Cloud Snapshots

The Cloud Snapshots service collection provides operations for managing cloud snapshot scanning and IaC detection. Search IaC detections, manage snapshot scan jobs, register cloud accounts, retrieve scan reports, and access registry credentials.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
CombinedDetections search_detections	Search IaC Detections using a query in Falcon Query Language
CreateDeploymentEntity launch_scan_job	Launch a snapshot scan for a given cloud asset
GetCredentialsIAC get_iac_credentials	Gets the registry credentials (external endpoint)
GetCredentialsMixin0 get_credentials	Gets the registry credentials
GetScanReport get_scan_reports	retrieve the scan report for an instance
ReadDeploymentsCombined search_scan_jobs	Retrieve snapshot jobs identified by the provided IDs
ReadDeploymentsEntities get_scan_jobs	Retrieve snapshot jobs identified by the provided IDs
RegisterCspmSnapshotAccount register_account	Register customer cloud account for snapshot scanning

---

CombinedDetections

Search IaC Detections using a query in Falcon Query Language

Method GET

Route /iac/combined/detections/v1

Scope Infrastructure as Code (IaC): READ

PEP 8 search_detections

Parameters

filter query · string

Search IaC detections using a query in Falcon Query Language (FQL). Supported filters:

Available values (19)

detection_uuid	file_name	is_from_module
last_detected	module_path	module_source
module_version	platform	project_name
project_owner	project_ref	provider
resource_name	rule_category	rule_name
rule_type	rule_uuid	service
severity

limit query · integer

the upper-bound on the number of records to retrieve

offset query · integer

The offset from where to begin.

sort query · string

fields to sort the records on. Supported columns:

Available values (19)

detection_uuid	file_name	is_from_module
last_detected	module_path	module_source
module_version	platform	project_name
project_owner	project_ref	provider
resource_name	rule_category	rule_name
rule_type	rule_uuid	service
severity

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.search_detections(filter="string",
                                    limit=integer,
                                    offset=integer,
                                    sort="string")
print(response)

Operation ID

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.CombinedDetections(filter="string",
                                     limit=integer,
                                     offset=integer,
                                     sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("CombinedDetections",
                          filter="string",
                          limit=integer,
                          offset=integer,
                          sort="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspg_iacapi"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)
  sort := "string"

  response, err := client.CspgIacapi.CombinedDetections(
    &cspg_iacapi.CombinedDetectionsParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspgIacapi.combinedDetections(
  "string",  // filter
  integer,  // limit
  integer,  // offset
  "string"  // sort
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspgIacapi.new

response = api.combined_detections(filter: 'string',
                                   limit: integer,
                                   offset: integer,
                                   sort: 'string')

puts response

Responses

200 OK

[
  {
    "detection_uuid": "string",
    "file_name": "string",
    "is_from_module": false,
    "last_detected": "string",
    "misconfigured_line": 0,
    "module_path": "string",
    "module_remediation": {},
    "module_source": "string",
    "module_version": "string",
    "project_name": "string",
    "project_owners": [],
    "project_ref": "string",
    "remediation": {},
    "resource_name": "string",
    "resource_type": "string",
    "rule": {}
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

CreateDeploymentEntity

Launch a snapshot scan for a given cloud asset

Method POST

Route /snapshots/entities/deployments/v1

Scope Snapshot: WRITE

PEP 8 launch_scan_job

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

account_id body · string

Cloud provider account ID.

asset_identifier body · string

Cloud asset identifier.

cloud_provider body · string

Cloud provider ID.

region body · string

Cloud provider region ID.

Code Examples

Python

PEP 8

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.launch_scan_job(account_id="string",
                                  asset_identifier="string",
                                  cloud_provider="string",
                                  region="string")
print(response)

Operation ID

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.CreateDeploymentEntity(account_id="string",
                                         asset_identifier="string",
                                         cloud_provider="string",
                                         region="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "account_id": "string",
            "asset_identifier": "string",
            "cloud_provider": "string",
            "region": "string"
        }
    ]
}

response = falcon.command("CreateDeploymentEntity", body=body_payload)
print(response)

PowerShell

New-FalconSnapshotScan -CloudProvider "string" `
  -Region "string" `
  -AccountId "string" `
  -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_snapshots"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  account_id := "string"
  asset_identifier := "string"
  cloud_provider := "string"
  region := "string"

  response, err := client.CloudSnapshots.CreateDeploymentEntity(
    &cloud_snapshots.CreateDeploymentEntityParams{
      Body: &models.ModelsCreateDeploymentInput{
        Resources: []interface{}{
          {
          AccountID: &account_id,
          AssetIdentifier: &asset_identifier,
          CloudProvider: &cloud_provider,
          Region: &region,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudSnapshots.createDeploymentEntity(
  {
    resources: [{
        accountId: "string",
        assetIdentifier: "string",
        cloudProvider: "string",
        region: "string"
      }]
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::cloud_snapshots_api::create_deployment_entity;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ModelsCreateDeploymentInput;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ModelsCreateDeploymentInput {
        resources: vec![DeploymentResource {
            account_id: Some("string".to_string()),
            asset_identifier: Some("string".to_string()),
            cloud_provider: Some("string".to_string()),
            region: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = create_deployment_entity(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudSnapshots.new

body = Falcon::ModelsCreateDeploymentInput.new(
  resources: [{
      account_id: 'string',
      asset_identifier: 'string',
      cloud_provider: 'string',
      region: 'string'
    }]
)

response = api.create_deployment_entity(body)

puts response

Responses

200 OK

[
  {
    "account_id": "string",
    "asset_identifier": "string",
    "cloud_provider": "string",
    "id": "string",
    "instance_type": "string",
    "last_updated_timestamp": "string",
    "region": "string",
    "status": "string",
    "status_detail": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

GetCredentialsIAC

Gets the registry credentials (external endpoint)

Method GET

Route /iac/entities/image-registry-credentials/v1

Scope Infrastructure as Code (IaC): READ

PEP 8 get_iac_credentials

Code Examples

Python

PEP 8

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_iac_credentials()
print(response)

Operation ID

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.GetCredentialsIAC()
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetCredentialsIAC")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspg_iacapi"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CspgIacapi.GetCredentialsMixin0(
    &cspg_iacapi.GetCredentialsMixin0Params{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspgIacapi.getCredentialsMixin0();

console.log(response);

Rust

use rusty_falcon::apis::cspg_iacapi_api::get_credentials_mixin0;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_credentials_mixin0(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspgIac.new

response = api.get_credentials_mixin0

puts response

Responses

200 OK

{
  "token": "string"
}

400 Bad Request

{
  "code": 0,
  "id": "string",
  "message": "string"
}

401 Unauthorized

{
  "code": 0,
  "id": "string",
  "message": "string"
}

403 Forbidden

{
  "code": 0,
  "id": "string",
  "message": "string"
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {
    "token": "string"
  }
}

---

---

GetCredentialsMixin0

Gets the registry credentials

Method GET

Route /snapshots/entities/image-registry-credentials/v1

Scope Snapshot Scanner Image Download: READ

PEP 8 get_credentials

Code Examples

Python

PEP 8

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_credentials()
print(response)

Operation ID

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.GetCredentialsMixin0()
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetCredentialsMixin0")
print(response)

PowerShell

Get-FalconSnapshotCredential

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_snapshots"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudSnapshots.GetCredentialsMixin0Mixin60(
    &cloud_snapshots.GetCredentialsMixin0Mixin60Params{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudSnapshots.getCredentialsMixin0Mixin60();

console.log(response);

Rust

use rusty_falcon::apis::cloud_snapshots_api::get_credentials_mixin0_mixin60;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_credentials_mixin0_mixin60(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudSnapshots.new

response = api.get_credentials_mixin0_mixin60

puts response

Responses

200 OK

{
  "token": "string"
}

400 Bad Request

{
  "code": 0,
  "id": "string",
  "message": "string"
}

401 Unauthorized

{
  "code": 0,
  "id": "string",
  "message": "string"
}

403 Forbidden

{
  "code": 0,
  "id": "string",
  "message": "string"
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {
    "token": "string"
  }
}

---

---

GetScanReport

retrieve the scan report for an instance

Method GET

Route /snapshots/entities/scanreports/v1

Scope Snapshot: READ

PEP 8 get_scan_reports

Parameters

ids query · string or list of strings

the instance identifiers to fetch the report for

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_scan_reports(ids=id_list)
print(response)

Operation ID

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetScanReport(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetScanReport",
                          ids=id_list)
print(response)

PowerShell

Get-FalconSnapshotScan -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_snapshots"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudSnapshots.GetScanReport(
    &cloud_snapshots.GetScanReportParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudSnapshots.getScanReport(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::cloud_snapshots_api::get_scan_report;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_scan_report(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudSnapshots.new

response = api.get_scan_report(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "ApplicationPackages": [],
    "DetectionEngineInfo": {},
    "Detections": [],
    "Vulnerabilities": [],
    "VulnerabilitiesTruncated": {},
    "job_metadata": {},
    "os_info": {},
    "results": {}
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

ReadDeploymentsCombined

Retrieve snapshot jobs identified by the provided IDs

Method GET

Route /snapshots/combined/deployments/v1

Scope Snapshot: READ

PEP 8 search_scan_jobs

Parameters

filter query · string

Search snapshot jobs using a query in Falcon Query Language (FQL). Supported filters:

Available values (5)

account_id	asset_identifier	cloud_provider
region	status

limit query · integer

The upper-bound on the number of records to retrieve.

offset query · integer

The offset from where to begin.

sort query · string

The fields to sort the records on. Supported columns:

Available values (7)

account_id	asset_identifier	cloud_provider
instance_type	last_updated_timestamp	region
status

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.search_scan_jobs(filter="string",
                                   limit=integer,
                                   offset=integer,
                                   sort="string")
print(response)

Operation ID

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.ReadDeploymentsCombined(filter="string",
                                          limit=integer,
                                          offset=integer,
                                          sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadDeploymentsCombined",
                          filter="string",
                          limit=integer,
                          offset=integer,
                          sort="string")
print(response)

PowerShell

Get-FalconSnapshot -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_snapshots"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)
  sort := "string"

  response, err := client.CloudSnapshots.ReadDeploymentsCombined(
    &cloud_snapshots.ReadDeploymentsCombinedParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudSnapshots.readDeploymentsCombined(
  "string",  // filter
  integer,  // limit
  integer,  // offset
  "string"  // sort
);

console.log(response);

Rust

use rusty_falcon::apis::cloud_snapshots_api::read_deployments_combined;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_deployments_combined(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudSnapshots.new

response = api.read_deployments_combined(filter: 'string',
                                         limit: integer,
                                         offset: integer,
                                         sort: 'string')

puts response

Responses

200 OK

[
  {
    "account_id": "string",
    "asset_identifier": "string",
    "cloud_provider": "string",
    "id": "string",
    "instance_type": "string",
    "last_updated_timestamp": "string",
    "region": "string",
    "status": "string",
    "status_detail": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

ReadDeploymentsEntities

Retrieve snapshot jobs identified by the provided IDs

Method GET

Route /snapshots/entities/deployments/v1

Scope Snapshot: READ

PEP 8 get_scan_jobs

Parameters

ids query · string or list of strings

Search snapshot jobs by ids - The maximum amount is 100 IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_scan_jobs(ids=id_list)
print(response)

Operation ID

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ReadDeploymentsEntities(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ReadDeploymentsEntities",
                          ids=id_list)
print(response)

PowerShell

Get-FalconSnapshot -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_snapshots"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudSnapshots.ReadDeploymentsEntities(
    &cloud_snapshots.ReadDeploymentsEntitiesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudSnapshots.readDeploymentsEntities(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::cloud_snapshots_api::read_deployments_entities;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_deployments_entities(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudSnapshots.new

response = api.read_deployments_entities(ids: ['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "account_id": "string",
    "asset_identifier": "string",
    "cloud_provider": "string",
    "id": "string",
    "instance_type": "string",
    "last_updated_timestamp": "string",
    "region": "string",
    "status": "string",
    "status_detail": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

RegisterCspmSnapshotAccount

Register customer cloud account for snapshot scanning

Method POST

Route /snapshots/entities/accounts/v1

Scope Snapshot: WRITE

PEP 8 register_account

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

aws_accounts body · array

Complete list of AWS accounts to register. Overrides any values specified below.

account_number body · string

AWS account number.

batch_regions body · list of dictionaries

Region the batch is executed.

iam_external_id body · string

The external ID of the IAM account used.

iam_role_arn body · string

The AWS ARN for the IAM account used.

kms_alias body · string

The KMS alias for the IAM account used.

processing_account body · string

The name of the processing account.

Code Examples

Python

PEP 8

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

batch_regions = [
    {
        "job_definition_name": "string",
        "job_queue": "string",
        "region": "string"
    }
]

response = falcon.register_account(aws_accounts=["string"],
                                   account_number="string",
                                   batch_regions=batch_regions,
                                   iam_external_id="string",
                                   iam_role_arn="string",
                                   kms_alias="string",
                                   processing_account="string")
print(response)

Operation ID

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

batch_regions = [
    {
        "job_definition_name": "string",
        "job_queue": "string",
        "region": "string"
    }
]

response = falcon.RegisterCspmSnapshotAccount(aws_accounts=["string"],
                                              account_number="string",
                                              batch_regions=batch_regions,
                                              iam_external_id="string",
                                              iam_role_arn="string",
                                              kms_alias="string",
                                              processing_account="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "aws_accounts": [
        {
            "account_number": "string",
            "batch_regions": [
                {
                    "job_definition_name": "string",
                    "job_queue": "string",
                    "region": "string"
                }
            ],
            "iam_external_id": "string",
            "iam_role_arn": "string",
            "kms_alias": "string",
            "processing_account": "string"
        }
    ]
}

response = falcon.command("RegisterCspmSnapshotAccount", body=body_payload)
print(response)

PowerShell

New-FalconSnapshotAwsAccount

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_snapshots"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  account_number := "string"
  job_definition_name := "string"
  job_queue := "string"
  region := "string"
  iam_external_id := "string"
  iam_role_arn := "string"
  kms_alias := "string"
  processing_account := "string"

  response, err := client.CloudSnapshots.Register(
    &cloud_snapshots.RegisterParams{
      Body: &models.ModelsAccountEntitiesInput{
        AwsAccounts: []interface{}{
          {
          AccountNumber: &account_number,
          BatchRegions: []interface{}{
            {
            JobDefinitionName: &job_definition_name,
            JobQueue: &job_queue,
            Region: &region,
            },
          },
          IamExternalID: &iam_external_id,
          IamRoleArn: &iam_role_arn,
          KmsAlias: &kms_alias,
          ProcessingAccount: &processing_account,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudSnapshots.register(
  {
    awsAccounts: [{
        accountNumber: "string",
        batchRegions: [{
            jobDefinitionName: "string",
            jobQueue: "string",
            region: "string"
          }],
        iamExternalId: "string",
        iamRoleArn: "string",
        kmsAlias: "string",
        processingAccount: "string"
      }]
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::cloud_snapshots_api::register_cspm_snapshot_account;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ModelsAccountEntitiesInput;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ModelsAccountEntitiesInput {
        aws_accounts: vec![AWSAccountInput {
            account_number: Some("string".to_string()),
            batch_regions: vec![AWSBatchClusterRegion {
                job_definition_name: Some("string".to_string()),
                job_queue: Some("string".to_string()),
                region: Some("string".to_string()),
                ..Default::default()
            }],
            iam_external_id: Some("string".to_string()),
            iam_role_arn: Some("string".to_string()),
            kms_alias: Some("string".to_string()),
            processing_account: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = register_cspm_snapshot_account(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudSnapshots.new

body = Falcon::ModelsAccountEntitiesInput.new(
  aws_accounts: [{
      account_number: 'string',
      batch_regions: [{
          job_definition_name: 'string',
          job_queue: 'string',
          region: 'string'
        }],
      iam_external_id: 'string',
      iam_role_arn: 'string',
      kms_alias: 'string',
      processing_account: 'string'
    }]
)

response = api.register_cspm_snapshot_account(body)

puts response

Responses

200 OK

[
  {
    "account_id": "string",
    "account_status": "string",
    "batch_regions": [],
    "cloud_provider": 0,
    "iam_external_id": "string",
    "iam_role_arn": "string",
    "processing_account": "string",
    "regions": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}