Skip to content

Cloud Security Detections

The Cloud Security Detections service collection provides operations for retrieving Indicators of Misconfiguration (IOMs) in cloud environments. Return IOMs grouped by rule, retrieve IOM entities by ID, or query for IOM IDs using FQL filters.

LanguageLast Update
Pythonv1.6.5
PowerShell
Gov0.22.0
TypeScriptv0.6.0
Rustv0.7.1
Rubyv1.4.0


OperationDescription
cspm-evaluations-combined-iom-by-rule
get_combined_iom_by_rule
returns ioms grouped by rule
cspm-evaluations-iom-entities
get_iom_entities
Gets IOMs based on the provided IDs
cspm-evaluations-iom-entities-post
cspm_evaluations_iom_entities_post
Gets IOMs based on IDs in the request body.
cspm-evaluations-iom-queries
query_iom_entities
Gets a list of IOM IDs for the given parameters, filters and sort criteria.

returns ioms grouped by rule

Method GET
Route /cloud-security-evaluations/combined/ioms-by-rule/v1
Scope Cloud Security API Detections: READ
PEP 8 get_combined_iom_by_rule
filter query · string
FQL string to filter results in Falcon Query Language (FQL). Supported fields:
Available values (48)
account_idaccount_nameapplicable_profile
attack_typebenchmark_namebenchmark_version
business_impactcidcloud_group
cloud_labelcloud_label_idcloud_provider
cloud_scopecreated_atenvironment
extension_statusfirst_detectedframework
last_detectedpolicy_idpolicy_name
regionrequirementresource_gcrn
resource_idresource_parentresource_status
resource_typeresource_type_namerule_group
rule_idrule_namerule_origin
sectionserviceservice_category
severitystatussuppressed_by
tactic_idtactic_nametag_key
tag_valuetagstags_string
technique_idtechnique_namezone
sort query · string
The field to sort on. Sortable fields include:
Available values (5)
assessed_assetscloud_providermisconfigurations
rule_idseverity
limit query · integer
The maximum number of items to return. When not specified or 0, 500 is used. When larger than 1000, 1000 is used.
offset query · integer
Offset returned assets
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
from falconpy import CloudSecurityDetections
falcon = CloudSecurityDetections(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_combined_iom_by_rule(filter="string",
sort="string",
limit=integer,
offset=integer)
print(response)
[
{
"account_id": "string",
"assessed_assets": 0,
"cid": "string",
"cloud_groups_v2": [],
"cloud_provider": "string",
"compliance": [],
"misconfigurations": 0,
"region": "string",
"rule": {},
"severity": "string",
"tags": {}
}
]


Gets IOMs based on the provided IDs

Method GET
Route /cloud-security-evaluations/entities/ioms/v1
Scope Cloud Security API Detections: READ
PEP 8 get_iom_entities
ids query · string or list of strings
List of IOMs to return (maximum 100 IDs allowed). Use POST method with same path if more entities are required.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
from falconpy import CloudSecurityDetections
falcon = CloudSecurityDetections(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_iom_entities(ids=id_list)
print(response)
[
{
"business_impact": [],
"cid": "string",
"cloud": {},
"cloud_groups": [],
"cloud_groups_v2": [],
"cloud_labels": [],
"environment": [],
"evaluation": {},
"groups": [],
"id": "string",
"resource": {}
}
]


Gets IOMs based on IDs in the request body.

Method POST
Route /cloud-security-evaluations/entities/ioms/v1
Scope Cloud Security API Detections: READ
PEP 8 cspm_evaluations_iom_entities_post
body body · dictionary
Full body payload as JSON formatted dictionary.
ids body · array
The ids value.
from falconpy import CloudSecurityDetections
falcon = CloudSecurityDetections(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.cspm_evaluations_iom_entities_post(ids=id_list)
print(response)
[
{
"business_impact": [],
"cid": "string",
"cloud": {},
"cloud_groups": [],
"cloud_groups_v2": [],
"cloud_labels": [],
"environment": [],
"evaluation": {},
"groups": [],
"id": "string",
"resource": {}
}
]


Gets a list of IOM IDs for the given parameters, filters and sort criteria.

Method GET
Route /cloud-security-evaluations/queries/ioms/v1
Scope Cloud Security API Detections: READ
PEP 8 query_iom_entities
filter query · string
FQL string to filter results in Falcon Query Language (FQL). Supported fields:
Available values (51)
account_idaccount_nameapplicable_profile
attack_typebenchmark_namebenchmark_version
business_impactcidcloud_group
cloud_labelcloud_label_idcloud_provider
cloud_scopecreated_atenvironment
extension_statusfirst_detectedframework
last_detectedpolicy_idpolicy_name
policy_uuidregionrequirement
requirement_nameresource_gcrnresource_id
resource_parentresource_statusresource_type
resource_type_namerule_grouprule_id
rule_namerule_originrule_remediation
sectionserviceservice_category
severitystatussuppressed_by
suppression_reasontactic_idtactic_name
tag_keytag_valuetags
tags_stringtechnique_idtechnique_name
sort query · string
The field to sort on. Use |asc or |desc suffix to specify sort direction.Supported fields:
Available values (51)
account_idaccount_nameapplicable_profile
attack_typebenchmark_namebenchmark_version
business_impactcidcloud_group
cloud_labelcloud_label_idcloud_provider
cloud_scopecreated_atenvironment
extension_statusfirst_detectedframework
last_detectedpolicy_idpolicy_name
policy_uuidregionrequirement
requirement_nameresource_gcrnresource_id
resource_parentresource_statusresource_type
resource_type_namerule_grouprule_id
rule_namerule_originrule_remediation
sectionserviceservice_category
severitystatussuppressed_by
suppression_reasontactic_idtactic_name
tag_keytag_valuetags
tags_stringtechnique_idtechnique_name
limit query · integer
The maximum number of items to return. When not specified or 0, 500 is used. When larger than 1000, 1000 is used.
offset query · integer
Offset returned assets
after query · string
token-based pagination. Use for paginating through an entire result set. Use only one of:
Available values (6)
offsetandafter
parametersforpaginating
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
from falconpy import CloudSecurityDetections
falcon = CloudSecurityDetections(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.query_iom_entities(filter="string",
sort="string",
limit=integer,
offset=integer,
after="string")
print(response)
[
"string"
]