Cloud Snapshots

The Cloud Snapshots service collection provides operations for managing cloud snapshot scanning and IaC detection. Search IaC detections, manage snapshot scan jobs, register cloud accounts, retrieve scan reports, and access registry credentials.

Language	Last Update
Python	v1.5.5
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

Operation	Description
CombinedDetections `search_detections`	Search IaC Detections using a query in Falcon Query Language.
ReadDeploymentsCombined `search_scan_jobs`	Search for snapshot jobs identified by the provided filter.
RegisterCspmSnapshotAccount `register_account`	Register customer cloud account for snapshot scanning.
ReadDeploymentsEntities `get_scan_jobs`	Retrieve snapshot jobs identified by the provided IDs.
CreateDeploymentEntity `launch_scan_job`	Launch a snapshot scan for a given cloud asset.
GetCredentialsIAC `get_iac_credentials`	Gets the registry credentials (external endpoint).
GetScanReport `get_scan_reports`	Retrieve the scan report for an instance.
GetCredentialsMixin0 `get_credentials`	Gets the registry credentials.

CombinedDetections

Search IaC Detections using a query in Falcon Query Language.

GET /iac/combined/detections/v1

Scope Infrastructure as Code (IaC): READ Consumes · Produces application/json

PEP 8 search_detections

Parameters

Name	Type	Data type	Description
filter	query	string	Search IaC detections using a query in Falcon Query Language (FQL). Supported filters: detection_uuid, file_name, last_detected, platform, project_name, project_owner, project_ref, provider, resource_name, rule_category, rule_name, rule_type, rule_uuid, service, severity.
limit	query	integer	The upper-bound on the number of records to retrieve.
offset	query	integer	The offset from where to begin.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.
sort	query	string	Fields to sort the records on. Supported columns: detection_uuid, file_name, last_detected, platform, project_name, project_owner, project_ref, provider, resource_name, rule_category, rule_name, rule_type, rule_uuid, service, severity.

Code Examples

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.search_detections(filter="string",
                                    limit=integer,
                                    offset=integer,
                                    sort="string")
print(response)

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.CombinedDetections(filter="string",
                                     limit=integer,
                                     offset=integer,
                                     sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("CombinedDetections",
                          filter="string",
                          limit=integer,
                          offset=integer,
                          sort="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspg_iacapi"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)
  sort := "string"

  response, err := client.CspgIacapi.CombinedDetections(
    &cspg_iacapi.CombinedDetectionsParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspgIacapi.combinedDetections(
  "string",  // filter
  integer,  // limit
  integer,  // offset
  "string"  // sort
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspgIacapi.new

response = api.combined_detections(filter: 'string',
                                   limit: integer,
                                   offset: integer,
                                   sort: 'string')

puts response

ReadDeploymentsCombined

Search for snapshot jobs identified by the provided filter.

GET /snapshots/combined/deployments/v1

Scope Snapshot: READ Consumes · Produces application/json

PEP 8 search_scan_jobs

Parameters

Name	Type	Data type	Description
filter	query	string	Search snapshot jobs using a query in Falcon Query Language (FQL). Supported filters: account_id, asset_identifier, cloud_provider, region, status.
limit	query	integer	The upper-bound on the number of records to retrieve.
offset	query	integer	The offset from where to begin.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.
sort	query	string	The fields to sort the records on. Supported columns: account_id, asset_identifier, cloud_provider, instance_type, last_updated_timestamp, region, status.

Code Examples

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.search_scan_jobs(filter="string",
                                   limit="string",
                                   offset="string",
                                   sort="string")
print(response)

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.ReadDeploymentsCombined(filter="string",
                                          limit="string",
                                          offset="string",
                                          sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadDeploymentsCombined",
                          filter="string",
                          limit=integer,
                          offset=integer,
                          sort="string")
print(response)

Get-FalconSnapshot -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_snapshots"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)
  sort := "string"

  response, err := client.CloudSnapshots.ReadDeploymentsCombined(
    &cloud_snapshots.ReadDeploymentsCombinedParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudSnapshots.readDeploymentsCombined(
  "string",  // filter
  integer,  // limit
  integer,  // offset
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::cloud_snapshots_api::read_deployments_combined;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_deployments_combined(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudSnapshots.new

response = api.read_deployments_combined(filter: 'string',
                                         limit: integer,
                                         offset: integer,
                                         sort: 'string')

puts response

RegisterCspmSnapshotAccount

POST /snapshots/entities/accounts/v1

Scope Snapshot: WRITE Consumes · Produces application/json

PEP 8 register_account

Parameters

Name	Type	Data type	Description
body	body	list of dictionaries	Full body payload in JSON format.
aws_accounts	body	list of dictionaries	Complete list of AWS accounts to register.
account_number	body	string	AWS account number. Overriden if `aws_accounts` keyword is provided.
batch_regions	body	string	Region the batch is executed within. Overriden if `aws_accounts` keyword is provided.
iam_external_id	body	string	The external ID of the IAM account used. Overriden if `aws_accounts` keyword is provided.
iam_role_arn	body	string	The AWS ARN for the IAM account used. Overriden if `aws_accounts` keyword is provided.
kms_alias	body	string	The KMS alias for the IAM account used. Overriden if `aws_accounts` keyword is provided.
processing_account	body	string	The ID of the processing account. Overriden if `aws_accounts` keyword is provided.

Code Examples

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

aws_accounts = [
    {
        "account_number": "string",
        "batch_regions": [
            {
                "job_definition_name": "string",
                "job_queue": "string",
                "region": "string"
            }
        ],
        "iam_external_id": "string",
        "iam_role_arn": "string",
        "kms_alias": "string",
        "processing_account": "string"
    }
]

response = falcon.register_account(aws_accounts=aws_accounts,
                                   account_number="string",
                                   batch_regions=[{"key": "value"}],
                                   iam_external_id="string",
                                   iam_role_arn="string",
                                   kms_alias="string",
                                   processing_account="string")
print(response)

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

aws_accounts = [
    {
        "account_number": "string",
        "batch_regions": [
            {
                "job_definition_name": "string",
                "job_queue": "string",
                "region": "string"
            }
        ],
        "iam_external_id": "string",
        "iam_role_arn": "string",
        "kms_alias": "string",
        "processing_account": "string"
    }
]

response = falcon.RegisterCspmSnapshotAccount(aws_accounts=aws_accounts,
                                              account_number="string",
                                              batch_regions=[{"key": "value"}],
                                              iam_external_id="string",
                                              iam_role_arn="string",
                                              kms_alias="string",
                                              processing_account="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "aws_accounts": [
        {
            "account_number": "string",
            "batch_regions": [
                {
                    "job_definition_name": "string",
                    "job_queue": "string",
                    "region": "string"
                }
            ],
            "iam_external_id": "string",
            "iam_role_arn": "string",
            "kms_alias": "string",
            "processing_account": "string"
        }
    ]
}

response = falcon.command("RegisterCspmSnapshotAccount", body=body_payload)
print(response)

New-FalconSnapshotAwsAccount

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_snapshots"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  account_number := "string"
  job_definition_name := "string"
  job_queue := "string"
  region := "string"
  iam_external_id := "string"
  iam_role_arn := "string"
  kms_alias := "string"
  processing_account := "string"

  response, err := client.CloudSnapshots.Register(
    &cloud_snapshots.RegisterParams{
      Body: &models.ModelsAccountEntitiesInput{
        AwsAccounts: []interface{}{
          {
          AccountNumber: &account_number,
          BatchRegions: []interface{}{
            {
            JobDefinitionName: &job_definition_name,
            JobQueue: &job_queue,
            Region: &region,
            },
          },
          IamExternalID: &iam_external_id,
          IamRoleArn: &iam_role_arn,
          KmsAlias: &kms_alias,
          ProcessingAccount: &processing_account,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudSnapshots.register(
  {
    awsAccounts: [{
        accountNumber: "string",
        batchRegions: [{
            jobDefinitionName: "string",
            jobQueue: "string",
            region: "string"
          }],
        iamExternalId: "string",
        iamRoleArn: "string",
        kmsAlias: "string",
        processingAccount: "string"
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::cloud_snapshots_api::register_cspm_snapshot_account;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ModelsAccountEntitiesInput;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ModelsAccountEntitiesInput {
        aws_accounts: vec![AWSAccountInput {
            account_number: Some("string".to_string()),
            batch_regions: vec![AWSBatchClusterRegion {
                job_definition_name: Some("string".to_string()),
                job_queue: Some("string".to_string()),
                region: Some("string".to_string()),
                ..Default::default()
            }],
            iam_external_id: Some("string".to_string()),
            iam_role_arn: Some("string".to_string()),
            kms_alias: Some("string".to_string()),
            processing_account: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = register_cspm_snapshot_account(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudSnapshots.new

body = Falcon::ModelsAccountEntitiesInput.new(
  aws_accounts: [{
      account_number: 'string',
      batch_regions: [{
          job_definition_name: 'string',
          job_queue: 'string',
          region: 'string'
        }],
      iam_external_id: 'string',
      iam_role_arn: 'string',
      kms_alias: 'string',
      processing_account: 'string'
    }]
)

response = api.register_cspm_snapshot_account(body)

puts response

ReadDeploymentsEntities

Retrieve snapshot jobs identified by the provided IDs.

GET /snapshots/entities/deployments/v1

Scope Snapshot: READ Consumes · Produces application/json

PEP 8 get_scan_jobs

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	Search snapshot jobs by ids - The maximum amount is 100 IDs.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.

Code Examples

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_scan_jobs(ids=id_list)
print(response)

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ReadDeploymentsEntities(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ReadDeploymentsEntities",
                          ids=id_list)
print(response)

Get-FalconSnapshot -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_snapshots"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudSnapshots.ReadDeploymentsEntities(
    &cloud_snapshots.ReadDeploymentsEntitiesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudSnapshots.readDeploymentsEntities(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::cloud_snapshots_api::read_deployments_entities;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_deployments_entities(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudSnapshots.new

response = api.read_deployments_entities(ids: ['ID1', 'ID2', 'ID3'])

puts response

CreateDeploymentEntity

Launch a snapshot scan for a given cloud asset.

POST /snapshots/entities/deployments/v1

Scope Snapshot: WRITE Consumes · Produces application/json

PEP 8 launch_scan_job

Parameters

Name	Type	Data type	Description
account_id	body	string	Cloud provider account ID.
asset_identifier	body	string	Cloud asset identifier.
body	body	list of dictionaries	Full body payload in JSON format.
cloud_provider	body	string	Cloud provider.
region	body	string	Cloud provider region.

Code Examples

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.launch_scan_job(account_id="string",
                                  asset_identifier="string",
                                  cloud_provider="string",
                                  region="string")
print(response)

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.CreateDeploymentEntity(account_id="string",
                                         asset_identifier="string",
                                         cloud_provider="string",
                                         region="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "account_id": "string",
            "asset_identifier": "string",
            "cloud_provider": "string",
            "region": "string"
        }
    ]
}

response = falcon.command("CreateDeploymentEntity", body=body_payload)
print(response)

New-FalconSnapshotScan -CloudProvider "string" `
  -Region "string" `
  -AccountId "string" `
  -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_snapshots"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  account_id := "string"
  asset_identifier := "string"
  cloud_provider := "string"
  region := "string"

  response, err := client.CloudSnapshots.CreateDeploymentEntity(
    &cloud_snapshots.CreateDeploymentEntityParams{
      Body: &models.ModelsCreateDeploymentInput{
        Resources: []interface{}{
          {
          AccountID: &account_id,
          AssetIdentifier: &asset_identifier,
          CloudProvider: &cloud_provider,
          Region: &region,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudSnapshots.createDeploymentEntity(
  {
    resources: [{
        accountId: "string",
        assetIdentifier: "string",
        cloudProvider: "string",
        region: "string"
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::cloud_snapshots_api::create_deployment_entity;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ModelsCreateDeploymentInput;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ModelsCreateDeploymentInput {
        resources: vec![DeploymentResource {
            account_id: Some("string".to_string()),
            asset_identifier: Some("string".to_string()),
            cloud_provider: Some("string".to_string()),
            region: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = create_deployment_entity(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudSnapshots.new

body = Falcon::ModelsCreateDeploymentInput.new(
  resources: [{
      account_id: 'string',
      asset_identifier: 'string',
      cloud_provider: 'string',
      region: 'string'
    }]
)

response = api.create_deployment_entity(body)

puts response

GetCredentialsIAC

Gets the registry credentials (external endpoint).

GET /iac/entities/image-registry-credentials/v1

Scope Infrastructure as Code (IaC): READ Consumes · Produces application/json

PEP 8 get_iac_credentials

No keywords or arguments accepted.

Code Examples

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_iac_credentials()
print(response)

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.GetCredentialsIAC()
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetCredentialsIAC")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspg_iacapi"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CspgIacapi.GetCredentialsMixin0(
    &cspg_iacapi.GetCredentialsMixin0Params{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspgIacapi.getCredentialsMixin0();

console.log(response);

use rusty_falcon::apis::cspg_iacapi_api::get_credentials_mixin0;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_credentials_mixin0(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

GetScanReport

Retrieve the scan report for an instance.

GET /snapshots/entities/scanreports/v1

Scope Snapshot: READ Consumes · Produces application/json

PEP 8 get_scan_reports

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The instance identifiers to fetch the report for.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.

Code Examples

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_scan_reports(ids=id_list)
print(response)

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetScanReport(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetScanReport",
                          ids=id_list)
print(response)

Get-FalconSnapshotScan -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cloud_snapshots"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CloudSnapshots.GetScanReport(
    &cloud_snapshots.GetScanReportParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudSnapshots.getScanReport(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::cloud_snapshots_api::get_scan_report;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_scan_report(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CloudSnapshots.new

response = api.get_scan_report(['ID1', 'ID2', 'ID3'])

puts response

GetCredentialsMixin0

Gets the registry credentials.

GET /snapshots/entities/image-registry-credentials/v1

Scope Snapshot Scanner: READ Consumes · Produces application/json

PEP 8 get_credentials

Parameters

Name	Type	Data type	Description
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_credentials()
print(response)

from falconpy import CloudSnapshots

falcon = CloudSnapshots(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.GetCredentialsMixin0()
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetCredentialsMixin0")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspg_iacapi"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CspgIacapi.GetCredentialsMixin0(
    &cspg_iacapi.GetCredentialsMixin0Params{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspgIacapi.getCredentialsMixin0();

console.log(response);

use rusty_falcon::apis::cspg_iacapi_api::get_credentials_mixin0;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_credentials_mixin0(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

Cloud Snapshots

Table of Contents

CombinedDetections

Parameters

Code Examples

ReadDeploymentsCombined

Parameters

Code Examples

RegisterCspmSnapshotAccount

Parameters

Code Examples

ReadDeploymentsEntities

Parameters

Code Examples

CreateDeploymentEntity

Parameters

Code Examples

GetCredentialsIAC

Code Examples

GetScanReport

Parameters

Code Examples

GetCredentialsMixin0

Parameters

Code Examples