Cloud Security Assets

The Cloud Security Assets service collection provides operations for querying and retrieving cloud resource data across your environment. Find assets by application resource, retrieve compliance data by account, fetch raw resource details by ID, and query the full asset inventory using FQL filters.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
cloud-security-assets-combined-application-findings combined_application_findings	Get findings for an application resource with pagination
cloud-security-assets-combined-compliance-by-account get_combined_compliance_by_account	Gets combined compliance data aggregated by account and region.
cloud-security-assets-entities-get get_assets	Gets raw resources based on the provided IDs param.
cloud-security-assets-entities-post cloud_security_assets_entities_post	Gets raw resources based on IDs in the request body.
cloud-security-assets-queries query_assets	Gets a list of resource IDs for the given parameters, filters and sort criteria

---

cloud-security-assets-combined-application-findings

Get findings for an application resource with pagination

Method GET

Route /cloud-security-assets/combined/application-findings/v1

Scope Cloud Security API Assets: READ

PEP 8 combined_application_findings

Parameters

crn query · string

Deprecated: Use ‘gcrn’ instead. Application CRN

gcrn query · string

Application GCRN

type query · string

Finding type

filter query · string

FQL string to filter findings.

offset query · integer

Pagination offset

limit query · integer

Page size

sort query · string

Sort expression in the format field|direction (e.g. key|desc), where direction is asc or desc. Sortable fields:

Available values (5)

depend	on	the
finding	type

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudSecurityAssets

falcon = CloudSecurityAssets(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.combined_application_findings(crn="string",
                                                gcrn="string",
                                                type="string",
                                                filter="string",
                                                offset=integer,
                                                limit=integer,
                                                sort="string")
print(response)

Operation ID

from falconpy import CloudSecurityAssets

falcon = CloudSecurityAssets(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.cloud_security_assets_combined_application_findings(crn="string",
                                                                      gcrn="string",
                                                                      type="string",
                                                                      filter="string",
                                                                      offset=integer,
                                                                      limit=integer,
                                                                      sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("cloud_security_assets_combined_application_findings",
                          crn="string",
                          gcrn="string",
                          type="string",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_security_assets"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  crn := "string"
  gcrn := "string"
  filter := "string"
  offset := int64(0)
  limit := int64(0)

  response, err := client.CloudSecurityAssets.CloudSecurityAssetsCombinedApplicationFindings(
    &cloud_security_assets.CloudSecurityAssetsCombinedApplicationFindingsParams{
      Crn: &crn,
      Gcrn: &gcrn,
      Type: "string",
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudSecurityAssets.cloudSecurityAssetsCombinedApplicationFindings(
  "string",  // type
  "string",  // crn
  "string",  // gcrn
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudSecurityAssets.new

response = api.cloud_security_assets_combined_application_findings('string')

puts response

Responses

200 OK

[
  {
    "crn": "string",
    "finding_type": "string",
    "findings": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

408 Request Timeout

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "next": "string",
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

cloud-security-assets-combined-compliance-by-account

Gets combined compliance data aggregated by account and region.

Method GET

Route /cloud-security-assets/combined/compliance-controls/by-account-region-and-resource-type/v1

Scope Cloud Security API Assets: READ

PEP 8 get_combined_compliance_by_account

Parameters

filter query · string

FQL string to filter on asset contents. Filterable fields include: - account_id - account_name - aspm.cloud_account - aspm.cloud_region - aspm.cloud_tag_key - aspm.cloud_tag_value - aspm.cloud_tags - aspm.deployment_provider - assessment_id - business_impact - cloud_group - cloud_label - cloud_label_id - cloud_provider - cloud_scope - compliant - control.benchmark.name - control.benchmark.version - control.extension.status - control.framework - control.name - control.type - control.version - environment - last_evaluated - region - resource_gcrn - resource_provider - resource_type - resource_type_name - service - service_category - severities - tag_key - tag_value - tags_string

Available values (29)

account_id	account_name	assessment_id
business_impact	cloud_group	cloud_label
cloud_label_id	cloud_provider	cloud_scope
compliant	control.benchmark.name	control.benchmark.version
control.extension.status	control.framework	control.name
control.type	control.version	environment
last_evaluated	region	resource_provider
resource_type	resource_type_name	service
service_category	severities	tag_key
tag_value	tags_string

sort query · string

Sort expression in format: field|direction (e.g., last_evaluated|desc). Allowed sort fields: - account_id - account_name - assessment_id - cloud_provider - control.benchmark.name - control.benchmark.version - control.framework - control.name - control.type - control.version - last_evaluated - region - resource_counts.compliant - resource_counts.non_compliant - resource_counts.total - resource_provider - resource_type - resource_type_name - service - service_category

Available values (20)

account_id	account_name	assessment_id
cloud_provider	control.benchmark.name	control.benchmark.version
control.framework	control.name	control.type
control.version	last_evaluated	region
resource_counts.compliant	resource_counts.non_compliant	resource_counts.total
resource_provider	resource_type	resource_type_name
service	service_category

limit query · integer

The maximum number of items to return. When not specified or 0, 20 is used. When larger than 10000, 10000 is used.

offset query · integer

Offset returned controls. Use only one of ‘offset’ and ‘after’ parameter for paginating. ‘offset’ can only be used on offsets < 10,000. For paginating through the entire result set, use ‘after’ parameter

after query · string

token-based pagination. use for paginating through an entire result set. Use only one of:

Available values (6)

offset	and	after
parameters	for	paginating

include_failing_iom_severity_counts query · boolean

Include counts of failing IOMs by severity level

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudSecurityAssets

falcon = CloudSecurityAssets(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.get_combined_compliance_by_account(filter="string",
                                                     sort="string",
                                                     limit=integer,
                                                     offset=integer,
                                                     after="string",
                                                     include_failing_iom_severity_counts=boolean)
print(response)

Operation ID

from falconpy import CloudSecurityAssets

falcon = CloudSecurityAssets(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.cloud_security_assets_combined_compliance_by_account(filter="string",
                                                                       sort="string",
                                                                       limit=integer,
                                                                       offset=integer,
                                                                       after="string",
                                                                       include_failing_iom_severity_counts=boolean)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("cloud_security_assets_combined_compliance_by_account",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer,
                          after="string",
                          include_failing_iom_severity_counts=boolean)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_security_assets"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)
  after := "string"
  includeFailingIomSeverityCounts := boolean

  response, err := client.CloudSecurityAssets.CloudSecurityAssetsCombinedComplianceByAccount(
    &cloud_security_assets.CloudSecurityAssetsCombinedComplianceByAccountParams{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      After: &after,
      IncludeFailingIomSeverityCounts: &includeFailingIomSeverityCounts,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudSecurityAssets.cloudSecurityAssetsCombinedComplianceByAccount(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer,  // offset
  "string",  // after
  boolean  // includeFailingIomSeverityCounts
);

console.log(response);

Rust

use rusty_falcon::apis::cloud_security_assets_api::cloud_security_assets_combined_compliance_by_account;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = cloud_security_assets_combined_compliance_by_account(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
        Some("string"),  // after
        Some(boolean),  // include_failing_iom_severity_counts
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudSecurityAssets.new

response = api.cloud_security_assets_combined_compliance_by_account(filter: 'string',
                                                                    sort: 'string',
                                                                    limit: integer,
                                                                    offset: integer,
                                                                    after: 'string',
                                                                    include_failing_iom_severity_counts: boolean)

puts response

Responses

200 OK

[
  {
    "account_id": "string",
    "account_name": "string",
    "assessment_id": "string",
    "cloud_groups": [],
    "cloud_groups_v2": [],
    "cloud_labels": [],
    "cloud_provider": "string",
    "control": {},
    "gcrn": "string",
    "groups": [],
    "last_evaluated": "string",
    "region": "string",
    "resource_counts": {},
    "resource_provider": "string",
    "resource_type": "string",
    "resource_type_name": "string",
    "rules": [],
    "service": "string",
    "service_category": "string",
    "severities": [],
    "tags": {}
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "next": "string",
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "next": "string",
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

408 Request Timeout

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "next": "string",
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "next": "string",
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

cloud-security-assets-entities-get

Gets raw resources based on the provided IDs param.

Method GET

Route /cloud-security-assets/entities/resources/v1

Scope Cloud Security API Assets: READ

PEP 8 get_assets

Parameters

ids query · string or list of strings

List of assets to return (maximum 100 IDs allowed). Use POST method with same path if more entities are required.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudSecurityAssets

falcon = CloudSecurityAssets(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_assets(ids=id_list)
print(response)

Operation ID

from falconpy import CloudSecurityAssets

falcon = CloudSecurityAssets(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.cloud_security_assets_entities_get(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("cloud_security_assets_entities_get",
                          ids=id_list)
print(response)

PowerShell

Get-FalconCloudAsset -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_security_assets"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudSecurityAssets.CloudSecurityAssetsEntitiesGet(
    &cloud_security_assets.CloudSecurityAssetsEntitiesGetParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudSecurityAssets.cloudSecurityAssetsEntitiesGet(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::cloud_security_assets_api::cloud_security_assets_entities_get;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = cloud_security_assets_entities_get(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudSecurityAssets.new

response = api.cloud_security_assets_entities_get(ids: ['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "account_id": "string",
    "account_name": "string",
    "active": false,
    "arn": "string",
    "category": "string",
    "cid": "string",
    "cloud_context": {},
    "cloud_groups": [],
    "cloud_groups_v2": [],
    "cloud_labels": [],
    "cloud_provider": "string",
    "cluster_id": "string",
    "cluster_name": "string",
    "compartment_name": "string",
    "compartment_ocid": "string",
    "compartment_path": "string",
    "configuration": {},
    "configuration_metadata": {},
    "creation_time": "string",
    "first_seen": "string",
    "gcrn": "string",
    "groups": [],
    "hash": "string",
    "id": "string",
    "location": "string",
    "organization_id": "string",
    "parent": "string",
    "project_id": "string",
    "project_number": "string",
    "region": "string",
    "relationships": [],
    "resource_group": "string",
    "resource_id": "string",
    "resource_name": "string",
    "resource_number": "string",
    "resource_type": "string",
    "resource_type_name": "string",
    "resource_url": "string",
    "revision": 0,
    "service": "string",
    "service_category": "string",
    "status": "string",
    "subscription_id": "string",
    "supplementary_configuration": {},
    "tags": {},
    "tenancy_name": "string",
    "tenancy_ocid": "string",
    "tenancy_type": "string",
    "tenant_id": "string",
    "updated_at": "string",
    "zone": "string",
    "zones": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "next": "string",
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "next": "string",
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

408 Request Timeout

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "next": "string",
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "next": "string",
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

cloud-security-assets-entities-post

Gets raw resources based on IDs in the request body.

Method POST

Route /cloud-security-assets/entities/resources/v1

Scope Cloud Security API Assets: READ

PEP 8 cloud_security_assets_entities_post

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

ids body · array

The ids value.

Code Examples

Python

PEP 8

from falconpy import CloudSecurityAssets

falcon = CloudSecurityAssets(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.cloud_security_assets_entities_post(ids=id_list)
print(response)

Operation ID

from falconpy import CloudSecurityAssets

falcon = CloudSecurityAssets(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.cloud_security_assets_entities_post(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "ids": ["string"]
}

response = falcon.command("cloud_security_assets_entities_post", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_security_assets"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudSecurityAssets.CloudSecurityAssetsEntitiesPost(
    &cloud_security_assets.CloudSecurityAssetsEntitiesPostParams{
      Body: &models.AssetsGetResourcesRequest{
        Ids: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudSecurityAssets.cloudSecurityAssetsEntitiesPost(
  {
    ids: []
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudSecurityAssets.new

body = Falcon::AssetsGetResourcesRequest.new(
  ids: []
)

response = api.cloud_security_assets_entities_post(body)

puts response

Responses

200 OK

[
  {
    "account_id": "string",
    "account_name": "string",
    "active": false,
    "arn": "string",
    "category": "string",
    "cid": "string",
    "cloud_context": {},
    "cloud_groups": [],
    "cloud_groups_v2": [],
    "cloud_labels": [],
    "cloud_provider": "string",
    "cluster_id": "string",
    "cluster_name": "string",
    "compartment_name": "string",
    "compartment_ocid": "string",
    "compartment_path": "string",
    "configuration": {},
    "configuration_metadata": {},
    "creation_time": "string",
    "first_seen": "string",
    "gcrn": "string",
    "groups": [],
    "hash": "string",
    "id": "string",
    "location": "string",
    "organization_id": "string",
    "parent": "string",
    "project_id": "string",
    "project_number": "string",
    "region": "string",
    "relationships": [],
    "resource_group": "string",
    "resource_id": "string",
    "resource_name": "string",
    "resource_number": "string",
    "resource_type": "string",
    "resource_type_name": "string",
    "resource_url": "string",
    "revision": 0,
    "service": "string",
    "service_category": "string",
    "status": "string",
    "subscription_id": "string",
    "supplementary_configuration": {},
    "tags": {},
    "tenancy_name": "string",
    "tenancy_ocid": "string",
    "tenancy_type": "string",
    "tenant_id": "string",
    "updated_at": "string",
    "zone": "string",
    "zones": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "next": "string",
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "next": "string",
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

408 Request Timeout

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "next": "string",
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "next": "string",
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

cloud-security-assets-queries

Gets a list of resource IDs for the given parameters, filters and sort criteria

Method GET

Route /cloud-security-assets/queries/resources/v1

Scope Cloud Security API Assets: READ

PEP 8 query_assets

Parameters

after query · string

token-based pagination. use for paginating through an entire result set. Use only one of:

Available values (6)

offset	and	after
parameters	for	paginating

filter query · string

FQL string to filter on asset contents. Filterable fields include: - account_bitmap_token_64 - account_id - account_name - active - application_name - aspm.cloud_account - aspm.cloud_region - aspm.cloud_tag_key - aspm.cloud_tag_value - aspm.cloud_tags - aspm.deployment_cloud_resource_id - aspm.deployment_provider - aspm.deployment_type - aspm.technologies - azure.resource_group - azure.vm_id - business_impact - cloud_group - cloud_label - cloud_label_id - cloud_provider - cloud_risks.rule - cloud_risks.severity - cloud_risks.status - cloud_scope - cluster_id - cluster_name - compartment_ocid - compliant.benchmark_name - compliant.benchmark_version - compliant.framework - compliant.policy_id - compliant.requirement - compliant.rule - compliant.section - configuration.id - control.benchmark.name - control.benchmark.version - control.framework - control.requirement - control.type - control.version - creation_time - cve_ids - data_classifications.found - data_classifications.label - data_classifications.label_id - data_classifications.scanned - data_classifications.tag - data_classifications.tag_id - environment - exprt_ratings - first_seen - gcp.multi_region - gcp.physical_region - highest_severity - id - insights.boolean_value - insights.date_value - insights.id - insights.integer_value - insights.string_list_value - insights.string_value - instance_id - instance_state - ioa_count - iom_count - legacy_resource_id - legacy_uuid - managed_by - non_compliant.benchmark_name - non_compliant.benchmark_version - non_compliant.framework - non_compliant.policy_id - non_compliant.requirement - non_compliant.rule - non_compliant.rule_name - non_compliant.section - non_compliant.severity - organization_Id - os_version - platform_name - publicly_exposed - region - resource_gcrn - resource_id - resource_name - resource_parent - resource_type - resource_type_name - sensor_priority - service - service_category - severity - snapshot_detections - ssm_managed - status - tag_key - tag_value - tags - tags_string - tenant_id - updated_at - vmware.guest_os_id - vmware.guest_os_version - vmware.host_system_name - vmware.host_type - vmware.instance_uuid - vmware.vm_host_name - vmware.vm_tools_status - zone

Available values (99)

account_id	account_name	active
aspm.deployment_cloud_resource_id	aspm.deployment_provider	aspm.deployment_type
aspm.technologies	azure.vm_id	business_impact
cloud_group	cloud_label	cloud_label_id
cloud_provider	cloud_risks.rule	cloud_risks.severity
cloud_risks.status	cloud_scope	cluster_id
cluster_name	compartment_ocid	compliant.benchmark_name
compliant.benchmark_version	compliant.framework	compliant.policy_id
compliant.requirement	compliant.rule	compliant.section
configuration.id	control.benchmark.name	control.benchmark.version
control.framework	control.requirement	control.type
control.version	creation_time	cve_ids
data_classifications.found	data_classifications.label	data_classifications.label_id
data_classifications.scanned	data_classifications.tag	data_classifications.tag_id
environment	exprt_ratings	first_seen
highest_severity	id	insights.boolean_value
insights.date_value	insights.id	insights.integer_value
insights.string_list_value	insights.string_value	instance_id
instance_state	ioa_count	iom_count
legacy_resource_id	legacy_uuid	managed_by
non_compliant.benchmark_name	non_compliant.benchmark_version	non_compliant.framework
non_compliant.policy_id	non_compliant.requirement	non_compliant.rule
non_compliant.rule_name	non_compliant.section	non_compliant.severity
os_version	platform_name	publicly_exposed
region	resource_id	resource_name
resource_parent	resource_type	resource_type_name
sensor_priority	service	service_category
severity	snapshot_detections	ssm_managed
status	tag_key	tag_value
tags	tags_string	tenant_id
updated_at	vmware.guest_os_id	vmware.guest_os_version
vmware.host_system_name	vmware.host_type	vmware.instance_uuid
vmware.vm_host_name	vmware.vm_tools_status	zone

sort query · string

The field to sort on. Sortable fields include:

Available values (55)

account_id	account_name	active
aspm.deployment_cloud_resource_id	aspm.deployment_provider	aspm.deployment_type
aspm.exprt_rating	aspm.technologies	cloud_provider
cloud_risks.open_risk_count	cluster_id	cluster_name
compartment_name	compartment_ocid	compartment_path
creation_time	data_classifications.found	data_classifications.scanned
first_seen	id	instance_id
instance_state	ioa_count	iom_count
managed_by	organization_Id	os_version
platform_name	publicly_exposed	region
resource_id	resource_name	resource_parent
resource_type	resource_type_name	service
service_category	ssm_managed	status
tenancy_name	tenancy_ocid	tenancy_type
tenant_id	updated_at	vmware.guest_os_id
vmware.guest_os_version	vmware.host_system_name	vmware.host_type
vmware.instance_uuid	vmware.vm_host_name	vmware.vm_tools_status
zone	publiclyExposedToTheInternet	publiclyExposedAccessRange
publiclyExposedExposureMethod

limit query · integer

The maximum number of items to return. When not specified or 0, 500 is used. When larger than 1000, 1000 is used.

offset query · integer

Offset returned assets. Use only one of ‘offset’ and ‘after’ parameter for paginating. ‘offset’ can only be used on offsets < 10,000. For paginating through the entire result set, use ‘after’ parameter

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudSecurityAssets

falcon = CloudSecurityAssets(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.query_assets(after="string",
                               filter="string",
                               sort="string",
                               limit=integer,
                               offset=integer)
print(response)

Operation ID

from falconpy import CloudSecurityAssets

falcon = CloudSecurityAssets(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.cloud_security_assets_queries(after="string",
                                                filter="string",
                                                sort="string",
                                                limit=integer,
                                                offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("cloud_security_assets_queries",
                          after="string",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconCloudAsset -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_security_assets"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  after := "string"
  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.CloudSecurityAssets.CloudSecurityAssetsQueries(
    &cloud_security_assets.CloudSecurityAssetsQueriesParams{
      After: &after,
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudSecurityAssets.cloudSecurityAssetsQueries(
  "string",  // after
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::cloud_security_assets_api::cloud_security_assets_queries;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = cloud_security_assets_queries(
        &falcon.cfg,  // configuration
        Some("string"),  // after
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudSecurityAssets.new

response = api.cloud_security_assets_queries(after: 'string',
                                             filter: 'string',
                                             sort: 'string',
                                             limit: integer,
                                             offset: integer)

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "next": "string",
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

408 Request Timeout

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "next": "string",
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "next": "string",
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}