Configuration Assessment Evaluation Logic

The Configuration Assessment Evaluation Logic service collection provides operations for retrieving evaluation logic details used in configuration assessment findings. Fetch evaluation logic items by finding ID to understand the rules and criteria applied during assessment.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
getEvaluationLogicMixin0 get_evaluation_logic	Get details on evaluation logic items by providing one or more finding IDs.

---

getEvaluationLogicMixin0

Get details on evaluation logic items by providing one or more finding IDs.

Method GET

Route /configuration-assessment/entities/evaluation-logic/v1

Scope Configuration Assessment: READ

PEP 8 get_evaluation_logic

Parameters

ids query · string or list of strings

One or more evaluation logic finding IDs.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ConfigurationAssessmentEvaluationLogic

falcon = ConfigurationAssessmentEvaluationLogic(client_id=CLIENT_ID,
                                                client_secret=CLIENT_SECRET
                                                )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_evaluation_logic(ids=id_list)
print(response)

Operation ID

from falconpy import ConfigurationAssessmentEvaluationLogic

falcon = ConfigurationAssessmentEvaluationLogic(client_id=CLIENT_ID,
                                                client_secret=CLIENT_SECRET
                                                )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getEvaluationLogicMixin0(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getEvaluationLogicMixin0",
                          ids=id_list)
print(response)

PowerShell

Get-FalconConfigAssessmentLogic -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/configuration_assessment_evaluation_logic"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ConfigurationAssessmentEvaluationLogic.GetEvaluationLogicMixin0(
    &configuration_assessment_evaluation_logic.GetEvaluationLogicMixin0Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.configurationAssessmentEvaluationLogic.getEvaluationLogicMixin0(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::configuration_assessment_evaluation_logic_api::get_evaluation_logic_mixin0;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_evaluation_logic_mixin0(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ConfigurationAssessmentEvaluationLogic.new

response = api.get_evaluation_logic_mixin0(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "aid": "string",
    "cid": "string",
    "created_timestamp": "string",
    "data_provider": "string",
    "host_info": {},
    "id": "string",
    "logic": [],
    "scanner_id": "string",
    "simplified_logic": [],
    "updated_timestamp": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}