Cloud Policies

The Cloud Policies service collection provides operations for managing cloud security policies, compliance frameworks and controls, rules, rule overrides, enriched assets, evaluation results, and suppression rules across cloud environments.

Language	Last Update
Python	v1.6.5
PowerShell
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
CloneComplianceFramework clone_compliance_framework	Clone an existing compliance framework to create a custom copy
CreateComplianceControl create_compliance_control	Create a new custom compliance control
CreateComplianceFramework create_compliance_framework	Create a new custom compliance framework
CreateRuleMixin0 create_rule	Create a new rule
CreateRuleOverride create_rule_override	Create a new rule override
CreateSuppressionRule create_suppression_rule	Create a new suppression rule
DeleteComplianceControl delete_compliance_control	Delete custom compliance controls
DeleteComplianceFramework delete_compliance_framework	Delete a custom compliance framework and all associated controls and rule assignments
DeleteRuleMixin0 delete_rule	Delete a rule
DeleteRuleOverride delete_rule_override	Delete a rule override
DeleteSuppressionRules delete_suppression_rules	Delete Suppression Rules by ID
GetComplianceControls get_compliance_controls	Get compliance controls by ID
GetComplianceFrameworks get_compliance_frameworks	Get compliance frameworks by ID
GetEnrichedAsset get_enriched_asset	Gets enriched assets that combine a primary resource with all its related resources
GetEvaluationResult get_evaluation_result	Gets evaluation results based on the provided rule
GetRule get_rule	Get a rule by id
GetRuleInputSchema get_rule_input_schema	Get rule input schema for given resource type
GetRuleOverride get_rule_override	Get a rule override
GetSuppressionRules get_suppression_rules	Get Suppression Rules by ID
QueryComplianceControls query_compliance_controls	Query for compliance controls by various parameters
QueryComplianceFrameworks query_compliance_frameworks	Query for compliance frameworks by various parameters
QueryRule query_rule	Query for rules by various parameters
QuerySuppressionRules query_suppression_rules	Query suppression rules with filtering, sorting and pagination
RenameSectionComplianceFramework rename_section_compliance_framework	Rename a section in a custom compliance framework
ReplaceControlRules replace_control_rules	Assign rules to a compliance control (full replace)
UpdateComplianceControl update_compliance_control	Update a custom compliance control
UpdateComplianceFramework update_compliance_framework	Update a custom compliance framework
UpdateRule update_rule	Update a rule
UpdateRuleOverride update_rule_override	Update a rule override
UpdateSuppressionRule update_suppression_rule	Update a suppression rule

---

CloneComplianceFramework

Clone an existing compliance framework to create a custom copy

Method POST

Route /cloud-policies/entities/compliance/clone-framework/v1

Scope Cloud Security Policies: WRITE

PEP 8 clone_compliance_framework

Parameters

ids query · string

The uuid of the compliance framework to clone

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.clone_compliance_framework(ids=id_list)
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.CloneComplianceFramework(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("CloneComplianceFramework",
                          ids="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudPolicies.CloneComplianceFramework(
    &cloud_policies.CloneComplianceFrameworkParams{
      Ids: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.cloneComplianceFramework("string");  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.clone_compliance_framework('string')

puts response

Responses

200 OK

[
  {
    "active": false,
    "authority": "string",
    "description": "string",
    "name": "string",
    "uuid": "string",
    "version": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "active": false,
      "authority": "string",
      "description": "string",
      "name": "string",
      "uuid": "string",
      "version": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "active": false,
      "authority": "string",
      "description": "string",
      "name": "string",
      "uuid": "string",
      "version": "string"
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "active": false,
      "authority": "string",
      "description": "string",
      "name": "string",
      "uuid": "string",
      "version": "string"
    }
  ]
}

---

---

CreateComplianceControl

Create a new custom compliance control

Method POST

Route /cloud-policies/entities/compliance/controls/v1

Scope Cloud Security Policies: WRITE

PEP 8 create_compliance_control

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

description body · string

The description of hte custom compliance control.

framework_id body · string

The framework ID of the custom compliance control.

name body · string

The name of the custom compliance control.

section_name body · string

The section name of the custom compliance control.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.create_compliance_control(description="string",
                                            framework_id="string",
                                            name="string",
                                            section_name="string")
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.CreateComplianceControl(description="string",
                                          framework_id="string",
                                          name="string",
                                          section_name="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "framework_id": "string",
    "name": "string",
    "section_name": "string"
}

response = falcon.command("CreateComplianceControl", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  framework_id := "string"
  name := "string"
  section_name := "string"

  response, err := client.CloudPolicies.CreateComplianceControl(
    &cloud_policies.CreateComplianceControlParams{
      Body: &models.CommonCreateComplianceControlRequest{
        Description: &description,
        FrameworkID: &framework_id,
        Name: &name,
        SectionName: &section_name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.createComplianceControl(
  {
    description: "string",
    frameworkId: "string",
    name: "string",
    sectionName: "string"
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

body = Falcon::CommonCreateComplianceControlRequest.new(
  description: 'string',
  framework_id: 'string',
  name: 'string',
  section_name: 'string'
)

response = api.create_compliance_control(body)

puts response

Responses

200 OK

[
  {
    "applicable_profiles": [],
    "authority": "string",
    "code": "string",
    "control_type": "string",
    "control_version": "string",
    "description": "string",
    "name": "string",
    "origin": "string",
    "requirement": "string",
    "section_name": "string",
    "security_framework": [],
    "uuid": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

CreateComplianceFramework

Create a new custom compliance framework

Method POST

Route /cloud-policies/entities/compliance/frameworks/v1

Scope Cloud Security Policies: WRITE

PEP 8 create_compliance_framework

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

active body · boolean

Value to determine if the compliance framework will be active.

description body · string

The description of the new compliance framework.

name body · string

The name of the new compliance framework.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.create_compliance_framework(active=boolean,
                                              description="string",
                                              name="string")
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.CreateComplianceFramework(active=boolean,
                                            description="string",
                                            name="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "active": boolean,
    "description": "string",
    "name": "string"
}

response = falcon.command("CreateComplianceFramework", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  active := boolean
  description := "string"
  name := "string"

  response, err := client.CloudPolicies.CreateComplianceFramework(
    &cloud_policies.CreateComplianceFrameworkParams{
      Body: &models.CommonCreateComplianceFrameworkRequest{
        Active: &active,
        Description: &description,
        Name: &name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.createComplianceFramework(
  {
    active: boolean,
    description: "string",
    name: "string"
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

body = Falcon::CommonCreateComplianceFrameworkRequest.new(
  active: boolean,
  description: 'string',
  name: 'string'
)

response = api.create_compliance_framework(body)

puts response

Responses

200 OK

[
  {
    "active": false,
    "authority": "string",
    "description": "string",
    "name": "string",
    "uuid": "string",
    "version": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

409 Conflict

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

CreateRuleMixin0

Create a new rule

Method POST

Route /cloud-policies/entities/rules/v1

Scope Cloud Security Policies: WRITE

PEP 8 create_rule

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

alert_info body · string

The info of the alert.

attack_types body · string

The type of attacks.

category body · string

controls body · array

The authority and code of the rule.

description body · string

The description of the rule.

domain body · string

The domain of the rule.

labels body · array

logic body · string

The logic for the rule.

name body · string

The name of the rule.

parent_rule_id body · string

The id of the parent.

platform body · string

The platform covered by the rule.

provider body · string

The provider for the rule.

remediation_info body · string

The remediation info provided by the rule.

remediation_url body · string

The URL providing the remediation.

resource_type body · string

The type of the resource.

severity body · integer

The severity level.

subdomain body · string

The subdomain for the rule.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

controls = [
    {
        "Authority": "string",
        "Code": "string"
    }
]

response = falcon.create_rule(alert_info="string",
                              attack_types="string",
                              controls=controls,
                              description="string",
                              domain="string",
                              logic="string",
                              name="string",
                              parent_rule_id="string",
                              platform="string",
                              provider="string",
                              remediation_info="string",
                              remediation_url="string",
                              resource_type="string",
                              severity=integer,
                              subdomain="string")
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

controls = [
    {
        "Authority": "string",
        "Code": "string"
    }
]

response = falcon.CreateRuleMixin0(alert_info="string",
                                   attack_types="string",
                                   controls=controls,
                                   description="string",
                                   domain="string",
                                   logic="string",
                                   name="string",
                                   parent_rule_id="string",
                                   platform="string",
                                   provider="string",
                                   remediation_info="string",
                                   remediation_url="string",
                                   resource_type="string",
                                   severity=integer,
                                   subdomain="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "alert_info": "string",
    "attack_types": "string",
    "category": "string",
    "controls": [
        {
            "authority": "string",
            "code": "string"
        }
    ],
    "description": "string",
    "domain": "string",
    "labels": ["string"],
    "logic": "string",
    "name": "string",
    "parent_rule_id": "string",
    "platform": "string",
    "provider": "string",
    "remediation_info": "string",
    "remediation_url": "string",
    "resource_type": "string",
    "severity": integer,
    "subdomain": "string"
}

response = falcon.command("CreateRuleMixin0", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  alert_info := "string"
  attack_types := "string"
  category := "string"
  Authority := "string"
  Code := "string"
  description := "string"
  domain := "string"
  logic := "string"
  name := "string"
  parent_rule_id := "string"
  platform := "string"
  provider := "string"
  remediation_info := "string"
  remediation_url := "string"
  resource_type := "string"
  severity := integer
  subdomain := "string"

  response, err := client.CloudPolicies.CreateRuleMixin0(
    &cloud_policies.CreateRuleMixin0Params{
      Body: &models.CommonCreateRuleRequest{
        AlertInfo: &alert_info,
        AttackTypes: &attack_types,
        Category: &category,
        Controls: []interface{}{
          {
          Authority: &Authority,
          Code: &Code,
          },
        },
        Description: &description,
        Domain: &domain,
        Labels: []string{"string"},
        Logic: &logic,
        Name: &name,
        ParentRuleID: &parent_rule_id,
        Platform: &platform,
        Provider: &provider,
        RemediationInfo: &remediation_info,
        RemediationUrl: &remediation_url,
        ResourceType: &resource_type,
        Severity: &severity,
        Subdomain: &subdomain,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.createRuleMixin0(
  {
    alertInfo: "string",
    attackTypes: "string",
    category: "string",
    controls: [{
        Authority: "string",
        Code: "string"
      }],
    description: "string",
    domain: "string",
    labels: [],
    logic: "string",
    name: "string",
    parentRuleId: "string",
    platform: "string",
    provider: "string",
    remediationInfo: "string",
    remediationUrl: "string",
    resourceType: "string",
    severity: integer,
    subdomain: "string"
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::cloud_policies_api::create_rule_mixin0;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::CommonCreateRuleRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = CommonCreateRuleRequest {
        description: Some("string".to_string()),
        domain: Some("string".to_string()),
        logic: Some("string".to_string()),
        name: Some("string".to_string()),
        parent_rule_id: Some("string".to_string()),
        platform: Some("string".to_string()),
        provider: Some("string".to_string()),
        resource_type: Some("string".to_string()),
        subdomain: Some("string".to_string()),
        ..Default::default()
    };

    let response = create_rule_mixin0(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

body = {
  alert_info: 'string',
  attack_types: 'string',
  category: 'string',
  controls: [{
      Authority: 'string',
      Code: 'string'
    }],
  description: 'string',
  domain: 'string',
  labels: [],
  logic: 'string',
  name: 'string',
  parent_rule_id: 'string',
  platform: 'string',
  provider: 'string',
  remediation_info: 'string',
  remediation_url: 'string',
  resource_type: 'string',
  severity: integer,
  subdomain: 'string'
}

response = api.create_rule_mixin0(body)

puts response

Responses

200 OK

[
  {
    "alert_info": "string",
    "attack_types": [],
    "auto_remediable": false,
    "category": "string",
    "cid": "string",
    "cloneable": false,
    "controls": [],
    "created_at": "string",
    "created_by": "string",
    "custom_configuration": {},
    "deleted_at": "string",
    "deleted_by": "string",
    "deprecated": false,
    "description": "string",
    "domain": "string",
    "logic": "string",
    "logic_format": "string",
    "mitre_tactics_id": "string",
    "mitre_tactics_name": "string",
    "mitre_tactics_url": "string",
    "mitre_techniques_id": "string",
    "mitre_techniques_name": "string",
    "mitre_techniques_url": "string",
    "mutable": "string",
    "name": "string",
    "origin": "string",
    "overrides": [],
    "parent_rule__pk": 0,
    "parent_rule_short_code": 0,
    "parent_rule_short_uuid": "string",
    "platform": "string",
    "provider": "string",
    "remediation": "string",
    "remediation_url": "string",
    "resource_metadata": "string",
    "resource_types": [],
    "revision": 0,
    "rule_logic_list": [],
    "scope_asset_filter": {},
    "scope_type": "string",
    "severity": 0,
    "short_code": 0,
    "subdomain": "string",
    "update_reason": "string",
    "updated_at": "string",
    "updated_by": "string",
    "uuid": "string",
    "visible": false
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "alert_info": "string",
      "attack_types": [],
      "auto_remediable": false,
      "category": "string",
      "cid": "string",
      "cloneable": false,
      "controls": [],
      "created_at": "string",
      "created_by": "string",
      "custom_configuration": {},
      "deleted_at": "string",
      "deleted_by": "string",
      "deprecated": false,
      "description": "string",
      "domain": "string",
      "logic": "string",
      "logic_format": "string",
      "mitre_tactics_id": "string",
      "mitre_tactics_name": "string",
      "mitre_tactics_url": "string",
      "mitre_techniques_id": "string",
      "mitre_techniques_name": "string",
      "mitre_techniques_url": "string",
      "mutable": "string",
      "name": "string",
      "origin": "string",
      "overrides": [],
      "parent_rule__pk": 0,
      "parent_rule_short_code": 0,
      "parent_rule_short_uuid": "string",
      "platform": "string",
      "provider": "string",
      "remediation": "string",
      "remediation_url": "string",
      "resource_metadata": "string",
      "resource_types": [],
      "revision": 0,
      "rule_logic_list": [],
      "scope_asset_filter": {},
      "scope_type": "string",
      "severity": 0,
      "short_code": 0,
      "subdomain": "string",
      "update_reason": "string",
      "updated_at": "string",
      "updated_by": "string",
      "uuid": "string",
      "visible": false
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

409 Conflict

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

CreateRuleOverride

Create a new rule override

Method POST

Route /cloud-policies/entities/rule-overrides/v1

Scope Cloud Security Policies: WRITE

PEP 8 create_rule_override

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

overrides body · array

The new rule override.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

overrides = [
    {
        "comment": "string",
        "crn": "string",
        "expires_at": "2025-11-10T21:16:14.315Z",
        "override_type": "string",
        "overrides_details": "string",
        "reason": "string",
        "rule_id": "string",
        "target_region": "string"
    }
]

response = falcon.create_rule_override(overrides=overrides)
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

overrides = [
    {
        "comment": "string",
        "crn": "string",
        "expires_at": "2025-11-10T21:16:14.315Z",
        "override_type": "string",
        "overrides_details": "string",
        "reason": "string",
        "rule_id": "string",
        "target_region": "string"
    }
]

response = falcon.CreateRuleOverride(overrides=overrides)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "overrides": [
        {
            "comment": "string",
            "crn": "string",
            "expires_at": "string",
            "override_type": "string",
            "overrides_details": "string",
            "reason": "string",
            "rule_id": "string",
            "target_region": "string"
        }
    ]
}

response = falcon.command("CreateRuleOverride", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  crn := "string"
  expires_at := "string"
  override_type := "string"
  overrides_details := "string"
  reason := "string"
  rule_id := "string"
  target_region := "string"

  response, err := client.CloudPolicies.CreateRuleOverride(
    &cloud_policies.CreateRuleOverrideParams{
      Body: &models.CommonCreateRuleOverrideRequest{
        Overrides: []interface{}{
          {
          Comment: &comment,
          Crn: &crn,
          ExpiresAt: &expires_at,
          OverrideType: &override_type,
          OverridesDetails: &overrides_details,
          Reason: &reason,
          RuleID: &rule_id,
          TargetRegion: &target_region,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.createRuleOverride(
  {
    overrides: [{
        comment: "string",
        crn: "string",
        expiresAt: "string",
        overrideType: "string",
        overridesDetails: "string",
        reason: "string",
        ruleId: "string",
        targetRegion: "string"
      }]
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::cloud_policies_api::create_rule_override;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::CommonCreateRuleOverrideRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = CommonCreateRuleOverrideRequest {
        overrides: vec![SingleCreateRuleOverrideRequest {
            comment: Some("string".to_string()),
            crn: Some("string".to_string()),
            override_type: Some("string".to_string()),
            overrides_details: Some("string".to_string()),
            reason: Some("string".to_string()),
            rule_id: Some("string".to_string()),
            target_region: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = create_rule_override(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

body = Falcon::CommonCreateRuleOverrideRequest.new(
  overrides: [{
      comment: 'string',
      crn: 'string',
      expires_at: 'string',
      override_type: 'string',
      overrides_details: 'string',
      reason: 'string',
      rule_id: 'string',
      target_region: 'string'
    }]
)

response = api.create_rule_override(body)

puts response

Responses

200 OK

[
  "string"
]

400 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

CreateSuppressionRule

Create a new suppression rule

Method POST

Route /cloud-policies/entities/suppression-rules/v1

Scope Cloud Security Policies: WRITE

PEP 8 create_suppression_rule

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

description body · string

Description of the suppression rule.

domain body · string

Policy domain for the rule.

name body · string

Name of the suppression rule.

rule_selection_filter body · object

Filter criteria for selecting rules.

rule_selection_type body · string

Type of rule selection.

scope_asset_filter body · object

Filter criteria for scoping assets.

scope_type body · string

Type of scope for the rule.

subdomain body · string

Policy subdomain for the rule.

suppression_comment body · string

Comment explaining the suppression.

suppression_expiration_date body · string

Expiration date for the suppression.

suppression_reason body · string

Reason for the suppression.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

rule_selection_filter = {
    "rule_ids": [
        "string"
    ],
    "rule_names": [
        "string"
    ],
    "rule_origins": [
        "string"
    ],
    "rule_providers": [
        "string"
    ],
    "rule_services": [
        "string"
    ],
    "rule_severities": [
        "string"
    ]
}

scope_asset_filter = {
    "account_ids": [
        "string"
    ],
    "cloud_group_ids": [
        "string"
    ],
    "cloud_providers": [
        "string"
    ],
    "regions": [
        "string"
    ],
    "resource_ids": [
        "string"
    ],
    "resource_names": [
        "string"
    ],
    "resource_types": [
        "string"
    ],
    "service_categories": [
        "string"
    ],
    "tags": [
        "string"
    ]
}

response = falcon.create_suppression_rule(description="string",
                                          domain="string",
                                          name="string",
                                          rule_selection_filter=rule_selection_filter,
                                          rule_selection_type="string",
                                          scope_asset_filter=scope_asset_filter,
                                          scope_type="string",
                                          subdomain="string",
                                          suppression_comment="string",
                                          suppression_expiration_date="string",
                                          suppression_reason="string")
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

rule_selection_filter = {
    "rule_ids": [
        "string"
    ],
    "rule_names": [
        "string"
    ],
    "rule_origins": [
        "string"
    ],
    "rule_providers": [
        "string"
    ],
    "rule_services": [
        "string"
    ],
    "rule_severities": [
        "string"
    ]
}

scope_asset_filter = {
    "account_ids": [
        "string"
    ],
    "cloud_group_ids": [
        "string"
    ],
    "cloud_providers": [
        "string"
    ],
    "regions": [
        "string"
    ],
    "resource_ids": [
        "string"
    ],
    "resource_names": [
        "string"
    ],
    "resource_types": [
        "string"
    ],
    "service_categories": [
        "string"
    ],
    "tags": [
        "string"
    ]
}

response = falcon.CreateSuppressionRule(description="string",
                                        domain="string",
                                        name="string",
                                        rule_selection_filter=rule_selection_filter,
                                        rule_selection_type="string",
                                        scope_asset_filter=scope_asset_filter,
                                        scope_type="string",
                                        subdomain="string",
                                        suppression_comment="string",
                                        suppression_expiration_date="string",
                                        suppression_reason="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "domain": "string",
    "name": "string",
    "rule_selection_filter": {
        "rule_ids": ["string"],
        "rule_names": ["string"],
        "rule_origins": ["string"],
        "rule_providers": ["string"],
        "rule_resource_type_names": ["string"],
        "rule_risk_factors": ["string"],
        "rule_services": ["string"],
        "rule_severities": ["string"]
    },
    "rule_selection_type": "string",
    "scope_asset_filter": {
        "account_ids": ["string"],
        "cloud_group_ids": ["string"],
        "cloud_providers": ["string"],
        "regions": ["string"],
        "resource_ids": ["string"],
        "resource_names": ["string"],
        "resource_types": ["string"],
        "service_categories": ["string"],
        "tags": ["string"]
    },
    "scope_type": "string",
    "subdomain": "string",
    "suppression_comment": "string",
    "suppression_expiration_date": "string",
    "suppression_reason": "string"
}

response = falcon.command("CreateSuppressionRule", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  domain := "string"
  name := "string"
  rule_selection_type := "string"
  scope_type := "string"
  subdomain := "string"
  suppression_comment := "string"
  suppression_expiration_date := "string"
  suppression_reason := "string"

  response, err := client.CloudPolicies.CreateSuppressionRule(
    &cloud_policies.CreateSuppressionRuleParams{
      Body: &models.SuppressionrulesCreateSuppressionRuleRequest{
        Description: &description,
        Domain: &domain,
        Name: &name,
        RuleSelectionFilter: &struct{}{},
        RuleSelectionType: &rule_selection_type,
        ScopeAssetFilter: &struct{}{},
        ScopeType: &scope_type,
        Subdomain: &subdomain,
        SuppressionComment: &suppression_comment,
        SuppressionExpirationDate: &suppression_expiration_date,
        SuppressionReason: &suppression_reason,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.createSuppressionRule(
  {
    description: "string",
    domain: "string",
    name: "string",
    ruleSelectionFilter: {
      ruleIds: [],
      ruleNames: [],
      ruleOrigins: [],
      ruleProviders: [],
      ruleResourceTypeNames: [],
      ruleRiskFactors: [],
      ruleServices: [],
      ruleSeverities: []
    },
    ruleSelectionType: "string",
    scopeAssetFilter: {
      accountIds: [],
      cloudGroupIds: [],
      cloudProviders: [],
      regions: [],
      resourceIds: [],
      resourceNames: [],
      resourceTypes: [],
      serviceCategories: [],
      tags: []
    },
    scopeType: "string",
    subdomain: "string",
    suppressionComment: "string",
    suppressionExpirationDate: "string",
    suppressionReason: "string"
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

body = Falcon::SuppressionrulesCreateSuppressionRuleRequest.new(
  description: 'string',
  domain: 'string',
  name: 'string',
  rule_selection_filter: {
    rule_ids: [],
    rule_names: [],
    rule_origins: [],
    rule_providers: [],
    rule_resource_type_names: [],
    rule_risk_factors: [],
    rule_services: [],
    rule_severities: []
  },
  rule_selection_type: 'string',
  scope_asset_filter: {
    account_ids: [],
    cloud_group_ids: [],
    cloud_providers: [],
    regions: [],
    resource_ids: [],
    resource_names: [],
    resource_types: [],
    service_categories: [],
    tags: []
  },
  scope_type: 'string',
  subdomain: 'string',
  suppression_comment: 'string',
  suppression_expiration_date: 'string',
  suppression_reason: 'string'
)

response = api.create_suppression_rule(body)

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

---

---

DeleteComplianceControl

Delete custom compliance controls

Method DELETE

Route /cloud-policies/entities/compliance/controls/v1

Scope Cloud Security Policies: WRITE

PEP 8 delete_compliance_control

Parameters

ids query · string or list of strings

The uuids of compliance control to delete

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_compliance_control(ids=id_list)
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteComplianceControl(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteComplianceControl",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudPolicies.DeleteComplianceControl(
    &cloud_policies.DeleteComplianceControlParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.deleteComplianceControl(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.delete_compliance_control(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

DeleteComplianceFramework

Delete a custom compliance framework and all associated controls and rule assignments

Method DELETE

Route /cloud-policies/entities/compliance/frameworks/v1

Scope Cloud Security Policies: WRITE

PEP 8 delete_compliance_framework

Parameters

ids query · string

The uuids of compliance framework to delete

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_compliance_framework(ids=id_list)
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteComplianceFramework(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteComplianceFramework",
                          ids="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudPolicies.DeleteComplianceFramework(
    &cloud_policies.DeleteComplianceFrameworkParams{
      Ids: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.deleteComplianceFramework("string");  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.delete_compliance_framework('string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

DeleteRuleMixin0

Delete a rule

Method DELETE

Route /cloud-policies/entities/rules/v1

Scope Cloud Security Policies: WRITE

PEP 8 delete_rule

Parameters

ids query · string or list of strings

The uuids of rules to delete

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_rule(ids=id_list)
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteRuleMixin0(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteRuleMixin0",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudPolicies.DeleteRuleMixin0(
    &cloud_policies.DeleteRuleMixin0Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.deleteRuleMixin0(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::cloud_policies_api::delete_rule_mixin0;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_rule_mixin0(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.delete_rule_mixin0(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  "string"
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

DeleteRuleOverride

Delete a rule override

Method DELETE

Route /cloud-policies/entities/rule-overrides/v1

Scope Cloud Security Policies: WRITE

PEP 8 delete_rule_override

Parameters

ids query · string or list of strings

The uuids of rule overrides to delete

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_rule_override(ids=id_list)
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteRuleOverride(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteRuleOverride",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudPolicies.DeleteRuleOverride(
    &cloud_policies.DeleteRuleOverrideParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.deleteRuleOverride(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::cloud_policies_api::delete_rule_override;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_rule_override(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.delete_rule_override(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "asset_filter": {},
    "asset_scope_type": "string",
    "cid": "string",
    "comment": "string",
    "created_at": "string",
    "created_by": "string",
    "crn": "string",
    "deleted_at": "string",
    "deleted_by": "string",
    "expires_at": "string",
    "override_details": "string",
    "override_type": "string",
    "reason": "string",
    "rule_id": "string",
    "suppression_rule_id": "string",
    "target_region": "string",
    "update_reason": "string",
    "updated_at": "string",
    "updated_by": "string",
    "user_id": "string",
    "uuid": "string"
  }
]

204 No Content

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "asset_filter": {},
      "asset_scope_type": "string",
      "cid": "string",
      "comment": "string",
      "created_at": "string",
      "created_by": "string",
      "crn": "string",
      "deleted_at": "string",
      "deleted_by": "string",
      "expires_at": "string",
      "override_details": "string",
      "override_type": "string",
      "reason": "string",
      "rule_id": "string",
      "suppression_rule_id": "string",
      "target_region": "string",
      "update_reason": "string",
      "updated_at": "string",
      "updated_by": "string",
      "user_id": "string",
      "uuid": "string"
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

DeleteSuppressionRules

Delete Suppression Rules by ID

Method DELETE

Route /cloud-policies/entities/suppression-rules/v1

Scope Cloud Security Policies: WRITE

PEP 8 delete_suppression_rules

Parameters

ids query · string or list of strings

The uuids of the suppression rules to delete. A maximum of 10 IDs can be provided.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_suppression_rules(ids=id_list)
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteSuppressionRules(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteSuppressionRules",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudPolicies.DeleteSuppressionRules(
    &cloud_policies.DeleteSuppressionRulesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.deleteSuppressionRules(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.delete_suppression_rules(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "created_at": "string",
    "created_by": "string",
    "deleted_at": "string",
    "deleted_by": "string",
    "description": "string",
    "disabled": false,
    "domain": "string",
    "id": "string",
    "name": "string",
    "rule_ids": [],
    "rule_selection_count": 0,
    "rule_selection_filter": {},
    "rule_selection_type": "string",
    "scope_asset_filter": {},
    "scope_type": "string",
    "subdomain": "string",
    "suppression_comment": "string",
    "suppression_expiration_date": "string",
    "suppression_reason": "string",
    "update_reason": "string",
    "updated_at": "string",
    "updated_by": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "created_at": "string",
      "created_by": "string",
      "deleted_at": "string",
      "deleted_by": "string",
      "description": "string",
      "disabled": false,
      "domain": "string",
      "id": "string",
      "name": "string",
      "rule_ids": [],
      "rule_selection_count": 0,
      "rule_selection_filter": {},
      "rule_selection_type": "string",
      "scope_asset_filter": {},
      "scope_type": "string",
      "subdomain": "string",
      "suppression_comment": "string",
      "suppression_expiration_date": "string",
      "suppression_reason": "string",
      "update_reason": "string",
      "updated_at": "string",
      "updated_by": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "created_at": "string",
      "created_by": "string",
      "deleted_at": "string",
      "deleted_by": "string",
      "description": "string",
      "disabled": false,
      "domain": "string",
      "id": "string",
      "name": "string",
      "rule_ids": [],
      "rule_selection_count": 0,
      "rule_selection_filter": {},
      "rule_selection_type": "string",
      "scope_asset_filter": {},
      "scope_type": "string",
      "subdomain": "string",
      "suppression_comment": "string",
      "suppression_expiration_date": "string",
      "suppression_reason": "string",
      "update_reason": "string",
      "updated_at": "string",
      "updated_by": "string"
    }
  ]
}

---

---

GetComplianceControls

Get compliance controls by ID

Method GET

Route /cloud-policies/entities/compliance/controls/v1

Scope Cloud Security Policies: READ

PEP 8 get_compliance_controls

Parameters

ids query · string or list of strings

The uuids of compliance controls to retrieve

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_compliance_controls(ids=id_list)
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetComplianceControls(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetComplianceControls",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudPolicies.GetComplianceControls(
    &cloud_policies.GetComplianceControlsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.getComplianceControls(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::cloud_policies_api::get_compliance_controls;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_compliance_controls(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.get_compliance_controls(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "applicable_profiles": [],
    "authority": "string",
    "code": "string",
    "control_type": "string",
    "control_version": "string",
    "description": "string",
    "name": "string",
    "origin": "string",
    "requirement": "string",
    "section_name": "string",
    "security_framework": [],
    "uuid": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "applicable_profiles": [],
      "authority": "string",
      "code": "string",
      "control_type": "string",
      "control_version": "string",
      "description": "string",
      "name": "string",
      "origin": "string",
      "requirement": "string",
      "section_name": "string",
      "security_framework": [],
      "uuid": "string"
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

GetComplianceFrameworks

Get compliance frameworks by ID

Method GET

Route /cloud-policies/entities/compliance/frameworks/v1

Scope Cloud Security Policies: READ

PEP 8 get_compliance_frameworks

Parameters

ids query · string or list of strings

The uuids of compliance frameworks to retrieve

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_compliance_frameworks(ids=id_list)
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetComplianceFrameworks(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetComplianceFrameworks",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudPolicies.GetComplianceFrameworks(
    &cloud_policies.GetComplianceFrameworksParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.getComplianceFrameworks(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::cloud_policies_api::get_compliance_frameworks;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_compliance_frameworks(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.get_compliance_frameworks(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "active": false,
    "authority": "string",
    "description": "string",
    "name": "string",
    "uuid": "string",
    "version": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "active": false,
      "authority": "string",
      "description": "string",
      "name": "string",
      "uuid": "string",
      "version": "string"
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

GetEnrichedAsset

Gets enriched assets that combine a primary resource with all its related resources

Method GET

Route /cloud-policies/entities/enriched-resources/v1

Scope Cloud Security Policies: READ

PEP 8 get_enriched_asset

Parameters

ids query · string or list of strings

List of asset IDs (maximum 100 IDs allowed).

domain query · string

Rule domain (Currently only used for KAC Rego rules)

subdomain query · string

Rule subdomain (Currently only used for KAC Rego rules)

resource_type query · string

Currently the Resource type field is only used when KAC Rules are specified vai Domain: Runtime & Subdomain: IOM. For KAC rules, we return static sample data instead of real assets b/c we don’t have KAC payloads stored for customers. This field valued selects what sample data resource type we return which the UI shows in the Rego Editor to do test evaluations

Available values (9)

cronjobs	daemonsets	deployments
jobs	pods	replicasets
replicationcontrollers	services	statefulsets

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_enriched_asset(ids=id_list,
                                     domain="string",
                                     subdomain="string",
                                     resource_type="string")
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetEnrichedAsset(ids=id_list,
                                   domain="string",
                                   subdomain="string",
                                   resource_type="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetEnrichedAsset",
                          ids=id_list,
                          domain="string",
                          subdomain="string",
                          resource_type="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  domain := "string"
  subdomain := "string"
  resourceType := "string"

  response, err := client.CloudPolicies.GetEnrichedAsset(
    &cloud_policies.GetEnrichedAssetParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Domain: &domain,
      Subdomain: &subdomain,
      ResourceType: &resourceType,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.getEnrichedAsset(
  ["ID1", "ID2", "ID3"],  // ids
  "string",  // domain
  "string",  // subdomain
  "string"  // resourceType
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.get_enriched_asset(ids: ['ID1', 'ID2', 'ID3'],
                                  domain: 'string',
                                  subdomain: 'string',
                                  resource_type: 'string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

---

---

GetEvaluationResult

Gets evaluation results based on the provided rule

Method POST

Route /cloud-policies/entities/evaluation/v1

Scope Cloud Security Policies: WRITE

PEP 8 get_evaluation_result

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

domain body · string

input body · object

The input for the provided rule.

logic body · string

The logic of the provided rule.

subdomain body · string

cloud_provider query · string

Cloud Service Provider of the provided IDs

Available values (4)

aws	azure	gcp
oci

resource_type query · string

Resource Type of the provided IDs

ids query · string or list of strings

List of assets to evaluate (maximum 100 IDs allowed).

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

input = {}

response = falcon.get_evaluation_result(cloud_provider="string",
                                        resource_type="string",
                                        ids=id_list,
                                        input=input,
                                        logic="string")
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

input = {}

response = falcon.GetEvaluationResult(cloud_provider="string",
                                      resource_type="string",
                                      ids=id_list,
                                      input=input,
                                      logic="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "domain": "string",
    "input": {},
    "logic": "string",
    "subdomain": "string"
}

response = falcon.command("GetEvaluationResult",
                          cloud_provider="string",
                          resource_type="string",
                          ids=id_list,
                          body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  domain := "string"
  logic := "string"
  subdomain := "string"
  cloudProvider := "string"
  resourceType := "string"

  response, err := client.CloudPolicies.GetEvaluationResult(
    &cloud_policies.GetEvaluationResultParams{
      Body: &models.CommonEvaluationRequestPayload{
        Domain: &domain,
        Input: &struct{}{},
        Logic: &logic,
        Subdomain: &subdomain,
      },
      CloudProvider: &cloudProvider,
      ResourceType: &resourceType,
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.getEvaluationResult(
  {  // body
      domain: "string",
      input: {},
      logic: "string",
      subdomain: "string"
  },
  "string",  // cloudProvider
  "string",  // resourceType
  ["ID1", "ID2", "ID3"]  // ids
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

body = Falcon::CommonEvaluationRequestPayload.new(
  domain: 'string',
  input: {},
  logic: 'string',
  subdomain: 'string'
)

response = api.get_evaluation_result(body)

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

---

---

GetRule

Get a rule by id

Method GET

Route /cloud-policies/entities/rules/v1

Scope Cloud Security Policies: READ

PEP 8 get_rule

Parameters

ids query · string or list of strings

The uuids of rules to retrieve

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rule(ids=id_list)
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetRule(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetRule",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudPolicies.GetRule(
    &cloud_policies.GetRuleParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.getRule(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::cloud_policies_api::get_rule;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_rule(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.get_rule(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "alert_info": "string",
    "attack_types": [],
    "auto_remediable": false,
    "category": "string",
    "cid": "string",
    "cloneable": false,
    "controls": [],
    "created_at": "string",
    "created_by": "string",
    "custom_configuration": {},
    "deleted_at": "string",
    "deleted_by": "string",
    "deprecated": false,
    "description": "string",
    "domain": "string",
    "logic": "string",
    "logic_format": "string",
    "mitre_tactics_id": "string",
    "mitre_tactics_name": "string",
    "mitre_tactics_url": "string",
    "mitre_techniques_id": "string",
    "mitre_techniques_name": "string",
    "mitre_techniques_url": "string",
    "mutable": "string",
    "name": "string",
    "origin": "string",
    "overrides": [],
    "parent_rule__pk": 0,
    "parent_rule_short_code": 0,
    "parent_rule_short_uuid": "string",
    "platform": "string",
    "provider": "string",
    "remediation": "string",
    "remediation_url": "string",
    "resource_metadata": "string",
    "resource_types": [],
    "revision": 0,
    "rule_logic_list": [],
    "scope_asset_filter": {},
    "scope_type": "string",
    "severity": 0,
    "short_code": 0,
    "subdomain": "string",
    "update_reason": "string",
    "updated_at": "string",
    "updated_by": "string",
    "uuid": "string",
    "visible": false
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "alert_info": "string",
      "attack_types": [],
      "auto_remediable": false,
      "category": "string",
      "cid": "string",
      "cloneable": false,
      "controls": [],
      "created_at": "string",
      "created_by": "string",
      "custom_configuration": {},
      "deleted_at": "string",
      "deleted_by": "string",
      "deprecated": false,
      "description": "string",
      "domain": "string",
      "logic": "string",
      "logic_format": "string",
      "mitre_tactics_id": "string",
      "mitre_tactics_name": "string",
      "mitre_tactics_url": "string",
      "mitre_techniques_id": "string",
      "mitre_techniques_name": "string",
      "mitre_techniques_url": "string",
      "mutable": "string",
      "name": "string",
      "origin": "string",
      "overrides": [],
      "parent_rule__pk": 0,
      "parent_rule_short_code": 0,
      "parent_rule_short_uuid": "string",
      "platform": "string",
      "provider": "string",
      "remediation": "string",
      "remediation_url": "string",
      "resource_metadata": "string",
      "resource_types": [],
      "revision": 0,
      "rule_logic_list": [],
      "scope_asset_filter": {},
      "scope_type": "string",
      "severity": 0,
      "short_code": 0,
      "subdomain": "string",
      "update_reason": "string",
      "updated_at": "string",
      "updated_by": "string",
      "uuid": "string",
      "visible": false
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

GetRuleInputSchema

Get rule input schema for given resource type

Method GET

Route /cloud-policies/combined/rules/input-schema/v1

Scope Cloud Security Policies: READ

PEP 8 get_rule_input_schema

Parameters

domain query · string

domain

subdomain query · string

subdomain

cloud_provider query · string

Cloud service provider for the resource type

Available values (4)

aws	azure	gcp
oci

resource_type query · string

Selects the resource type for which to retrieve the rule input schema

enriched query · boolean

When true, returns the enriched schema with inlined related resource types. Defaults to true.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.get_rule_input_schema(domain="string",
                                        subdomain="string",
                                        cloud_provider="string",
                                        resource_type="string",
                                        enriched=boolean)
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.GetRuleInputSchema(domain="string",
                                     subdomain="string",
                                     cloud_provider="string",
                                     resource_type="string",
                                     enriched=boolean)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetRuleInputSchema",
                          domain="string",
                          subdomain="string",
                          cloud_provider="string",
                          resource_type="string",
                          enriched=boolean)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cloudProvider := "string"

  response, err := client.CloudPolicies.GetRuleInputSchema(
    &cloud_policies.GetRuleInputSchemaParams{
      Domain: "string",
      Subdomain: "string",
      CloudProvider: &cloudProvider,
      ResourceType: "string",
      Enriched: boolean,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.getRuleInputSchema(
  "string",  // domain
  "string",  // subdomain
  "string",  // resourceType
  "string",  // cloudProvider
  boolean  // enriched
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.get_rule_input_schema('string', 'string', 'string')

puts response

Responses

200 OK

[
  {}
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {}
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {}
  ]
}

---

---

GetRuleOverride

Get a rule override

Method GET

Route /cloud-policies/entities/rule-overrides/v1

Scope Cloud Security Policies: READ

PEP 8 get_rule_override

Parameters

ids query · string or list of strings

The uuids of rule overrides to retrieve

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rule_override(ids=id_list)
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetRuleOverride(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetRuleOverride",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudPolicies.GetRuleOverride(
    &cloud_policies.GetRuleOverrideParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.getRuleOverride(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::cloud_policies_api::get_rule_override;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_rule_override(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.get_rule_override(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "asset_filter": {},
    "asset_scope_type": "string",
    "cid": "string",
    "comment": "string",
    "created_at": "string",
    "created_by": "string",
    "crn": "string",
    "deleted_at": "string",
    "deleted_by": "string",
    "expires_at": "string",
    "override_details": "string",
    "override_type": "string",
    "reason": "string",
    "rule_id": "string",
    "suppression_rule_id": "string",
    "target_region": "string",
    "update_reason": "string",
    "updated_at": "string",
    "updated_by": "string",
    "user_id": "string",
    "uuid": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

GetSuppressionRules

Get Suppression Rules by ID

Method GET

Route /cloud-policies/entities/suppression-rules/v1

Scope Cloud Security Policies: READ

PEP 8 get_suppression_rules

Parameters

ids query · string or list of strings

The uuids of the suppression rules to retrieve

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_suppression_rules(ids=id_list)
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetSuppressionRules(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetSuppressionRules",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudPolicies.GetSuppressionRules(
    &cloud_policies.GetSuppressionRulesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.getSuppressionRules(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.get_suppression_rules(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "created_at": "string",
    "created_by": "string",
    "deleted_at": "string",
    "deleted_by": "string",
    "description": "string",
    "disabled": false,
    "domain": "string",
    "id": "string",
    "name": "string",
    "rule_ids": [],
    "rule_selection_count": 0,
    "rule_selection_filter": {},
    "rule_selection_type": "string",
    "scope_asset_filter": {},
    "scope_type": "string",
    "subdomain": "string",
    "suppression_comment": "string",
    "suppression_expiration_date": "string",
    "suppression_reason": "string",
    "update_reason": "string",
    "updated_at": "string",
    "updated_by": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "created_at": "string",
      "created_by": "string",
      "deleted_at": "string",
      "deleted_by": "string",
      "description": "string",
      "disabled": false,
      "domain": "string",
      "id": "string",
      "name": "string",
      "rule_ids": [],
      "rule_selection_count": 0,
      "rule_selection_filter": {},
      "rule_selection_type": "string",
      "scope_asset_filter": {},
      "scope_type": "string",
      "subdomain": "string",
      "suppression_comment": "string",
      "suppression_expiration_date": "string",
      "suppression_reason": "string",
      "update_reason": "string",
      "updated_at": "string",
      "updated_by": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "created_at": "string",
      "created_by": "string",
      "deleted_at": "string",
      "deleted_by": "string",
      "description": "string",
      "disabled": false,
      "domain": "string",
      "id": "string",
      "name": "string",
      "rule_ids": [],
      "rule_selection_count": 0,
      "rule_selection_filter": {},
      "rule_selection_type": "string",
      "scope_asset_filter": {},
      "scope_type": "string",
      "subdomain": "string",
      "suppression_comment": "string",
      "suppression_expiration_date": "string",
      "suppression_reason": "string",
      "update_reason": "string",
      "updated_at": "string",
      "updated_by": "string"
    }
  ]
}

---

---

QueryComplianceControls

Query for compliance controls by various parameters

Method GET

Route /cloud-policies/queries/compliance/controls/v1

Scope Cloud Security Policies: READ

PEP 8 query_compliance_controls

Parameters

filter query · string

FQL filter, allowed props:

Available values (7)

compliance_control_name	compliance_control_authority	compliance_control_type
compliance_control_section	compliance_control_requirement	compliance_control_benchmark_name
compliance_control_benchmark_version

limit query · integer

The maximum number of resources to return. The maximum allowed is 500.

offset query · integer

The number of results to skip before starting to return results.

sort query · string

Field to sort on. Sortable fields:

Available values (7)

compliance_control_name	compliance_control_authority	compliance_control_type
compliance_control_section	compliance_control_requirement	compliance_control_benchmark_name
compliance_control_benchmark_version

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.query_compliance_controls(filter="string",
                                            limit=integer,
                                            offset=integer,
                                            sort="string")
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.QueryComplianceControls(filter="string",
                                          limit=integer,
                                          offset=integer,
                                          sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryComplianceControls",
                          filter="string",
                          limit=integer,
                          offset=integer,
                          sort="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)
  sort := "string"

  response, err := client.CloudPolicies.QueryComplianceControls(
    &cloud_policies.QueryComplianceControlsParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.queryComplianceControls(
  "string",  // filter
  integer,  // limit
  integer,  // offset
  "string"  // sort
);

console.log(response);

Rust

use rusty_falcon::apis::cloud_policies_api::query_compliance_controls;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_compliance_controls(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.query_compliance_controls(filter: 'string',
                                         limit: integer,
                                         offset: integer,
                                         sort: 'string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

QueryComplianceFrameworks

Query for compliance frameworks by various parameters

Method GET

Route /cloud-policies/queries/compliance/frameworks/v1

Scope Cloud Security Policies: READ

PEP 8 query_compliance_frameworks

Parameters

filter query · string

FQL filter, allowed properties:

Available values (3)

compliance_framework_name

compliance_framework_version

compliance_framework_authority

limit query · integer

The maximum number of resources to return. The maximum allowed is 500.

offset query · integer

The number of results to skip before starting to return results.

sort query · string

Field to sort on. Sortable fields:

Available values (3)

compliance_framework_name

compliance_framework_version

compliance_framework_authority

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.query_compliance_frameworks(filter="string",
                                              limit=integer,
                                              offset=integer,
                                              sort="string")
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.QueryComplianceFrameworks(filter="string",
                                            limit=integer,
                                            offset=integer,
                                            sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryComplianceFrameworks",
                          filter="string",
                          limit=integer,
                          offset=integer,
                          sort="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)
  sort := "string"

  response, err := client.CloudPolicies.QueryComplianceFrameworks(
    &cloud_policies.QueryComplianceFrameworksParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.queryComplianceFrameworks(
  "string",  // filter
  integer,  // limit
  integer,  // offset
  "string"  // sort
);

console.log(response);

Rust

use rusty_falcon::apis::cloud_policies_api::query_compliance_frameworks;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_compliance_frameworks(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.query_compliance_frameworks(filter: 'string',
                                           limit: integer,
                                           offset: integer,
                                           sort: 'string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

QueryRule

Query for rules by various parameters

Method GET

Route /cloud-policies/queries/rules/v1

Scope Cloud Security Policies: READ

PEP 8 query_rule

Parameters

filter query · string

FQL filter, allowed properties:

Available values (27)

rule_auto_remediable	rule_category	rule_cloneable
rule_compliance_benchmark	rule_compliance_benchmark_uuid	rule_compliance_framework
rule_control_requirement	rule_control_section	rule_created_at
rule_description	rule_domain	rule_mitre_tactic
rule_mitre_technique	rule_name	rule_origin
rule_parent_uuid	rule_provider	rule_resource_type
rule_resource_type_name	rule_risk_factor	rule_service
rule_severity	rule_short_code	rule_status
rule_subdomain	rule_updated_at	rule_updated_by

limit query · integer

The maximum number of resources to return. The maximum allowed is 500.

offset query · integer

The number of results to skip before starting to return results.

sort query · string

Field to sort on. Sortable fields:

Available values (27)

rule_auto_remediable	rule_category	rule_cloneable
rule_compliance_benchmark	rule_compliance_benchmark_uuid	rule_compliance_framework
rule_control_requirement	rule_control_section	rule_created_at
rule_description	rule_domain	rule_mitre_tactic
rule_mitre_technique	rule_name	rule_origin
rule_parent_uuid	rule_provider	rule_resource_type
rule_resource_type_name	rule_risk_factor	rule_service
rule_severity	rule_short_code	rule_status
rule_subdomain	rule_updated_at	rule_updated_by

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.query_rule(filter="string",
                             limit=integer,
                             offset=integer,
                             sort="string")
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.QueryRule(filter="string",
                            limit=integer,
                            offset=integer,
                            sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryRule",
                          filter="string",
                          limit=integer,
                          offset=integer,
                          sort="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)
  sort := "string"

  response, err := client.CloudPolicies.QueryRule(
    &cloud_policies.QueryRuleParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.queryRule(
  "string",  // filter
  integer,  // limit
  integer,  // offset
  "string"  // sort
);

console.log(response);

Rust

use rusty_falcon::apis::cloud_policies_api::query_rule;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_rule(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.query_rule(filter: 'string',
                          limit: integer,
                          offset: integer,
                          sort: 'string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

---

---

QuerySuppressionRules

Query suppression rules with filtering, sorting and pagination

Method GET

Route /cloud-policies/queries/suppression-rules/v1

Scope Cloud Security Policies: READ

PEP 8 query_suppression_rules

Parameters

filter query · string

FQL expression to filter suppression rules. The allowed properties are:

Available values (11)

name	description	domain
subdomain	suppression_expiration_date	suppression_reason
created_by	created_at	last_modified_at
disabled	groups

limit query · integer

The maximum number of resources to return. The maximum allowed is 50.

offset query · integer

The number of results to skip before starting to return results.

sort query · string

Field to sort on. Sortable fields:

Available values (11)

name	description	domain
subdomain	suppression_expiration_date	suppression_reason
created_by	created_at	last_modified_at
disabled	groups

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.query_suppression_rules(filter="string",
                                          limit=integer,
                                          offset=integer,
                                          sort="string")
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.QuerySuppressionRules(filter="string",
                                        limit=integer,
                                        offset=integer,
                                        sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QuerySuppressionRules",
                          filter="string",
                          limit=integer,
                          offset=integer,
                          sort="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)
  sort := "string"

  response, err := client.CloudPolicies.QuerySuppressionRules(
    &cloud_policies.QuerySuppressionRulesParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.querySuppressionRules(
  "string",  // filter
  integer,  // limit
  integer,  // offset
  "string"  // sort
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

response = api.query_suppression_rules(filter: 'string',
                                       limit: integer,
                                       offset: integer,
                                       sort: 'string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

---

---

RenameSectionComplianceFramework

Rename a section in a custom compliance framework

Method PATCH

Route /cloud-policies/entities/compliance/frameworks/section/v1

Scope Cloud Security Policies: WRITE

PEP 8 rename_section_compliance_framework

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

ids query · string

The uuid of compliance framework containing the section to rename

sectionName query · string

The current name of the section to rename

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.rename_section_compliance_framework(ids=id_list,
                                                      sectionName="string",
                                                      section_name="string")
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RenameSectionComplianceFramework(ids=id_list,
                                                   sectionName="string",
                                                   section_name="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "section_name": "string"
}

response = falcon.command("RenameSectionComplianceFramework",
                          ids="string",
                          section_name="string",
                          body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  section_name := "string"

  response, err := client.CloudPolicies.RenameSectionComplianceFramework(
    &cloud_policies.RenameSectionComplianceFrameworkParams{
      Body: &models.CommonRenameSectionRequest{
        SectionName: &section_name,
      },
      Ids: "string",
      SectionName: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.renameSectionComplianceFramework(
  "string",  // ids
  "string",  // sectionName
  {  // body
      sectionName: "string"
  }
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

body = Falcon::CommonRenameSectionRequest.new(
  section_name: 'string'
)

response = api.rename_section_compliance_framework(body, 'string', 'string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReplaceControlRules

Assign rules to a compliance control (full replace)

Method PUT

Route /cloud-policies/entities/compliance/control-rule-assignments/v1

Scope Cloud Security Policies: WRITE

PEP 8 replace_control_rules

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

rule_ids body · array

The ids of the rules to replace.

ids query · string

The UUID of the compliance control to assign rules to

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.replace_control_rules(ids=id_list, rule_ids=id_list)
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ReplaceControlRules(ids=id_list, rule_ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "rule_ids": ["string"]
}

response = falcon.command("ReplaceControlRules",
                          ids="string",
                          body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudPolicies.ReplaceControlRules(
    &cloud_policies.ReplaceControlRulesParams{
      Body: &models.CommonAssignRulesToControlRequest{
        RuleIds: []string{"string"},
      },
      Ids: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.replaceControlRules(
  "string",  // ids
  {  // body
      ruleIds: []
  }
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

body = Falcon::CommonAssignRulesToControlRequest.new(
  rule_ids: []
)

response = api.replace_control_rules(body, 'string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

UpdateComplianceControl

Update a custom compliance control

Method PATCH

Route /cloud-policies/entities/compliance/controls/v1

Scope Cloud Security Policies: WRITE

PEP 8 update_compliance_control

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

description body · string

The description of hte custom compliance control.

name body · string

The name of the custom compliance control.

ids query · string

The uuid of compliance control to update

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_compliance_control(ids=id_list,
                                            description="string",
                                            name="string")
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.UpdateComplianceControl(ids=id_list,
                                          description="string",
                                          name="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "description": "string",
    "name": "string"
}

response = falcon.command("UpdateComplianceControl",
                          ids="string",
                          body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  name := "string"

  response, err := client.CloudPolicies.UpdateComplianceControl(
    &cloud_policies.UpdateComplianceControlParams{
      Body: &models.CommonUpdateComplianceControlRequest{
        Description: &description,
        Name: &name,
      },
      Ids: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.updateComplianceControl(
  "string",  // ids
  {  // body
      description: "string",
      name: "string"
  }
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

body = Falcon::CommonUpdateComplianceControlRequest.new(
  description: 'string',
  name: 'string'
)

response = api.update_compliance_control(body, 'string')

puts response

Responses

200 OK

[
  {
    "applicable_profiles": [],
    "authority": "string",
    "code": "string",
    "control_type": "string",
    "control_version": "string",
    "description": "string",
    "name": "string",
    "origin": "string",
    "requirement": "string",
    "section_name": "string",
    "security_framework": [],
    "uuid": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

UpdateComplianceFramework

Update a custom compliance framework

Method PATCH

Route /cloud-policies/entities/compliance/frameworks/v1

Scope Cloud Security Policies: WRITE

PEP 8 update_compliance_framework

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

active body · boolean

Value to determine if the compliance framework will be active.

description body · string

The description of the new compliance framework.

name body · string

The name of the new compliance framework.

ids query · string

The uuids of compliance framework to update

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_compliance_framework(ids=id_list,
                                              active=boolean,
                                              description="string",
                                              name="string")
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.UpdateComplianceFramework(ids=id_list,
                                            active=boolean,
                                            description="string",
                                            name="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "active": boolean,
    "description": "string",
    "name": "string"
}

response = falcon.command("UpdateComplianceFramework",
                          ids="string",
                          body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  active := boolean
  description := "string"
  name := "string"

  response, err := client.CloudPolicies.UpdateComplianceFramework(
    &cloud_policies.UpdateComplianceFrameworkParams{
      Body: &models.CommonUpdateComplianceFrameworkRequest{
        Active: &active,
        Description: &description,
        Name: &name,
      },
      Ids: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.updateComplianceFramework(
  "string",  // ids
  {  // body
      active: boolean,
      description: "string",
      name: "string"
  }
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

body = Falcon::CommonUpdateComplianceFrameworkRequest.new(
  active: boolean,
  description: 'string',
  name: 'string'
)

response = api.update_compliance_framework(body, 'string')

puts response

Responses

200 OK

[
  {
    "active": false,
    "authority": "string",
    "description": "string",
    "name": "string",
    "uuid": "string",
    "version": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

409 Conflict

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

UpdateRule

Update a rule

Method PATCH

Route /cloud-policies/entities/rules/v1

Scope Cloud Security Policies: WRITE

PEP 8 update_rule

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

alert_info body · string

The info of the alert.

attack_types body · array

The type of attacks.

category body · string

controls body · array

The authority and code of the rule.

description body · string

The description of the rule.

name body · string

The name of the rule.

rule_logic_list body · array

The logic list data.

severity body · integer

The severity level.

uuid body · string

The uuid of the rule to update.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

controls = [
    {
        "authority": "string",
        "code": "string"
    }
]

rule_logic_list = [
    {
        "logic": "string",
        "platform": "string",
        "remediation_info": "string",
        "remediation_url": "string"
    }
]

response = falcon.update_rule(alert_info="string",
                              attack_types=id_list,
                              controls=controls,
                              description="string",
                              name="string",
                              rule_logic_list=rule_logic_list,
                              severity=integer,
                              uuid="string")
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

controls = [
    {
        "authority": "string",
        "code": "string"
    }
]

rule_logic_list = [
    {
        "logic": "string",
        "platform": "string",
        "remediation_info": "string",
        "remediation_url": "string"
    }
]

response = falcon.UpdateRule(alert_info="string",
                             attack_types=id_list,
                             controls=controls,
                             description="string",
                             name="string",
                             rule_logic_list=rule_logic_list,
                             severity=integer,
                             uuid="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "alert_info": "string",
    "attack_types": ["string"],
    "category": "string",
    "controls": [
        {
            "authority": "string",
            "code": "string"
        }
    ],
    "description": "string",
    "name": "string",
    "rule_logic_list": [
        {
            "logic": "string",
            "modules": {},
            "platform": "string",
            "remediation_info": "string",
            "remediation_url": "string"
        }
    ],
    "severity": integer,
    "uuid": "string"
}

response = falcon.command("UpdateRule", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  alert_info := "string"
  category := "string"
  authority := "string"
  code := "string"
  description := "string"
  name := "string"
  logic := "string"
  platform := "string"
  remediation_info := "string"
  remediation_url := "string"
  severity := integer
  uuid := "string"

  response, err := client.CloudPolicies.UpdateRule(
    &cloud_policies.UpdateRuleParams{
      Body: &models.CommonUpdateRuleRequest{
        AlertInfo: &alert_info,
        AttackTypes: []string{"string"},
        Category: &category,
        Controls: []interface{}{
          {
          Authority: &authority,
          Code: &code,
          },
        },
        Description: &description,
        Name: &name,
        RuleLogicList: []interface{}{
          {
          Logic: &logic,
          Modules: &struct{}{},
          Platform: &platform,
          RemediationInfo: &remediation_info,
          RemediationUrl: &remediation_url,
          },
        },
        Severity: &severity,
        Uuid: &uuid,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.updateRule(
  {
    alertInfo: "string",
    attackTypes: [],
    category: "string",
    controls: [{
        authority: "string",
        code: "string"
      }],
    description: "string",
    name: "string",
    ruleLogicList: [{
        logic: "string",
        modules: {},
        platform: "string",
        remediationInfo: "string",
        remediationUrl: "string"
      }],
    severity: integer,
    uuid: "string"
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::cloud_policies_api::update_rule;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::CommonUpdateRuleRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = CommonUpdateRuleRequest {
        uuid: Some("string".to_string()),
        ..Default::default()
    };

    let response = update_rule(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

body = Falcon::CommonUpdateRuleRequest.new(
  alert_info: 'string',
  attack_types: [],
  category: 'string',
  controls: [{
      authority: 'string',
      code: 'string'
    }],
  description: 'string',
  name: 'string',
  rule_logic_list: [{
      logic: 'string',
      modules: {},
      platform: 'string',
      remediation_info: 'string',
      remediation_url: 'string'
    }],
  severity: integer,
  uuid: 'string'
)

response = api.update_rule(body)

puts response

Responses

200 OK

[
  {
    "alert_info": "string",
    "attack_types": [],
    "auto_remediable": false,
    "category": "string",
    "cid": "string",
    "cloneable": false,
    "controls": [],
    "created_at": "string",
    "created_by": "string",
    "custom_configuration": {},
    "deleted_at": "string",
    "deleted_by": "string",
    "deprecated": false,
    "description": "string",
    "domain": "string",
    "logic": "string",
    "logic_format": "string",
    "mitre_tactics_id": "string",
    "mitre_tactics_name": "string",
    "mitre_tactics_url": "string",
    "mitre_techniques_id": "string",
    "mitre_techniques_name": "string",
    "mitre_techniques_url": "string",
    "mutable": "string",
    "name": "string",
    "origin": "string",
    "overrides": [],
    "parent_rule__pk": 0,
    "parent_rule_short_code": 0,
    "parent_rule_short_uuid": "string",
    "platform": "string",
    "provider": "string",
    "remediation": "string",
    "remediation_url": "string",
    "resource_metadata": "string",
    "resource_types": [],
    "revision": 0,
    "rule_logic_list": [],
    "scope_asset_filter": {},
    "scope_type": "string",
    "severity": 0,
    "short_code": 0,
    "subdomain": "string",
    "update_reason": "string",
    "updated_at": "string",
    "updated_by": "string",
    "uuid": "string",
    "visible": false
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

409 Conflict

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

UpdateRuleOverride

Update a rule override

Method PATCH

Route /cloud-policies/entities/rule-overrides/v1

Scope Cloud Security Policies: WRITE

PEP 8 update_rule_override

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

overrides body · array

The new rule override.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

overrides = [
    {
        "comment": "string",
        "crn": "string",
        "expires_at": "2025-11-10T21:16:14.315Z",
        "override_type": "string",
        "overrides_details": "string",
        "reason": "string",
        "rule_id": "string",
        "target_region": "string"
    }
]

response = falcon.update_rule_override(overrides=overrides)
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

overrides = [
    {
        "comment": "string",
        "crn": "string",
        "expires_at": "2025-11-10T21:16:14.315Z",
        "override_type": "string",
        "overrides_details": "string",
        "reason": "string",
        "rule_id": "string",
        "target_region": "string"
    }
]

response = falcon.UpdateRuleOverride(overrides=overrides)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "overrides": [
        {
            "comment": "string",
            "crn": "string",
            "expires_at": "string",
            "override_type": "string",
            "overrides_details": "string",
            "reason": "string",
            "rule_id": "string",
            "target_region": "string"
        }
    ]
}

response = falcon.command("UpdateRuleOverride", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  crn := "string"
  expires_at := "string"
  override_type := "string"
  overrides_details := "string"
  reason := "string"
  rule_id := "string"
  target_region := "string"

  response, err := client.CloudPolicies.UpdateRuleOverride(
    &cloud_policies.UpdateRuleOverrideParams{
      Body: &models.CommonUpdateRuleOverrideRequest{
        Overrides: []interface{}{
          {
          Comment: &comment,
          Crn: &crn,
          ExpiresAt: &expires_at,
          OverrideType: &override_type,
          OverridesDetails: &overrides_details,
          Reason: &reason,
          RuleID: &rule_id,
          TargetRegion: &target_region,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.updateRuleOverride(
  {
    overrides: [{
        comment: "string",
        crn: "string",
        expiresAt: "string",
        overrideType: "string",
        overridesDetails: "string",
        reason: "string",
        ruleId: "string",
        targetRegion: "string"
      }]
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::cloud_policies_api::update_rule_override;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::CommonUpdateRuleOverrideRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = CommonUpdateRuleOverrideRequest {
        overrides: vec![SingleCreateRuleOverrideRequest {
            comment: Some("string".to_string()),
            crn: Some("string".to_string()),
            override_type: Some("string".to_string()),
            overrides_details: Some("string".to_string()),
            reason: Some("string".to_string()),
            rule_id: Some("string".to_string()),
            target_region: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = update_rule_override(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

body = Falcon::CommonUpdateRuleOverrideRequest.new(
  overrides: [{
      comment: 'string',
      crn: 'string',
      expires_at: 'string',
      override_type: 'string',
      overrides_details: 'string',
      reason: 'string',
      rule_id: 'string',
      target_region: 'string'
    }]
)

response = api.update_rule_override(body)

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

UpdateSuppressionRule

Update a suppression rule

Method PATCH

Route /cloud-policies/entities/suppression-rules/v1

Scope Cloud Security Policies: WRITE

PEP 8 update_suppression_rule

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

description body · string

Description of the suppression rule.

id body · string

Identifier of the suppression rule to update.

name body · string

Name of the suppression rule.

rule_selection_filter body · object

Filter criteria for selecting rules.

rule_selection_type body · string

Type of rule selection.

scope_asset_filter body · object

Filter criteria for scoping assets.

scope_type body · string

Type of scope for the rule.

suppression_comment body · string

Comment explaining the suppression.

suppression_expiration_date body · string

Expiration date for the suppression.

suppression_reason body · string

Reason for the suppression.

Code Examples

Python

PEP 8

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

rule_selection_filter = {
    "rule_ids": [
        "string"
    ],
    "rule_names": [
        "string"
    ],
    "rule_origins": [
        "string"
    ],
    "rule_providers": [
        "string"
    ],
    "rule_services": [
        "string"
    ],
    "rule_severities": [
        "string"
    ]
}

scope_asset_filter = {
    "account_ids": [
        "string"
    ],
    "cloud_group_ids": [
        "string"
    ],
    "cloud_providers": [
        "string"
    ],
    "regions": [
        "string"
    ],
    "resource_ids": [
        "string"
    ],
    "resource_names": [
        "string"
    ],
    "resource_types": [
        "string"
    ],
    "service_categories": [
        "string"
    ],
    "tags": [
        "string"
    ]
}

response = falcon.update_suppression_rule(description="string",
                                          id="string",
                                          name="string",
                                          rule_selection_filter=rule_selection_filter,
                                          rule_selection_type="string",
                                          scope_asset_filter=scope_asset_filter,
                                          scope_type="string",
                                          suppression_comment="string",
                                          suppression_expiration_date="string",
                                          suppression_reason="string")
print(response)

Operation ID

from falconpy import CloudPolicies

falcon = CloudPolicies(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

rule_selection_filter = {
    "rule_ids": [
        "string"
    ],
    "rule_names": [
        "string"
    ],
    "rule_origins": [
        "string"
    ],
    "rule_providers": [
        "string"
    ],
    "rule_services": [
        "string"
    ],
    "rule_severities": [
        "string"
    ]
}

scope_asset_filter = {
    "account_ids": [
        "string"
    ],
    "cloud_group_ids": [
        "string"
    ],
    "cloud_providers": [
        "string"
    ],
    "regions": [
        "string"
    ],
    "resource_ids": [
        "string"
    ],
    "resource_names": [
        "string"
    ],
    "resource_types": [
        "string"
    ],
    "service_categories": [
        "string"
    ],
    "tags": [
        "string"
    ]
}

response = falcon.UpdateSuppressionRule(description="string",
                                        id="string",
                                        name="string",
                                        rule_selection_filter=rule_selection_filter,
                                        rule_selection_type="string",
                                        scope_asset_filter=scope_asset_filter,
                                        scope_type="string",
                                        suppression_comment="string",
                                        suppression_expiration_date="string",
                                        suppression_reason="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "id": "string",
    "name": "string",
    "rule_selection_filter": {
        "rule_ids": ["string"],
        "rule_names": ["string"],
        "rule_origins": ["string"],
        "rule_providers": ["string"],
        "rule_resource_type_names": ["string"],
        "rule_risk_factors": ["string"],
        "rule_services": ["string"],
        "rule_severities": ["string"]
    },
    "rule_selection_type": "string",
    "scope_asset_filter": {
        "account_ids": ["string"],
        "cloud_group_ids": ["string"],
        "cloud_providers": ["string"],
        "regions": ["string"],
        "resource_ids": ["string"],
        "resource_names": ["string"],
        "resource_types": ["string"],
        "service_categories": ["string"],
        "tags": ["string"]
    },
    "scope_type": "string",
    "suppression_comment": "string",
    "suppression_expiration_date": "string",
    "suppression_reason": "string"
}

response = falcon.command("UpdateSuppressionRule", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  id := "string"
  name := "string"
  rule_selection_type := "string"
  scope_type := "string"
  suppression_comment := "string"
  suppression_expiration_date := "string"
  suppression_reason := "string"

  response, err := client.CloudPolicies.UpdateSuppressionRule(
    &cloud_policies.UpdateSuppressionRuleParams{
      Body: &models.SuppressionrulesUpdateSuppressionRuleRequest{
        Description: &description,
        ID: &id,
        Name: &name,
        RuleSelectionFilter: &struct{}{},
        RuleSelectionType: &rule_selection_type,
        ScopeAssetFilter: &struct{}{},
        ScopeType: &scope_type,
        SuppressionComment: &suppression_comment,
        SuppressionExpirationDate: &suppression_expiration_date,
        SuppressionReason: &suppression_reason,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudPolicies.updateSuppressionRule(
  {
    description: "string",
    id: "string",
    name: "string",
    ruleSelectionFilter: {
      ruleIds: [],
      ruleNames: [],
      ruleOrigins: [],
      ruleProviders: [],
      ruleResourceTypeNames: [],
      ruleRiskFactors: [],
      ruleServices: [],
      ruleSeverities: []
    },
    ruleSelectionType: "string",
    scopeAssetFilter: {
      accountIds: [],
      cloudGroupIds: [],
      cloudProviders: [],
      regions: [],
      resourceIds: [],
      resourceNames: [],
      resourceTypes: [],
      serviceCategories: [],
      tags: []
    },
    scopeType: "string",
    suppressionComment: "string",
    suppressionExpirationDate: "string",
    suppressionReason: "string"
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudPolicies.new

body = Falcon::SuppressionrulesUpdateSuppressionRuleRequest.new(
  description: 'string',
  id: 'string',
  name: 'string',
  rule_selection_filter: {
    rule_ids: [],
    rule_names: [],
    rule_origins: [],
    rule_providers: [],
    rule_resource_type_names: [],
    rule_risk_factors: [],
    rule_services: [],
    rule_severities: []
  },
  rule_selection_type: 'string',
  scope_asset_filter: {
    account_ids: [],
    cloud_group_ids: [],
    cloud_providers: [],
    regions: [],
    resource_ids: [],
    resource_names: [],
    resource_types: [],
    service_categories: [],
    tags: []
  },
  scope_type: 'string',
  suppression_comment: 'string',
  suppression_expiration_date: 'string',
  suppression_reason: 'string'
)

response = api.update_suppression_rule(body)

puts response

Responses

200 OK

[
  {
    "created_at": "string",
    "created_by": "string",
    "deleted_at": "string",
    "deleted_by": "string",
    "description": "string",
    "disabled": false,
    "domain": "string",
    "id": "string",
    "name": "string",
    "rule_ids": [],
    "rule_selection_count": 0,
    "rule_selection_filter": {},
    "rule_selection_type": "string",
    "scope_asset_filter": {},
    "scope_type": "string",
    "subdomain": "string",
    "suppression_comment": "string",
    "suppression_expiration_date": "string",
    "suppression_reason": "string",
    "update_reason": "string",
    "updated_at": "string",
    "updated_by": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "created_at": "string",
      "created_by": "string",
      "deleted_at": "string",
      "deleted_by": "string",
      "description": "string",
      "disabled": false,
      "domain": "string",
      "id": "string",
      "name": "string",
      "rule_ids": [],
      "rule_selection_count": 0,
      "rule_selection_filter": {},
      "rule_selection_type": "string",
      "scope_asset_filter": {},
      "scope_type": "string",
      "subdomain": "string",
      "suppression_comment": "string",
      "suppression_expiration_date": "string",
      "suppression_reason": "string",
      "update_reason": "string",
      "updated_at": "string",
      "updated_by": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "created_at": "string",
      "created_by": "string",
      "deleted_at": "string",
      "deleted_by": "string",
      "description": "string",
      "disabled": false,
      "domain": "string",
      "id": "string",
      "name": "string",
      "rule_ids": [],
      "rule_selection_count": 0,
      "rule_selection_filter": {},
      "rule_selection_type": "string",
      "scope_asset_filter": {},
      "scope_type": "string",
      "subdomain": "string",
      "suppression_comment": "string",
      "suppression_expiration_date": "string",
      "suppression_reason": "string",
      "update_reason": "string",
      "updated_at": "string",
      "updated_by": "string"
    }
  ]
}