Cloud Security

The Cloud Security service collection provides operations for managing cloud risk visibility and Cloud Group organization in your CrowdStrike Falcon environment. Retrieve combined cloud risk details, query and manage Cloud Groups with full CRUD support, and organize cloud assets by selectors.

Language	Last Update
Python	v1.6.5
PowerShell
Go	v0.22.0
TypeScript	v0.6.0
Rust
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
combined-cloud-risks combined_cloud_risks	Gets cloud risks with full details based on filters and sort criteria
CreateCloudGroupExternal create_cloud_group	Create a Cloud Group.
DeleteCloudGroupsExternal delete_cloud_groups	Delete Cloud Groups in batch
ListCloudGroupIDsExternal list_group_ids	Query Cloud Groups and returns IDs
ListCloudGroupsByIDExternal list_cloud_groups_by_id	List Cloud Groups By ID
ListCloudGroupsExternal list_cloud_groups	Query Cloud Groups and returns entities
UpdateCloudGroupExternal update_cloud_group	Update Cloud Group

---

combined-cloud-risks

Gets cloud risks with full details based on filters and sort criteria

Method GET

Route /cloud-security-risks/combined/cloud-risks/v1

Scope Cloud Security API Risks: READ

PEP 8 combined_cloud_risks

Parameters

filter query · string

FQL string to filter results in Falcon Query Language (FQL). Supported fields:

Available values (21)

account_id	account_name	asset_gcrn
asset_id	asset_name	asset_region
asset_type	cloud_group	cloud_provider
first_seen	last_seen	resolved_at
risk_factor	rule_id	rule_name
service_category	severity	status
suppressed_by	suppressed_reason	tags

sort query · string

The field to sort on. Use |asc or |desc suffix to specify sort direction. Supported fields:

Available values (14)

account_id	account_name	asset_id
asset_name	asset_region	asset_type
cloud_provider	first_seen	last_seen
resolved_at	rule_name	service_category
severity	status

limit query · integer

The maximum number of items to return. When not specified or 0, 500 is used. When larger than 1000, 1000 is used.

offset query · integer

Offset returned risks

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudSecurity

falcon = CloudSecurity(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.combined_cloud_risks(filter="string",
                                       sort="string",
                                       limit=integer,
                                       offset=integer)
print(response)

Operation ID

from falconpy import CloudSecurity

falcon = CloudSecurity(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.combined_cloud_risks(filter="string",
                                       sort="string",
                                       limit=integer,
                                       offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("combined_cloud_risks",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_security"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.CloudSecurity.CombinedCloudRisks(
    &cloud_security.CombinedCloudRisksParams{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudSecurity.combinedCloudRisks(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudSecurity.new

response = api.combined_cloud_risks(filter: 'string',
                                    sort: 'string',
                                    limit: integer,
                                    offset: integer)

puts response

Responses

200 OK

[
  {
    "account_id": "string",
    "account_name": "string",
    "adversaries": [],
    "agv2_id": "string",
    "asset_gcrn": "string",
    "asset_id": "string",
    "asset_name": "string",
    "asset_region": "string",
    "asset_tags": [],
    "asset_type": "string",
    "cid": "string",
    "cloud_groups": [],
    "comments": [],
    "crn": "string",
    "disabled": false,
    "first_seen": "string",
    "graph": {},
    "id": "string",
    "insight_categories": [],
    "last_seen": "string",
    "provider": "string",
    "resolved_at": "string",
    "risk_factors": [],
    "rule_description": "string",
    "rule_id": "string",
    "rule_name": "string",
    "score": 0,
    "service_category": "string",
    "severity": "string",
    "status": "string",
    "suppression": {}
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "next": "string",
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

408 Request Timeout

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "next": "string",
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "next": "string",
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

CreateCloudGroupExternal

Create a Cloud Group.

Method POST

Route /cloud-security/entities/cloud-groups/v1

Scope Assets: WRITE

PEP 8 create_cloud_group

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

business_impact body · string

Business Impact is one of:

Available values (3)

high

moderate

low

business_unit body · string

Business Unit is one of:

Available values (7)

the	business	context
field	of	the
group

description body · string

environment body · string

Environment is one of:

Available values (4)

dev	test	stage
prod

name body · string

Group name is unique and case insensitive.

owners body · array

The owners field contains a list of user emails.

selectors body · object

The Selectors for the cloud group.

Code Examples

Python

PEP 8

from falconpy import CloudSecurity

falcon = CloudSecurity(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

selectors = {
    "cloud_resources": [
        {
            "account_ids": [
                "string"
            ],
            "cloud_provider": "aws",
            "filters": {
                "region": [
                    "string"
                ],
                "tags": [
                    "string"
                ]
            }
        }
    ],
    "images": [
        {
            "filters": {
                "repository": [
                    "string"
                ],
                "tag": [
                    "string"
                ]
            },
            "registry": "string"
        }
    ]
}

response = falcon.create_cloud_group(business_impact="string",
                                     business_unit="string",
                                     description="string",
                                     environment="string",
                                     name="string",
                                     owners=id_list,
                                     selectors=selectors)
print(response)

Operation ID

from falconpy import CloudSecurity

falcon = CloudSecurity(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

selectors = {
    "cloud_resources": [
        {
            "account_ids": [
                "string"
            ],
            "cloud_provider": "aws",
            "filters": {
                "region": [
                    "string"
                ],
                "tags": [
                    "string"
                ]
            }
        }
    ],
    "images": [
        {
            "filters": {
                "repository": [
                    "string"
                ],
                "tag": [
                    "string"
                ]
            },
            "registry": "string"
        }
    ]
}

response = falcon.CreateCloudGroupExternal(business_impact="string",
                                           business_unit="string",
                                           description="string",
                                           environment="string",
                                           name="string",
                                           owners=id_list,
                                           selectors=selectors)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "business_impact": "string",
    "business_unit": "string",
    "description": "string",
    "environment": "string",
    "name": "string",
    "owners": ["string"],
    "selectors": {
        "cloud_resources": [
            {
                "account_ids": ["string"],
                "cloud_provider": "string",
                "filters": {}
            }
        ],
        "images": [
            {
                "filters": {},
                "registry": "string"
            }
        ],
        "kubernetes_resources": [
            {
                "cluster": ["string"],
                "namespace": ["string"]
            }
        ]
    }
}

response = falcon.command("CreateCloudGroupExternal", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_security"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  business_impact := "string"
  business_unit := "string"
  description := "string"
  environment := "string"
  name := "string"

  response, err := client.CloudSecurity.CreateCloudGroupExternal(
    &cloud_security.CreateCloudGroupExternalParams{
      Body: &models.AssetgroupmanagerV1CreateCloudGroupRequest{
        BusinessImpact: &business_impact,
        BusinessUnit: &business_unit,
        Description: &description,
        Environment: &environment,
        Name: &name,
        Owners: []string{"string"},
        Selectors: &struct{}{},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudSecurity.createCloudGroupExternal(
  {
    businessImpact: "string",
    businessUnit: "string",
    description: "string",
    environment: "string",
    name: "string",
    owners: [],
    selectors: {
      cloudResources: [{
          accountIds: [],
          cloudProvider: "string",
          filters: {}
        }],
      images: [{
          filters: {},
          registry: "string"
        }],
      kubernetesResources: [{
          cluster: [],
          namespace: []
        }]
    }
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudSecurity.new

body = Falcon::AssetgroupmanagerV1CreateCloudGroupRequest.new(
  business_impact: 'string',
  business_unit: 'string',
  description: 'string',
  environment: 'string',
  name: 'string',
  owners: [],
  selectors: {
    cloud_resources: [{
        account_ids: [],
        cloud_provider: 'string',
        filters: {}
      }],
    images: [{
        filters: {},
        registry: 'string'
      }],
    kubernetes_resources: [{
        cluster: [],
        namespace: []
      }]
  }
)

response = api.create_cloud_group_external(body)

puts response

Responses

200 A successful response.

[
  "string"
]

400 Returned when the request is malformed.

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

401 Returned when the request is unauthorized.

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

403 Returned when the subject does not have permission to access the resource.

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

404 Returned when the resource does not exist.

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

412 Returned when a precondition fails e.g if after this call the CID will have more groups than the max allowed

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Server error

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

---

---

DeleteCloudGroupsExternal

Delete Cloud Groups in batch

Method DELETE

Route /cloud-security/entities/cloud-groups/v1

Scope Assets: WRITE

PEP 8 delete_cloud_groups

Parameters

ids query · string or list of strings

Cloud Groups UUIDs to delete

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudSecurity

falcon = CloudSecurity(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_cloud_groups(ids=id_list)
print(response)

Operation ID

from falconpy import CloudSecurity

falcon = CloudSecurity(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteCloudGroupsExternal(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteCloudGroupsExternal",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_security"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudSecurity.DeleteCloudGroupsExternal(
    &cloud_security.DeleteCloudGroupsExternalParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudSecurity.deleteCloudGroupsExternal(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudSecurity.new

response = api.delete_cloud_groups_external(ids: ['ID1', 'ID2', 'ID3'])

puts response

Responses

400 Returned when the request is malformed.

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

401 Returned when the request is unauthorized.

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

403 Returned when the subject does not have permission to access the resource.

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

404 Returned when the resource does not exist.

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Server error

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

---

---

ListCloudGroupIDsExternal

Query Cloud Groups and returns IDs

Method GET

Route /cloud-security/queries/cloud-groups/v1

Scope Assets: READ

PEP 8 list_group_ids

Parameters

filter query · string

A valid FQL filter. Supports filtering groups by:

Available values (11)

name	description	created_at
updated_at	cloud_provider	account_id
region	cloud_provider_tag	image_registry
image_repository	image_tag

sort query · string

A valid sort string.

offset query · string

The starting position of the list operation.

limit query · string

The maximum number of cloud groups to retrieve.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudSecurity

falcon = CloudSecurity(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.list_group_ids(filter="string",
                                 sort="string",
                                 offset="string",
                                 limit="string")
print(response)

Operation ID

from falconpy import CloudSecurity

falcon = CloudSecurity(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.ListCloudGroupIDsExternal(filter="string",
                                            sort="string",
                                            offset="string",
                                            limit="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ListCloudGroupIDsExternal",
                          filter="string",
                          sort="string",
                          offset="string",
                          limit="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_security"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  offset := "string"
  limit := "string"

  response, err := client.CloudSecurity.ListCloudGroupIDsExternal(
    &cloud_security.ListCloudGroupIDsExternalParams{
      Filter: &filter,
      Sort: &sort,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudSecurity.listCloudGroupIDsExternal(
  "string",  // filter
  "string",  // sort
  "string",  // offset
  "string"  // limit
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudSecurity.new

response = api.list_cloud_group_ids_external(filter: 'string',
                                             sort: 'string',
                                             offset: 'string',
                                             limit: 'string')

puts response

Responses

200 A successful response.

[
  "string"
]

400 Returned when the request is malformed.

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

401 Returned when the request is unauthorized.

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

403 Returned when the subject does not have permission to access the resource.

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

404 Returned when the resource does not exist.

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Server error

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

---

---

ListCloudGroupsByIDExternal

List Cloud Groups By ID

Method GET

Route /cloud-security/entities/cloud-groups/v1

Scope Assets: READ

PEP 8 list_cloud_groups_by_id

Parameters

ids query · string or list of strings

Cloud Groups UUIDs.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudSecurity

falcon = CloudSecurity(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.list_cloud_groups_by_id(ids=id_list)
print(response)

Operation ID

from falconpy import CloudSecurity

falcon = CloudSecurity(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ListCloudGroupsByIDExternal(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ListCloudGroupsByIDExternal",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_security"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudSecurity.ListCloudGroupsByIDExternal(
    &cloud_security.ListCloudGroupsByIDExternalParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudSecurity.listCloudGroupsByIDExternal(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudSecurity.new

response = api.list_cloud_groups_by_id_external(ids: ['ID1', 'ID2', 'ID3'])

puts response

Responses

200 A successful response.

[
  {
    "business_impact": "string",
    "business_unit": "string",
    "created_at": "string",
    "created_by": "string",
    "description": "string",
    "environment": "string",
    "id": "string",
    "name": "string",
    "owners": [],
    "selectors": {},
    "updated_at": "string",
    "updated_by": "string"
  }
]

400 Returned when the request is malformed.

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

401 Returned when the request is unauthorized.

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

403 Returned when the subject does not have permission to access the resource.

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

404 Returned when the resource does not exist.

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Server error

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

---

---

ListCloudGroupsExternal

Query Cloud Groups and returns entities

Method GET

Route /cloud-security/combined/cloud-groups/v1

Scope Assets: READ

PEP 8 list_cloud_groups

Parameters

filter query · string

A valid FQL filter. Supports filtering groups by:

Available values (11)

name	description	created_at
updated_at	cloud_provider	account_id
region	cloud_provider_tag	image_registry
image_repository	image_tag

sort query · string

A valid sort string.

offset query · string

The starting position of the list operation.

limit query · string

The maximum number of cloud groups to retrieve.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudSecurity

falcon = CloudSecurity(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.list_cloud_groups(filter="string",
                                    sort="string",
                                    offset="string",
                                    limit="string")
print(response)

Operation ID

from falconpy import CloudSecurity

falcon = CloudSecurity(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.ListCloudGroupsExternal(filter="string",
                                          sort="string",
                                          offset="string",
                                          limit="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ListCloudGroupsExternal",
                          filter="string",
                          sort="string",
                          offset="string",
                          limit="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_security"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  offset := "string"
  limit := "string"

  response, err := client.CloudSecurity.ListCloudGroupsExternal(
    &cloud_security.ListCloudGroupsExternalParams{
      Filter: &filter,
      Sort: &sort,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudSecurity.listCloudGroupsExternal(
  "string",  // filter
  "string",  // sort
  "string",  // offset
  "string"  // limit
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudSecurity.new

response = api.list_cloud_groups_external(filter: 'string',
                                          sort: 'string',
                                          offset: 'string',
                                          limit: 'string')

puts response

Responses

200 A successful response.

[
  {
    "business_impact": "string",
    "business_unit": "string",
    "created_at": "string",
    "created_by": "string",
    "description": "string",
    "environment": "string",
    "id": "string",
    "name": "string",
    "owners": [],
    "selectors": {},
    "updated_at": "string",
    "updated_by": "string"
  }
]

400 Returned when the request is malformed.

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

401 Returned when the request is unauthorized.

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

403 Returned when the subject does not have permission to access the resource.

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

404 Returned when the resource does not exist.

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Server error

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

---

---

UpdateCloudGroupExternal

Update Cloud Group

Method PATCH

Route /cloud-security/entities/cloud-groups/v1

Scope Assets: WRITE

PEP 8 update_cloud_group

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

business_impact body · string

The new Business Impact for the group. It will be deleted if the value is sent empty.

Available values (4)

	high	moderate
low

business_unit body · string

Business Impact is one of:

Available values (7)

the	business	context
field	of	the
group

description body · string

The new Description for the group.

environment body · string

Environment is one of:

Available values (5)

	dev	test
stage	prod

id body · string

The UUID of the group to be updated.

name body · string

Group name is unique and case insensitive.

owners body · array

The owners field contains a list of user emails. An empty list of owners means that the group will be updated to have no owners.

selectors body · object

The new Selectors for the cloud group. This doesn’t support partial updates and always must include **all existing selectors**.

Code Examples

Python

PEP 8

from falconpy import CloudSecurity

falcon = CloudSecurity(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

selectors = {
    "cloud_resources": [
        {
            "account_ids": [
                "string"
            ],
            "cloud_provider": "aws",
            "filters": {
                "region": [
                    "string"
                ],
                "tags": [
                    "string"
                ]
            }
        }
    ],
    "images": [
        {
            "filters": {
                "repository": [
                    "string"
                ],
                "tag": [
                    "string"
                ]
            },
            "registry": "string"
        }
    ]
}

response = falcon.update_cloud_group(business_impact="string",
                                     business_unit="string",
                                     description="string",
                                     environment="string",
                                     name="string",
                                     owners=id_list,
                                     selectors=selectors)
print(response)

Operation ID

from falconpy import CloudSecurity

falcon = CloudSecurity(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

selectors = {
    "cloud_resources": [
        {
            "account_ids": [
                "string"
            ],
            "cloud_provider": "aws",
            "filters": {
                "region": [
                    "string"
                ],
                "tags": [
                    "string"
                ]
            }
        }
    ],
    "images": [
        {
            "filters": {
                "repository": [
                    "string"
                ],
                "tag": [
                    "string"
                ]
            },
            "registry": "string"
        }
    ]
}

response = falcon.UpdateCloudGroupExternal(business_impact="string",
                                           business_unit="string",
                                           description="string",
                                           environment="string",
                                           name="string",
                                           owners=id_list,
                                           selectors=selectors)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "business_impact": "string",
    "business_unit": "string",
    "description": "string",
    "environment": "string",
    "id": "string",
    "name": "string",
    "owners": ["string"],
    "selectors": {
        "cloud_resources": [
            {
                "account_ids": ["string"],
                "cloud_provider": "string",
                "filters": {}
            }
        ],
        "images": [
            {
                "filters": {},
                "registry": "string"
            }
        ],
        "kubernetes_resources": [
            {
                "cluster": ["string"],
                "namespace": ["string"]
            }
        ]
    }
}

response = falcon.command("UpdateCloudGroupExternal", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_security"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  group := "string"

  response, err := client.CloudSecurity.UpdateCloudGroupExternal(
    &cloud_security.UpdateCloudGroupExternalParams{
      Group: &group,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudSecurity.updateCloudGroupExternal("string");  // group

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudSecurity.new

response = api.update_cloud_group_external('string')

puts response

Responses

200 A successful response.

[
  "string"
]

400 Returned when the request is malformed.

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

401 Returned when the request is unauthorized.

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

403 Returned when the subject does not have permission to access the resource.

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

404 Returned when the resource does not exist.

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Server error

{
  "errors": [
    {
      "code": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}