworkRequest{
        Active: &active,
        Description: &description,
        Name: &name,
      },
      Ids: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.updateComplianceFramework(
  "string",  // ids
  {  // body
      active: boolean,
      description: "string",
      name: "string"
  }
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

body = Falcon::CommonUpdateComplianceFrameworkRequest.new(
  active: boolean,
  description: 'string',
  name: 'string'
)

response = api.update_compliance_framework(body, 'string')

puts response

DeleteComplianceFramework

Delete a custom compliance framework and all associated controls and rule assignments.

DELETE /cloud-policies/entities/compliance/frameworks/v1

Scope Cloud Security Policies: WRITE Consumes · Produces application/json

PEP 8 delete_compliance_framework

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The uuids of compliance framework to delete.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_compliance_framework(ids=id_list)
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteComplianceFramework(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteComplianceFramework",
                          ids="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudPolicies.DeleteComplianceFramework(
    &cloud_policies.DeleteComplianceFrameworkParams{
      Ids: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.deleteComplianceFramework("string");  // ids

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.delete_compliance_framework('string')

puts response

GetEnrichedAsset

Get enriched assets that combine a primary resource with all its related resources.

GET /cloud-policies/entities/enriched-resources/v1

Scope Cloud Security Policies: READ Consumes · Produces application/json

PEP 8 get_enriched_asset

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	List of asset IDs (maximum 100 IDs allowed).
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_enriched_asset(ids=id_list)
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetEnrichedAsset(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetEnrichedAsset",
                          ids=id_list,
                          domain="string",
                          subdomain="string",
                          resource_type="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  domain := "string"
  subdomain := "string"
  resourceType := "string"

  response, err := client.CloudPolicies.GetEnrichedAsset(
    &cloud_policies.GetEnrichedAssetParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Domain: &domain,
      Subdomain: &subdomain,
      ResourceType: &resourceType,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.getEnrichedAsset(
  ["ID1", "ID2", "ID3"],  // ids
  "string",  // domain
  "string",  // subdomain
  "string"  // resourceType
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.get_enriched_asset(ids: ['ID1', 'ID2', 'ID3'],
                                  domain: 'string',
                                  subdomain: 'string',
                                  resource_type: 'string')

puts response

GetEvaluationResult

Get evaluation results based on the provided rule.

POST /cloud-policies/entities/evaluation/v1

Scope Cloud Security Policies: READ Consumes · Produces application/json

PEP 8 get_evaluation_result

Parameters

Name	Type	Data type	Description
cloud_provider	query	string	Cloud Service Provider of the provided IDs.
resource_type	query	string	Resource Type of the provided IDs.
ids	query	string or list of strings	List of assets to evaluate (maximum 100 IDs allowed).
input	body	dictionary	The input for the provided rule.
logic	body	string	The logic of the provided rule.
body	body	dictionary	Full body payload in JSON format.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

input = {}

response = falcon.get_evaluation_result(cloud_provider=id_list,
                                        resource_type="string",
                                        ids=id_list,
                                        input=input)
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

input = {}

response = falcon.GetEvaluationResult(cloud_provider=id_list,
                                      resource_type="string",
                                      ids=id_list,
                                      input=input)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "domain": "string",
    "input": {},
    "logic": "string",
    "subdomain": "string"
}

response = falcon.command("GetEvaluationResult",
                          cloud_provider="string",
                          resource_type="string",
                          ids=id_list,
                          body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  domain := "string"
  logic := "string"
  subdomain := "string"
  cloudProvider := "string"
  resourceType := "string"

  response, err := client.CloudPolicies.GetEvaluationResult(
    &cloud_policies.GetEvaluationResultParams{
      Body: &models.CommonEvaluationRequestPayload{
        Domain: &domain,
        Input: &struct{}{},
        Logic: &logic,
        Subdomain: &subdomain,
      },
      CloudProvider: &cloudProvider,
      ResourceType: &resourceType,
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.getEvaluationResult(
  {  // body
      domain: "string",
      input: {},
      logic: "string",
      subdomain: "string"
  },
  "string",  // cloudProvider
  "string",  // resourceType
  ["ID1", "ID2", "ID3"]  // ids
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

body = Falcon::CommonEvaluationRequestPayload.new(
  domain: 'string',
  input: {},
  logic: 'string',
  subdomain: 'string'
)

response = api.get_evaluation_result(body)

puts response

GetRuleOverride

Get a rule override by ID.

GET /cloud-policies/entities/rule-overrides/v1

Scope Cloud Security Policies: READ Consumes · Produces application/json

PEP 8 get_rule_override

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The uuids of rule overrides to retrieve.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rule_override(ids=id_list)
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetRuleOverride(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetRuleOverride",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudPolicies.GetRuleOverride(
    &cloud_policies.GetRuleOverrideParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.getRuleOverride(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::cloud_policies_api::get_rule_override;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_rule_override(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.get_rule_override(['ID1', 'ID2', 'ID3'])

puts response

CreateRuleOverride

Create a new rule override.

POST /cloud-policies/entities/rule-overrides/v1

Scope Cloud Security Policies: WRITE Consumes · Produces application/json

PEP 8 create_rule_override

Parameters

Name	Type	Data type	Description
overrides	body	list of dictionaries	The new rule override.
body	body	dictionary	Full body payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.create_rule_override(overrides=id_list)
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.CreateRuleOverride(overrides=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "overrides": [
        {
            "comment": "string",
            "crn": "string",
            "expires_at": "string",
            "override_type": "string",
            "overrides_details": "string",
            "reason": "string",
            "rule_id": "string",
            "target_region": "string"
        }
    ]
}

response = falcon.command("CreateRuleOverride", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  crn := "string"
  expires_at := "string"
  override_type := "string"
  overrides_details := "string"
  reason := "string"
  rule_id := "string"
  target_region := "string"

  response, err := client.CloudPolicies.CreateRuleOverride(
    &cloud_policies.CreateRuleOverrideParams{
      Body: &models.CommonCreateRuleOverrideRequest{
        Overrides: []interface{}{
          {
          Comment: &comment,
          Crn: &crn,
          ExpiresAt: &expires_at,
          OverrideType: &override_type,
          OverridesDetails: &overrides_details,
          Reason: &reason,
          RuleID: &rule_id,
          TargetRegion: &target_region,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.createRuleOverride(
  {
    overrides: [{
        comment: "string",
        crn: "string",
        expiresAt: "string",
        overrideType: "string",
        overridesDetails: "string",
        reason: "string",
        ruleId: "string",
        targetRegion: "string"
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::cloud_policies_api::create_rule_override;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::CommonCreateRuleOverrideRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = CommonCreateRuleOverrideRequest {
        overrides: vec![SingleCreateRuleOverrideRequest {
            comment: Some("string".to_string()),
            crn: Some("string".to_string()),
            override_type: Some("string".to_string()),
            overrides_details: Some("string".to_string()),
            reason: Some("string".to_string()),
            rule_id: Some("string".to_string()),
            target_region: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = create_rule_override(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

body = Falcon::CommonCreateRuleOverrideRequest.new(
  overrides: [{
      comment: 'string',
      crn: 'string',
      expires_at: 'string',
      override_type: 'string',
      overrides_details: 'string',
      reason: 'string',
      rule_id: 'string',
      target_region: 'string'
    }]
)

response = api.create_rule_override(body)

puts response

UpdateRuleOverride

Update a rule override.

PATCH /cloud-policies/entities/rule-overrides/v1

Scope Cloud Security Policies: WRITE Consumes · Produces application/json

PEP 8 update_rule_override

Parameters

Name	Type	Data type	Description
overrides	body	list of dictionaries	The updated rule override.
body	body	dictionary	Full body payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_rule_override(overrides=id_list)
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.UpdateRuleOverride(overrides=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "overrides": [
        {
            "comment": "string",
            "crn": "string",
            "expires_at": "string",
            "override_type": "string",
            "overrides_details": "string",
            "reason": "string",
            "rule_id": "string",
            "target_region": "string"
        }
    ]
}

response = falcon.command("UpdateRuleOverride", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  crn := "string"
  expires_at := "string"
  override_type := "string"
  overrides_details := "string"
  reason := "string"
  rule_id := "string"
  target_region := "string"

  response, err := client.CloudPolicies.UpdateRuleOverride(
    &cloud_policies.UpdateRuleOverrideParams{
      Body: &models.CommonUpdateRuleOverrideRequest{
        Overrides: []interface{}{
          {
          Comment: &comment,
          Crn: &crn,
          ExpiresAt: &expires_at,
          OverrideType: &override_type,
          OverridesDetails: &overrides_details,
          Reason: &reason,
          RuleID: &rule_id,
          TargetRegion: &target_region,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.updateRuleOverride(
  {
    overrides: [{
        comment: "string",
        crn: "string",
        expiresAt: "string",
        overrideType: "string",
        overridesDetails: "string",
        reason: "string",
        ruleId: "string",
        targetRegion: "string"
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::cloud_policies_api::update_rule_override;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::CommonUpdateRuleOverrideRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = CommonUpdateRuleOverrideRequest {
        overrides: vec![SingleCreateRuleOverrideRequest {
            comment: Some("string".to_string()),
            crn: Some("string".to_string()),
            override_type: Some("string".to_string()),
            overrides_details: Some("string".to_string()),
            reason: Some("string".to_string()),
            rule_id: Some("string".to_string()),
            target_region: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = update_rule_override(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

body = Falcon::CommonUpdateRuleOverrideRequest.new(
  overrides: [{
      comment: 'string',
      crn: 'string',
      expires_at: 'string',
      override_type: 'string',
      overrides_details: 'string',
      reason: 'string',
      rule_id: 'string',
      target_region: 'string'
    }]
)

response = api.update_rule_override(body)

puts response

DeleteRuleOverride

Delete a rule override.

DELETE /cloud-policies/entities/rule-overrides/v1

Scope Cloud Security Policies: WRITE Consumes · Produces application/json

PEP 8 delete_rule_override

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The uuids of rule overrides to delete.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_rule_override(ids=id_list)
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteRuleOverride(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteRuleOverride",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudPolicies.DeleteRuleOverride(
    &cloud_policies.DeleteRuleOverrideParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.deleteRuleOverride(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::cloud_policies_api::delete_rule_override;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_rule_override(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.delete_rule_override(['ID1', 'ID2', 'ID3'])

puts response

CreateRuleMixin0

Create a new rule.

POST /cloud-policies/entities/rules/v1

Scope Cloud Security Policies: WRITE Consumes · Produces application/json

PEP 8 create_rule

Parameters

Name	Type	Data type	Description
alert_info	body	string	The info of the alert.
attack_types	body	string	The type of attacks.
controls	body	list of dictionaries	The authority and code of the rule.
description	body	string	The description of the rule.
domain	body	string	The domain of the rule.
logic	body	string	The logic for the rule.
name	body	string	The name of the rule.
parent_rule_id	body	string	The id of the parent.
platform	body	string	The platform covered by the rule.
provider	body	string	The provider for the rule.
remediation_info	body	string	The remediation info provided by the rule.
remediation_url	body	string	The URL providing the remediation.
resource_type	body	string	The type of the resource.
severity	body	integer	The severity level.
subdomain	body	string	The subdomain for the rule.
body	body	dictionary	Full body payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

controls = [
    {
        "Authority": "string",
        "Code": "string"
    }
]

response = falcon.create_rule(alert_info="string",
                              attack_types="string",
                              controls=controls,
                              description="string",
                              domain="string",
                              logic="string",
                              name="string",
                              parent_rule_id="string",
                              platform="string",
                              provider="string",
                              remediation_info="string",
                              remediation_url="string",
                              resource_type="string",
                              severity=integer,
                              subdomain="string")
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

controls = [
    {
        "Authority": "string",
        "Code": "string"
    }
]

response = falcon.CreateRuleMixin0(alert_info="string",
                                   attack_types="string",
                                   controls=controls,
                                   description="string",
                                   domain="string",
                                   logic="string",
                                   name="string",
                                   parent_rule_id="string",
                                   platform="string",
                                   provider="string",
                                   remediation_info="string",
                                   remediation_url="string",
                                   resource_type="string",
                                   severity=integer,
                                   subdomain="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "alert_info": "string",
    "attack_types": "string",
    "category": "string",
    "controls": [
        {
            "authority": "string",
            "code": "string"
        }
    ],
    "description": "string",
    "domain": "string",
    "labels": ["string"],
    "logic": "string",
    "name": "string",
    "parent_rule_id": "string",
    "platform": "string",
    "provider": "string",
    "remediation_info": "string",
    "remediation_url": "string",
    "resource_type": "string",
    "severity": integer,
    "subdomain": "string"
}

response = falcon.command("CreateRuleMixin0", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  alert_info := "string"
  attack_types := "string"
  category := "string"
  Authority := "string"
  Code := "string"
  description := "string"
  domain := "string"
  logic := "string"
  name := "string"
  parent_rule_id := "string"
  platform := "string"
  provider := "string"
  remediation_info := "string"
  remediation_url := "string"
  resource_type := "string"
  severity := integer
  subdomain := "string"

  response, err := client.CloudPolicies.CreateRuleMixin0(
    &cloud_policies.CreateRuleMixin0Params{
      Body: &models.CommonCreateRuleRequest{
        AlertInfo: &alert_info,
        AttackTypes: &attack_types,
        Category: &category,
        Controls: []interface{}{
          {
          Authority: &Authority,
          Code: &Code,
          },
        },
        Description: &description,
        Domain: &domain,
        Labels: []string{"string"},
        Logic: &logic,
        Name: &name,
        ParentRuleID: &parent_rule_id,
        Platform: &platform,
        Provider: &provider,
        RemediationInfo: &remediation_info,
        RemediationUrl: &remediation_url,
        ResourceType: &resource_type,
        Severity: &severity,
        Subdomain: &subdomain,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.createRuleMixin0(
  {
    alertInfo: "string",
    attackTypes: "string",
    category: "string",
    controls: [{
        Authority: "string",
        Code: "string"
      }],
    description: "string",
    domain: "string",
    labels: [],
    logic: "string",
    name: "string",
    parentRuleId: "string",
    platform: "string",
    provider: "string",
    remediationInfo: "string",
    remediationUrl: "string",
    resourceType: "string",
    severity: integer,
    subdomain: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::cloud_policies_api::create_rule_mixin0;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::CommonCreateRuleRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = CommonCreateRuleRequest {
        description: Some("string".to_string()),
        domain: Some("string".to_string()),
        logic: Some("string".to_string()),
        name: Some("string".to_string()),
        parent_rule_id: Some("string".to_string()),
        platform: Some("string".to_string()),
        provider: Some("string".to_string()),
        resource_type: Some("string".to_string()),
        subdomain: Some("string".to_string()),
        ..Default::default()
    };

    let response = create_rule_mixin0(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

body = {
  alert_info: 'string',
  attack_types: 'string',
  category: 'string',
  controls: [{
      Authority: 'string',
      Code: 'string'
    }],
  description: 'string',
  domain: 'string',
  labels: [],
  logic: 'string',
  name: 'string',
  parent_rule_id: 'string',
  platform: 'string',
  provider: 'string',
  remediation_info: 'string',
  remediation_url: 'string',
  resource_type: 'string',
  severity: integer,
  subdomain: 'string'
}

response = api.create_rule_mixin0(body)

puts response

UpdateRule

Update a rule.

PATCH /cloud-policies/entities/rules/v1

Scope Cloud Security Policies: WRITE Consumes · Produces application/json

PEP 8 update_rule

Parameters

Name	Type	Data type	Description
alert_info	body	string	The info of the alert.
attack_types	body	list of strings	The type of attacks.
category	body	string	Rule category.
controls	body	list of dictionaries	The authority and code of the rule.
description	body	string	The description of the rule.
name	body	string	The name of the rule.
rule_logic_list	body	list of dictionaries	The logic list data.
severity	body	integer	The severity level.
uuid	body	string	The uuid of the rule to update.
body	body	dictionary	Full body payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

controls = [
    {
        "authority": "string",
        "code": "string"
    }
]

rule_logic_list = [
    {
        "logic": "string",
        "platform": "string",
        "remediation_info": "string",
        "remediation_url": "string"
    }
]

response = falcon.update_rule(alert_info="string",
                              attack_types=["string"],
                              controls=controls,
                              description="string",
                              name="string",
                              rule_logic_list=rule_logic_list,
                              severity=integer,
                              uuid="string")
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

controls = [
    {
        "authority": "string",
        "code": "string"
    }
]

rule_logic_list = [
    {
        "logic": "string",
        "platform": "string",
        "remediation_info": "string",
        "remediation_url": "string"
    }
]

response = falcon.UpdateRule(alert_info="string",
                             attack_types=["string"],
                             controls=controls,
                             description="string",
                             name="string",
                             rule_logic_list=rule_logic_list,
                             severity=integer,
                             uuid="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "alert_info": "string",
    "attack_types": ["string"],
    "category": "string",
    "controls": [
        {
            "authority": "string",
            "code": "string"
        }
    ],
    "description": "string",
    "name": "string",
    "rule_logic_list": [
        {
            "logic": "string",
            "modules": {},
            "platform": "string",
            "remediation_info": "string",
            "remediation_url": "string"
        }
    ],
    "severity": integer,
    "uuid": "string"
}

response = falcon.command("UpdateRule", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  alert_info := "string"
  category := "string"
  authority := "string"
  code := "string"
  description := "string"
  name := "string"
  logic := "string"
  platform := "string"
  remediation_info := "string"
  remediation_url := "string"
  severity := integer
  uuid := "string"

  response, err := client.CloudPolicies.UpdateRule(
    &cloud_policies.UpdateRuleParams{
      Body: &models.CommonUpdateRuleRequest{
        AlertInfo: &alert_info,
        AttackTypes: []string{"string"},
        Category: &category,
        Controls: []interface{}{
          {
          Authority: &authority,
          Code: &code,
          },
        },
        Description: &description,
        Name: &name,
        RuleLogicList: []interface{}{
          {
          Logic: &logic,
          Modules: &struct{}{},
          Platform: &platform,
          RemediationInfo: &remediation_info,
          RemediationUrl: &remediation_url,
          },
        },
        Severity: &severity,
        Uuid: &uuid,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.updateRule(
  {
    alertInfo: "string",
    attackTypes: [],
    category: "string",
    controls: [{
        authority: "string",
        code: "string"
      }],
    description: "string",
    name: "string",
    ruleLogicList: [{
        logic: "string",
        modules: {},
        platform: "string",
        remediationInfo: "string",
        remediationUrl: "string"
      }],
    severity: integer,
    uuid: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::cloud_policies_api::update_rule;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::CommonUpdateRuleRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = CommonUpdateRuleRequest {
        uuid: Some("string".to_string()),
        ..Default::default()
    };

    let response = update_rule(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

body = Falcon::CommonUpdateRuleRequest.new(
  alert_info: 'string',
  attack_types: [],
  category: 'string',
  controls: [{
      authority: 'string',
      code: 'string'
    }],
  description: 'string',
  name: 'string',
  rule_logic_list: [{
      logic: 'string',
      modules: {},
      platform: 'string',
      remediation_info: 'string',
      remediation_url: 'string'
    }],
  severity: integer,
  uuid: 'string'
)

response = api.update_rule(body)

puts response

DeleteRuleMixin0

Delete a rule.

DELETE /cloud-policies/entities/rules/v1

Scope Cloud Security Policies: WRITE Consumes · Produces application/json

PEP 8 delete_rule

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The uuids of rules to delete.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_rule(ids=id_list)
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteRuleMixin0(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteRuleMixin0",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudPolicies.DeleteRuleMixin0(
    &cloud_policies.DeleteRuleMixin0Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.deleteRuleMixin0(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::cloud_policies_api::delete_rule_mixin0;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_rule_mixin0(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.delete_rule_mixin0(['ID1', 'ID2', 'ID3'])

puts response

QueryComplianceFrameworks

Query for compliance frameworks by various parameters.

GET /cloud-policies/queries/compliance/frameworks/v1

Scope Cloud Security Policies: READ Consumes · Produces application/json

PEP 8 query_compliance_frameworks

Parameters

Name	Type	Data type	Description
filter	query	string	FQL filter, allowed props: `compliance_framework_name`, `compliance_framework_version`, `compliance_framework_authority`.
limit	query	integer	The maximum number of resources to return. The maximum allowed is 500. Default: 100.
offset	query	integer	The number of results to skip before starting to return results. Default: 0.
sort	query	string	Field to sort on. Sortable fields: `compliance_framework_name`, `compliance_framework_version`, `compliance_framework_authority`. Use the \|asc or \|desc suffix to specify sort direction.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.query_compliance_frameworks(filter="string",
                                              limit="string",
                                              offset="string",
                                              sort="string")
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.QueryComplianceFrameworks(filter="string",
                                            limit="string",
                                            offset="string",
                                            sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryComplianceFrameworks",
                          filter="string",
                          limit=integer,
                          offset=integer,
                          sort="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)
  sort := "string"

  response, err := client.CloudPolicies.QueryComplianceFrameworks(
    &cloud_policies.QueryComplianceFrameworksParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.queryComplianceFrameworks(
  "string",  // filter
  integer,  // limit
  integer,  // offset
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::cloud_policies_api::query_compliance_frameworks;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_compliance_frameworks(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.query_compliance_frameworks(filter: 'string',
                                           limit: integer,
                                           offset: integer,
                                           sort: 'string')

puts response

QueryRule

Query for rules by various parameters.

GET /cloud-policies/queries/rules/v1

Scope Cloud Security Policies: READ Consumes · Produces application/json

PEP 8 query_rule

Parameters

Name	Type	Data type	Description
filter	query	string	FQL filter, allowed props: `rule_auto_remediable`, `rule_category`, `rule_cloneable`, `rule_compliance_benchmark`, `rule_compliance_benchmark_uuid`, `rule_compliance_framework`, `rule_control_requirement`, `rule_control_section`, `rule_created_at`, `rule_description`, `rule_domain`, `rule_mitre_tactic`, `rule_mitre_technique`, `rule_name`, `rule_origin`, `rule_parent_uuid`, `rule_provider`, `rule_resource_type`, `rule_resource_type_name`, `rule_risk_factor`, `rule_service`, `rule_severity`, `rule_short_code`, `rule_status`, `rule_subdomain`, `rule_updated_at`, `rule_updated_by`.
limit	query	integer	The maximum number of resources to return. The maximum allowed is 500. Default: 100.
offset	query	integer	The number of results to skip before starting to return results. Default: 0.
sort	query	string	Field to sort on. Sortable fields: `rule_auto_remediable`, `rule_category`, `rule_cloneable`, `rule_compliance_benchmark`, `rule_compliance_benchmark_uuid`, `rule_compliance_framework`, `rule_control_requirement`, `rule_control_section`, `rule_created_at`, `rule_description`, `rule_domain`, `rule_mitre_tactic`, `rule_mitre_technique`, `rule_name`, `rule_origin`, `rule_parent_uuid`, `rule_provider`, `rule_resource_type`, `rule_resource_type_name`, `rule_risk_factor`, `rule_service`, `rule_severity`, `rule_short_code`, `rule_status`, `rule_subdomain`, `rule_updated_at`, `rule_updated_by`. Use the \|asc or \|desc suffix to specify sort direction.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.query_rule(filter="string",
                             limit="string",
                             offset="string",
                             sort="string")
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.QueryRule(filter="string",
                            limit="string",
                            offset="string",
                            sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryRule",
                          filter="string",
                          limit=integer,
                          offset=integer,
                          sort="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)
  sort := "string"

  response, err := client.CloudPolicies.QueryRule(
    &cloud_policies.QueryRuleParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.queryRule(
  "string",  // filter
  integer,  // limit
  integer,  // offset
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::cloud_policies_api::query_rule;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_rule(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.query_rule(filter: 'string',
                          limit: integer,
                          offset: integer,
                          sort: 'string')

puts response

GetSuppressionRules

Get Suppression Rules by ID.

GET /cloud-policies/entities/suppression-rules/v1

Scope Cloud Security Policies: READ Consumes · Produces application/json

PEP 8 get_suppression_rules

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The uuids of the suppression rules to retrieve.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_suppression_rules(ids=id_list)
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetSuppressionRules(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetSuppressionRules",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudPolicies.GetSuppressionRules(
    &cloud_policies.GetSuppressionRulesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.getSuppressionRules(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.get_suppression_rules(['ID1', 'ID2', 'ID3'])

puts response

CreateSuppressionRule

Create a new suppression rule.

POST /cloud-policies/entities/suppression-rules/v1

Scope Cloud Security Policies: WRITE Consumes · Produces application/json

PEP 8 create_suppression_rule

Parameters

Name	Type	Data type	Description
description	body	string	Description of the suppression rule.
id	body	string	The ID of the suppression rule.
name	body	string	Name of the suppression rule.
rule_selection_filter	body	dictionary	Dictionary of lists defining rule selection criteria.
rule_selection_type	body	string	Type of rule selection.
scope_asset_filter	body	dictionary	Dictionary of lists defining scope asset filter criteria.
scope_type	body	string	Type of scope.
suppression_comment	body	string	Comment for the suppression.
suppression_expiration_date	body	string	Expiration date for the suppression.
suppression_reason	body	string	Reason for the suppression.
domain	body	string	Domain.
subdomain	body	string	Subdomain.
body	body	dictionary	Full body payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

rule_selection_filter = {
    "rule_ids": [
        "string"
    ],
    "rule_names": [
        "string"
    ],
    "rule_origins": [
        "string"
    ],
    "rule_providers": [
        "string"
    ],
    "rule_services": [
        "string"
    ],
    "rule_severities": [
        "string"
    ]
}

scope_asset_filter = {
    "account_ids": [
        "string"
    ],
    "cloud_group_ids": [
        "string"
    ],
    "cloud_providers": [
        "string"
    ],
    "regions": [
        "string"
    ],
    "resource_ids": [
        "string"
    ],
    "resource_names": [
        "string"
    ],
    "resource_types": [
        "string"
    ],
    "service_categories": [
        "string"
    ],
    "tags": [
        "string"
    ]
}

response = falcon.create_suppression_rule(description="string",
                                          domain="string",
                                          name="string",
                                          rule_selection_filter=rule_selection_filter,
                                          rule_selection_type="string",
                                          scope_asset_filter=scope_asset_filter,
                                          scope_type="string",
                                          subdomain="string",
                                          suppression_comment="string",
                                          suppression_expiration_date="string",
                                          suppression_reason="string")
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

rule_selection_filter = {
    "rule_ids": [
        "string"
    ],
    "rule_names": [
        "string"
    ],
    "rule_origins": [
        "string"
    ],
    "rule_providers": [
        "string"
    ],
    "rule_services": [
        "string"
    ],
    "rule_severities": [
        "string"
    ]
}

scope_asset_filter = {
    "account_ids": [
        "string"
    ],
    "cloud_group_ids": [
        "string"
    ],
    "cloud_providers": [
        "string"
    ],
    "regions": [
        "string"
    ],
    "resource_ids": [
        "string"
    ],
    "resource_names": [
        "string"
    ],
    "resource_types": [
        "string"
    ],
    "service_categories": [
        "string"
    ],
    "tags": [
        "string"
    ]
}

response = falcon.CreateSuppressionRule(description="string",
                                        domain="string",
                                        name="string",
                                        rule_selection_filter=rule_selection_filter,
                                        rule_selection_type="string",
                                        scope_asset_filter=scope_asset_filter,
                                        scope_type="string",
                                        subdomain="string",
                                        suppression_comment="string",
                                        suppression_expiration_date="string",
                                        suppression_reason="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "domain": "string",
    "name": "string",
    "rule_selection_filter": {
        "rule_ids": ["string"],
        "rule_names": ["string"],
        "rule_origins": ["string"],
        "rule_providers": ["string"],
        "rule_resource_type_names": ["string"],
        "rule_risk_factors": ["string"],
        "rule_services": ["string"],
        "rule_severities": ["string"]
    },
    "rule_selection_type": "string",
    "scope_asset_filter": {
        "account_ids": ["string"],
        "cloud_group_ids": ["string"],
        "cloud_providers": ["string"],
        "regions": ["string"],
        "resource_ids": ["string"],
        "resource_names": ["string"],
        "resource_types": ["string"],
        "service_categories": ["string"],
        "tags": ["string"]
    },
    "scope_type": "string",
    "subdomain": "string",
    "suppression_comment": "string",
    "suppression_expiration_date": "string",
    "suppression_reason": "string"
}

response = falcon.command("CreateSuppressionRule", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  domain := "string"
  name := "string"
  rule_selection_type := "string"
  scope_type := "string"
  subdomain := "string"
  suppression_comment := "string"
  suppression_expiration_date := "string"
  suppression_reason := "string"

  response, err := client.CloudPolicies.CreateSuppressionRule(
    &cloud_policies.CreateSuppressionRuleParams{
      Body: &models.SuppressionrulesCreateSuppressionRuleRequest{
        Description: &description,
        Domain: &domain,
        Name: &name,
        RuleSelectionFilter: &struct{}{},
        RuleSelectionType: &rule_selection_type,
        ScopeAssetFilter: &struct{}{},
        ScopeType: &scope_type,
        Subdomain: &subdomain,
        SuppressionComment: &suppression_comment,
        SuppressionExpirationDate: &suppression_expiration_date,
        SuppressionReason: &suppression_reason,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.createSuppressionRule(
  {
    description: "string",
    domain: "string",
    name: "string",
    ruleSelectionFilter: {
      ruleIds: [],
      ruleNames: [],
      ruleOrigins: [],
      ruleProviders: [],
      ruleResourceTypeNames: [],
      ruleRiskFactors: [],
      ruleServices: [],
      ruleSeverities: []
    },
    ruleSelectionType: "string",
    scopeAssetFilter: {
      accountIds: [],
      cloudGroupIds: [],
      cloudProviders: [],
      regions: [],
      resourceIds: [],
      resourceNames: [],
      resourceTypes: [],
      serviceCategories: [],
      tags: []
    },
    scopeType: "string",
    subdomain: "string",
    suppressionComment: "string",
    suppressionExpirationDate: "string",
    suppressionReason: "string"
}  // body
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

body = Falcon::SuppressionrulesCreateSuppressionRuleRequest.new(
  description: 'string',
  domain: 'string',
  name: 'string',
  rule_selection_filter: {
    rule_ids: [],
    rule_names: [],
    rule_origins: [],
    rule_providers: [],
    rule_resource_type_names: [],
    rule_risk_factors: [],
    rule_services: [],
    rule_severities: []
  },
  rule_selection_type: 'string',
  scope_asset_filter: {
    account_ids: [],
    cloud_group_ids: [],
    cloud_providers: [],
    regions: [],
    resource_ids: [],
    resource_names: [],
    resource_types: [],
    service_categories: [],
    tags: []
  },
  scope_type: 'string',
  subdomain: 'string',
  suppression_comment: 'string',
  suppression_expiration_date: 'string',
  suppression_reason: 'string'
)

response = api.create_suppression_rule(body)

puts response

UpdateSuppressionRule

Update a suppression rule.

PATCH /cloud-policies/entities/suppression-rules/v1

Scope Cloud Security Policies: WRITE Consumes · Produces application/json

PEP 8 update_suppression_rule

Parameters

Name	Type	Data type	Description
description	body	string	Description of the suppression rule.
id	body	string	The ID of the suppression rule.
name	body	string	Name of the suppression rule.
rule_selection_filter	body	dictionary	Dictionary of lists defining rule selection criteria.
rule_selection_type	body	string	Type of rule selection.
scope_asset_filter	body	dictionary	Dictionary of lists defining scope asset filter criteria.
scope_type	body	string	Type of scope.
suppression_comment	body	string	Comment for the suppression.
suppression_expiration_date	body	string	Expiration date for the suppression.
suppression_reason	body	string	Reason for the suppression.
domain	body	string	Domain.
subdomain	body	string	Subdomain.
body	body	dictionary	Full body payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

rule_selection_filter = {
    "rule_ids": [
        "string"
    ],
    "rule_names": [
        "string"
    ],
    "rule_origins": [
        "string"
    ],
    "rule_providers": [
        "string"
    ],
    "rule_services": [
        "string"
    ],
    "rule_severities": [
        "string"
    ]
}

scope_asset_filter = {
    "account_ids": [
        "string"
    ],
    "cloud_group_ids": [
        "string"
    ],
    "cloud_providers": [
        "string"
    ],
    "regions": [
        "string"
    ],
    "resource_ids": [
        "string"
    ],
    "resource_names": [
        "string"
    ],
    "resource_types": [
        "string"
    ],
    "service_categories": [
        "string"
    ],
    "tags": [
        "string"
    ]
}

response = falcon.update_suppression_rule(description="string",
                                          id="string",
                                          name="string",
                                          rule_selection_filter=rule_selection_filter,
                                          rule_selection_type="string",
                                          scope_asset_filter=scope_asset_filter,
                                          scope_type="string",
                                          suppression_comment="string",
                                          suppression_expiration_date="string",
                                          suppression_reason="string")
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

rule_selection_filter = {
    "rule_ids": [
        "string"
    ],
    "rule_names": [
        "string"
    ],
    "rule_origins": [
        "string"
    ],
    "rule_providers": [
        "string"
    ],
    "rule_services": [
        "string"
    ],
    "rule_severities": [
        "string"
    ]
}

scope_asset_filter = {
    "account_ids": [
        "string"
    ],
    "cloud_group_ids": [
        "string"
    ],
    "cloud_providers": [
        "string"
    ],
    "regions": [
        "string"
    ],
    "resource_ids": [
        "string"
    ],
    "resource_names": [
        "string"
    ],
    "resource_types": [
        "string"
    ],
    "service_categories": [
        "string"
    ],
    "tags": [
        "string"
    ]
}

response = falcon.UpdateSuppressionRule(description="string",
                                        id="string",
                                        name="string",
                                        rule_selection_filter=rule_selection_filter,
                                        rule_selection_type="string",
                                        scope_asset_filter=scope_asset_filter,
                                        scope_type="string",
                                        suppression_comment="string",
                                        suppression_expiration_date="string",
                                        suppression_reason="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "id": "string",
    "name": "string",
    "rule_selection_filter": {
        "rule_ids": ["string"],
        "rule_names": ["string"],
        "rule_origins": ["string"],
        "rule_providers": ["string"],
        "rule_resource_type_names": ["string"],
        "rule_risk_factors": ["string"],
        "rule_services": ["string"],
        "rule_severities": ["string"]
    },
    "rule_selection_type": "string",
    "scope_asset_filter": {
        "account_ids": ["string"],
        "cloud_group_ids": ["string"],
        "cloud_providers": ["string"],
        "regions": ["string"],
        "resource_ids": ["string"],
        "resource_names": ["string"],
        "resource_types": ["string"],
        "service_categories": ["string"],
        "tags": ["string"]
    },
    "scope_type": "string",
    "suppression_comment": "string",
    "suppression_expiration_date": "string",
    "suppression_reason": "string"
}

response = falcon.command("UpdateSuppressionRule", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  id := "string"
  name := "string"
  rule_selection_type := "string"
  scope_type := "string"
  suppression_comment := "string"
  suppression_expiration_date := "string"
  suppression_reason := "string"

  response, err := client.CloudPolicies.UpdateSuppressionRule(
    &cloud_policies.UpdateSuppressionRuleParams{
      Body: &models.SuppressionrulesUpdateSuppressionRuleRequest{
        Description: &description,
        ID: &id,
        Name: &name,
        RuleSelectionFilter: &struct{}{},
        RuleSelectionType: &rule_selection_type,
        ScopeAssetFilter: &struct{}{},
        ScopeType: &scope_type,
        SuppressionComment: &suppression_comment,
        SuppressionExpirationDate: &suppression_expiration_date,
        SuppressionReason: &suppression_reason,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.updateSuppressionRule(
  {
    description: "string",
    id: "string",
    name: "string",
    ruleSelectionFilter: {
      ruleIds: [],
      ruleNames: [],
      ruleOrigins: [],
      ruleProviders: [],
      ruleResourceTypeNames: [],
      ruleRiskFactors: [],
      ruleServices: [],
      ruleSeverities: []
    },
    ruleSelectionType: "string",
    scopeAssetFilter: {
      accountIds: [],
      cloudGroupIds: [],
      cloudProviders: [],
      regions: [],
      resourceIds: [],
      resourceNames: [],
      resourceTypes: [],
      serviceCategories: [],
      tags: []
    },
    scopeType: "string",
    suppressionComment: "string",
    suppressionExpirationDate: "string",
    suppressionReason: "string"
}  // body
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

body = Falcon::SuppressionrulesUpdateSuppressionRuleRequest.new(
  description: 'string',
  id: 'string',
  name: 'string',
  rule_selection_filter: {
    rule_ids: [],
    rule_names: [],
    rule_origins: [],
    rule_providers: [],
    rule_resource_type_names: [],
    rule_risk_factors: [],
    rule_services: [],
    rule_severities: []
  },
  rule_selection_type: 'string',
  scope_asset_filter: {
    account_ids: [],
    cloud_group_ids: [],
    cloud_providers: [],
    regions: [],
    resource_ids: [],
    resource_names: [],
    resource_types: [],
    service_categories: [],
    tags: []
  },
  scope_type: 'string',
  suppression_comment: 'string',
  suppression_expiration_date: 'string',
  suppression_reason: 'string'
)

response = api.update_suppression_rule(body)

puts response

DeleteSuppressionRules

Delete Suppression Rules by ID.

DELETE /cloud-policies/entities/suppression-rules/v1

Scope Cloud Security Policies: WRITE Consumes · Produces application/json

PEP 8 delete_suppression_rules

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The uuids of the suppression rules to delete. A maximum of 10 IDs can be provided.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_suppression_rules(ids=id_list)
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteSuppressionRules(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteSuppressionRules",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudPolicies.DeleteSuppressionRules(
    &cloud_policies.DeleteSuppressionRulesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.deleteSuppressionRules(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.delete_suppression_rules(['ID1', 'ID2', 'ID3'])

puts response

QuerySuppressionRules

Query suppression rules with filtering, sorting and pagination.

GET /cloud-policies/queries/suppression-rules/v1

Scope Cloud Security Policies: READ Consumes · Produces application/json

PEP 8 query_suppression_rules

Parameters

Name	Type	Data type	Description
filter	query	string	FQL expression to filter suppression rules. Allowed properties: `name`, `description`, `domain`, `subdomain`, `suppression_reason`, `suppression_expiration_date`, `created_by`, `created_at`, `last_modified_at`, `disabled`, `groups`.
limit	query	integer	The maximum number of resources to return. The maximum allowed is 50. Default: 20.
offset	query	integer	The number of results to skip before starting to return results. Default: 0.
sort	query	string	Field to sort on. Sortable fields: `name`, `description`, `domain`, `subdomain`, `suppression_reason`, `suppression_expiration_date`, `created_by`, `created_at`, `last_modified_at`, `disabled`, `groups`. Use the .asc or .desc suffix to specify sort direction.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.query_suppression_rules(filter="string",
                                          limit=integer,
                                          offset=integer,
                                          sort="string")
print(response)

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.QuerySuppressionRules(filter="string",
                                        limit=integer,
                                        offset=integer,
                                        sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QuerySuppressionRules",
                          filter="string",
                          limit=integer,
                          offset=integer,
                          sort="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)
  sort := "string"

  response, err := client.CloudPolicies.QuerySuppressionRules(
    &cloud_policies.QuerySuppressionRulesParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.querySuppressionRules(
  "string",  // filter
  integer,  // limit
  integer,  // offset
  "string"  // sort
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.query_suppression_rules(filter: 'string',
                                       limit: integer,
                                       offset: integer,
                                       sort: 'string')

puts response

Cloud Policies

Table of Contents

GetRuleInputSchema

Parameters

Code Examples

ReplaceControlRules

Parameters

Code Examples

GetComplianceControls

Parameters

Code Examples

CreateComplianceControl

Parameters

Code Examples

UpdateComplianceControl

Parameters

Code Examples

DeleteComplianceControl

Parameters

Code Examples

QueryComplianceControls

Parameters

Code Examples

GetRule

Parameters

Code Examples

RenameSectionComplianceFramework

Parameters

Code Examples

GetComplianceFrameworks

Parameters

Code Examples

CreateComplianceFramework

Parameters

Code Examples

UpdateComplianceFramework

Parameters

Code Examples

DeleteComplianceFramework

Parameters

Code Examples

GetEnrichedAsset

Parameters

Code Examples

GetEvaluationResult

Parameters

Code Examples

GetRuleOverride

Parameters

Code Examples

CreateRuleOverride

Parameters

Code Examples

UpdateRuleOverride

Parameters

Code Examples

DeleteRuleOverride

Parameters

Code Examples

CreateRuleMixin0

Parameters

Code Examples

UpdateRule

Parameters

Code Examples

DeleteRuleMixin0

Parameters

Code Examples

QueryComplianceFrameworks

Parameters

Code Examples

QueryRule

Parameters

Code Examples

GetSuppressionRules

Parameters

Code Examples

CreateSuppressionRule

Parameters

Code Examples