Content Update Policies

The Content Update Policies service collection provides operations for managing content update policies in your CrowdStrike Falcon environment. Search for policy members and policies, perform actions on policies, set precedence, create, delete, and update policies, and query pinnable content versions.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
createContentUpdatePolicies create_policies	Create Content Update Policies by specifying details about the policy to create
deleteContentUpdatePolicies delete_policies	Delete a set of Content Update Policies by specifying their IDs
getContentUpdatePolicies get_policies	Retrieve a set of Content Update Policies by specifying their IDs
performContentUpdatePoliciesAction perform_action	Perform the specified action on the Content Update Policies specified in the request
queryCombinedContentUpdatePolicies query_policies_combined	Search for Content Update Policies in your environment by providing an FQL filter and paging details.
queryCombinedContentUpdatePolicyMembers query_policy_members_combined	Search for members of a Content Update Policy in your environment by providing an FQL filter and paging details.
queryContentUpdatePolicies query_policies	Search for Content Update Policies in your environment by providing an FQL filter and paging details.
queryContentUpdatePolicyMembers query_policy_members	Search for members of a Content Update Policy in your environment by providing an FQL filter and paging details.
queryPinnableContentVersions query_pinnable_content_versions	Search for content versions available for pinning given the category.
setContentUpdatePoliciesPrecedence set_precedence	Sets the precedence of Content Update Policies based on the order of IDs specified in the request.
updateContentUpdatePolicies update_policies	Update Content Update Policies by specifying the ID of the policy and details to update

---

createContentUpdatePolicies

Create Content Update Policies by specifying details about the policy to create

Method POST

Route /policy/entities/content-update/v1

Scope Content Update Policy: WRITE

PEP 8 create_policies

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

description body · string

Content update policy description.

name body · string

Content update policy name.

settings body · dictionary

Content update policy settings.

Code Examples

Python

PEP 8

from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

settings = {
    "ring_assignment_settings": [
        {
            "delay_hours": "string",
            "id": "string",
            "ring_assignment": "string"
        }
    ]
}

response = falcon.create_policies(description="string",
                                  name="string",
                                  settings=settings)
print(response)

Operation ID

from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

settings = {
    "ring_assignment_settings": [
        {
            "delay_hours": "string",
            "id": "string",
            "ring_assignment": "string"
        }
    ]
}

response = falcon.createContentUpdatePolicies(description="string",
                                              name="string",
                                              settings=settings)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "description": "string",
            "name": "string",
            "settings": {
                "ring_assignment_settings": ["string"]
            }
        }
    ]
}

response = falcon.command("createContentUpdatePolicies", body=body_payload)
print(response)

PowerShell

New-FalconContentPolicy -Name "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/content_update_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  name := "string"

  response, err := client.ContentUpdatePolicies.CreateContentUpdatePolicies(
    &content_update_policies.CreateContentUpdatePoliciesParams{
      Body: &models.ContentUpdateCreatePoliciesReqV1{
        Resources: []interface{}{
          {
          Description: &description,
          Name: &name,
          Settings: &struct{}{},
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.contentUpdatePolicies.createContentUpdatePolicies(
  {
    resources: [{
        description: "string",
        name: "string",
        settings: {
          ringAssignmentSettings: []
        }
      }]
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::content_update_policies_api::create_content_update_policies;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ContentUpdateCreatePoliciesReqV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ContentUpdateCreatePoliciesReqV1 {
        resources: vec![CreatePolicyReqV1 {
            name: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = create_content_update_policies(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContentUpdatePolicies.new

body = Falcon::ContentUpdateCreatePoliciesReqV1.new(
  resources: [{
      description: 'string',
      name: 'string',
      settings: {
        ring_assignment_settings: []
      }
    }]
)

response = api.create_content_update_policies(body)

puts response

Responses

201 Created

[
  {
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform_name": "string",
    "settings": {}
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

---

---

deleteContentUpdatePolicies

Delete a set of Content Update Policies by specifying their IDs

Method DELETE

Route /policy/entities/content-update/v1

Scope Content Update Policy: WRITE

PEP 8 delete_policies

Parameters

ids query · string or list of strings

The IDs of the Content Update Policies to delete

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_policies(ids=id_list)
print(response)

Operation ID

from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteContentUpdatePolicies(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deleteContentUpdatePolicies",
                          ids=id_list)
print(response)

PowerShell

Remove-FalconContentPolicy -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/content_update_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ContentUpdatePolicies.DeleteContentUpdatePolicies(
    &content_update_policies.DeleteContentUpdatePoliciesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.contentUpdatePolicies.deleteContentUpdatePolicies(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::content_update_policies_api::delete_content_update_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_content_update_policies(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContentUpdatePolicies.new

response = api.delete_content_update_policies(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  "string"
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

---

---

getContentUpdatePolicies

Retrieve a set of Content Update Policies by specifying their IDs

Method GET

Route /policy/entities/content-update/v1

Scope Content Update Policy: READ

PEP 8 get_policies

Parameters

ids query · string or list of strings

The IDs of the Content Update Policies to return

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_policies(ids=id_list)
print(response)

Operation ID

from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getContentUpdatePolicies(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getContentUpdatePolicies",
                          ids=id_list)
print(response)

PowerShell

Get-FalconContentPolicy -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/content_update_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ContentUpdatePolicies.GetContentUpdatePolicies(
    &content_update_policies.GetContentUpdatePoliciesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.contentUpdatePolicies.getContentUpdatePolicies(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::content_update_policies_api::get_content_update_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_content_update_policies(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContentUpdatePolicies.new

response = api.get_content_update_policies(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform_name": "string",
    "settings": {}
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

---

---

performContentUpdatePoliciesAction

Perform the specified action on the Content Update Policies specified in the request

Method POST

Route /policy/entities/content-update-actions/v1

Scope Content Update Policy: WRITE

PEP 8 perform_action

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

action_parameters body · array

Action specific parameter options.

ids body · array

Content Update policy IDs to perform action against.

action_name query · string

The action to perform

Available values (9)

add-host-group	disable	enable
override-allow	override-pause	override-revert
remove-host-group	remove-pinned-content-version	set-pinned-content-version

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.perform_action(action_name="string",
                                 action_parameters=[{"key": "value"}],
                                 ids=id_list)
print(response)

Operation ID

from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.performContentUpdatePoliciesAction(action_name="string",
                                                     action_parameters=[{"key": "value"}],
                                                     ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "action_parameters": [
        {
            "name": "string",
            "value": "string"
        }
    ],
    "ids": ["string"]
}

response = falcon.command("performContentUpdatePoliciesAction",
                          action_name="string",
                          body=body_payload)
print(response)

PowerShell

Invoke-FalconContentPolicyAction -Name "string" -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/content_update_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"
  value := "string"

  response, err := client.ContentUpdatePolicies.PerformContentUpdatePoliciesAction(
    &content_update_policies.PerformContentUpdatePoliciesActionParams{
      Body: &models.MsaEntityActionRequestV2{
        ActionParameters: []interface{}{
          {
          Name: &name,
          Value: &value,
          },
        },
        Ids: []string{"string"},
      },
      ActionName: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.contentUpdatePolicies.performContentUpdatePoliciesAction(
  "string",  // actionName
  {  // body
      actionParameters: [{
          name: "string",
          value: "string"
        }],
      ids: []
  }
);

console.log(response);

Rust

use rusty_falcon::apis::content_update_policies_api::perform_content_update_policies_action;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaEntityActionRequestV2;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaEntityActionRequestV2 {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = perform_content_update_policies_action(
        &falcon.cfg,  // configuration
        "string",  // action_name
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContentUpdatePolicies.new

body = Falcon::MsaEntityActionRequestV2.new(
  action_parameters: [{
      name: 'string',
      value: 'string'
    }],
  ids: []
)

response = api.perform_content_update_policies_action(body, 'string')

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform_name": "string",
    "settings": {}
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

---

---

queryCombinedContentUpdatePolicies

Search for Content Update Policies in your environment by providing an FQL filter and paging details.

Method GET

Route /policy/combined/content-update/v1

Scope Content Update Policy: READ

PEP 8 query_policies_combined

Parameters

filter query · string

The filter expression that should be used to limit the results.

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return. [1-5000]

sort query · string

The property to sort by.

Available values (16)

created_by.asc	created_by.desc	created_timestamp.asc
created_timestamp.desc	enabled.asc	enabled.desc
modified_by.asc	modified_by.desc	modified_timestamp.asc
modified_timestamp.desc	name.asc	name.desc
platform_name.asc	platform_name.desc	precedence.asc
precedence.desc

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.query_policies_combined(filter="string",
                                          offset=integer,
                                          limit=integer,
                                          sort="string")
print(response)

Operation ID

from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.queryCombinedContentUpdatePolicies(filter="string",
                                                     offset=integer,
                                                     limit=integer,
                                                     sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryCombinedContentUpdatePolicies",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

PowerShell

Get-FalconContentPolicy -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/content_update_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.ContentUpdatePolicies.QueryCombinedContentUpdatePolicies(
    &content_update_policies.QueryCombinedContentUpdatePoliciesParams{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.contentUpdatePolicies.queryCombinedContentUpdatePolicies(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

Rust

use rusty_falcon::apis::content_update_policies_api::query_combined_content_update_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_combined_content_update_policies(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContentUpdatePolicies.new

response = api.query_combined_content_update_policies(filter: 'string',
                                                      offset: integer,
                                                      limit: integer,
                                                      sort: 'string')

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform_name": "string",
    "settings": {}
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

---

---

queryCombinedContentUpdatePolicyMembers

Search for members of a Content Update Policy in your environment by providing an FQL filter and paging details.

Method GET

Route /policy/combined/content-update-members/v1

Scope Content Update Policy: READ

PEP 8 query_policy_members_combined

Parameters

id query · string

The ID of the Content Update Policy to search for members of

filter query · string

The filter expression that should be used to limit the results.

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return. [1-5000]

sort query · string

The property to sort by.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.query_policy_members_combined(id="string",
                                                filter="string",
                                                offset=integer,
                                                limit=integer,
                                                sort="string")
print(response)

Operation ID

from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.queryCombinedContentUpdatePolicyMembers(id="string",
                                                          filter="string",
                                                          offset=integer,
                                                          limit=integer,
                                                          sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryCombinedContentUpdatePolicyMembers",
                          id="string",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

PowerShell

Get-FalconContentPolicyMember -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/content_update_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  iD := "string"
  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.ContentUpdatePolicies.QueryCombinedContentUpdatePolicyMembers(
    &content_update_policies.QueryCombinedContentUpdatePolicyMembersParams{
      ID: &iD,
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.contentUpdatePolicies.queryCombinedContentUpdatePolicyMembers(
  "string",  // id
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

Rust

use rusty_falcon::apis::content_update_policies_api::query_combined_content_update_policy_members;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_combined_content_update_policy_members(
        &falcon.cfg,  // configuration
        Some("string"),  // id
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContentUpdatePolicies.new

response = api.query_combined_content_update_policy_members(id: 'string',
                                                            filter: 'string',
                                                            offset: integer,
                                                            limit: integer,
                                                            sort: 'string')

puts response

Responses

200 OK

[
  {
    "agent_load_flags": "string",
    "agent_local_time": "string",
    "agent_version": "string",
    "base_image_version": "string",
    "bios_manufacturer": "string",
    "bios_version": "string",
    "build_number": "string",
    "chassis_type": "string",
    "chassis_type_desc": "string",
    "cid": "string",
    "cloud_service_compartment_id": "string",
    "config_id_base": "string",
    "config_id_build": "string",
    "config_id_platform": "string",
    "connection_ip": "string",
    "connection_mac_address": "string",
    "cpu_signature": "string",
    "cpu_vendor": "string",
    "criticality": "string",
    "default_gateway_ip": "string",
    "deployment_type": "string",
    "detection_suppression_status": "string",
    "device_id": "string",
    "device_policies": {},
    "email": "string",
    "external_ip": "string",
    "filesystem_containment_status": "string",
    "first_login_timestamp": "string",
    "first_login_user": "string",
    "first_seen": "string",
    "group_hash": "string",
    "groups": [],
    "host_deleted_status": "string",
    "host_hidden_status": "string",
    "host_utc_offset": "string",
    "hostname": "string",
    "instance_id": "string",
    "internet_exposure": "string",
    "k8s_cluster_git_version": "string",
    "k8s_cluster_id": "string",
    "k8s_cluster_version": "string",
    "kernel_version": "string",
    "last_login_timestamp": "string",
    "last_login_uid": "string",
    "last_login_user": "string",
    "last_login_user_sid": "string",
    "last_reboot": "string",
    "last_seen": "string",
    "license_activation_state": "string",
    "linux_sensor_mode": "string",
    "local_ip": "string",
    "mac_address": "string",
    "machine_domain": "string",
    "major_version": "string",
    "managed_apps": {},
    "meta": {},
    "migration_completed_time": "string",
    "minor_version": "string",
    "modified_timestamp": "string",
    "notes": [],
    "os_build": "string",
    "os_product_name": "string",
    "os_version": "string",
    "ou": [],
    "platform_id": "string",
    "platform_name": "string",
    "pod_annotations": [],
    "pod_host_ip4": "string",
    "pod_host_ip6": "string",
    "pod_hostname": "string",
    "pod_id": "string",
    "pod_ip4": "string",
    "pod_ip6": "string",
    "pod_labels": [],
    "pod_name": "string",
    "pod_namespace": "string",
    "pod_service_account_name": "string",
    "pointer_size": "string",
    "policies": [],
    "product_type": "string",
    "product_type_desc": "string",
    "provision_status": "string",
    "reduced_functionality_mode": "string",
    "release_group": "string",
    "rtr_state": "string",
    "safe_mode": "string",
    "serial_number": "string",
    "service_pack_major": "string",
    "service_pack_minor": "string",
    "service_provider": "string",
    "service_provider_account_id": "string",
    "site_name": "string",
    "slow_changing_modified_timestamp": "string",
    "status": "string",
    "system_manufacturer": "string",
    "system_product_name": "string",
    "tags": [],
    "zone_group": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "agent_load_flags": "string",
      "agent_local_time": "string",
      "agent_version": "string",
      "base_image_version": "string",
      "bios_manufacturer": "string",
      "bios_version": "string",
      "build_number": "string",
      "chassis_type": "string",
      "chassis_type_desc": "string",
      "cid": "string",
      "cloud_service_compartment_id": "string",
      "config_id_base": "string",
      "config_id_build": "string",
      "config_id_platform": "string",
      "connection_ip": "string",
      "connection_mac_address": "string",
      "cpu_signature": "string",
      "cpu_vendor": "string",
      "criticality": "string",
      "default_gateway_ip": "string",
      "deployment_type": "string",
      "detection_suppression_status": "string",
      "device_id": "string",
      "device_policies": {},
      "email": "string",
      "external_ip": "string",
      "filesystem_containment_status": "string",
      "first_login_timestamp": "string",
      "first_login_user": "string",
      "first_seen": "string",
      "group_hash": "string",
      "groups": [],
      "host_deleted_status": "string",
      "host_hidden_status": "string",
      "host_utc_offset": "string",
      "hostname": "string",
      "instance_id": "string",
      "internet_exposure": "string",
      "k8s_cluster_git_version": "string",
      "k8s_cluster_id": "string",
      "k8s_cluster_version": "string",
      "kernel_version": "string",
      "last_login_timestamp": "string",
      "last_login_uid": "string",
      "last_login_user": "string",
      "last_login_user_sid": "string",
      "last_reboot": "string",
      "last_seen": "string",
      "license_activation_state": "string",
      "linux_sensor_mode": "string",
      "local_ip": "string",
      "mac_address": "string",
      "machine_domain": "string",
      "major_version": "string",
      "managed_apps": {},
      "meta": {},
      "migration_completed_time": "string",
      "minor_version": "string",
      "modified_timestamp": "string",
      "notes": [],
      "os_build": "string",
      "os_product_name": "string",
      "os_version": "string",
      "ou": [],
      "platform_id": "string",
      "platform_name": "string",
      "pod_annotations": [],
      "pod_host_ip4": "string",
      "pod_host_ip6": "string",
      "pod_hostname": "string",
      "pod_id": "string",
      "pod_ip4": "string",
      "pod_ip6": "string",
      "pod_labels": [],
      "pod_name": "string",
      "pod_namespace": "string",
      "pod_service_account_name": "string",
      "pointer_size": "string",
      "policies": [],
      "product_type": "string",
      "product_type_desc": "string",
      "provision_status": "string",
      "reduced_functionality_mode": "string",
      "release_group": "string",
      "rtr_state": "string",
      "safe_mode": "string",
      "serial_number": "string",
      "service_pack_major": "string",
      "service_pack_minor": "string",
      "service_provider": "string",
      "service_provider_account_id": "string",
      "site_name": "string",
      "slow_changing_modified_timestamp": "string",
      "status": "string",
      "system_manufacturer": "string",
      "system_product_name": "string",
      "tags": [],
      "zone_group": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "agent_load_flags": "string",
      "agent_local_time": "string",
      "agent_version": "string",
      "base_image_version": "string",
      "bios_manufacturer": "string",
      "bios_version": "string",
      "build_number": "string",
      "chassis_type": "string",
      "chassis_type_desc": "string",
      "cid": "string",
      "cloud_service_compartment_id": "string",
      "config_id_base": "string",
      "config_id_build": "string",
      "config_id_platform": "string",
      "connection_ip": "string",
      "connection_mac_address": "string",
      "cpu_signature": "string",
      "cpu_vendor": "string",
      "criticality": "string",
      "default_gateway_ip": "string",
      "deployment_type": "string",
      "detection_suppression_status": "string",
      "device_id": "string",
      "device_policies": {},
      "email": "string",
      "external_ip": "string",
      "filesystem_containment_status": "string",
      "first_login_timestamp": "string",
      "first_login_user": "string",
      "first_seen": "string",
      "group_hash": "string",
      "groups": [],
      "host_deleted_status": "string",
      "host_hidden_status": "string",
      "host_utc_offset": "string",
      "hostname": "string",
      "instance_id": "string",
      "internet_exposure": "string",
      "k8s_cluster_git_version": "string",
      "k8s_cluster_id": "string",
      "k8s_cluster_version": "string",
      "kernel_version": "string",
      "last_login_timestamp": "string",
      "last_login_uid": "string",
      "last_login_user": "string",
      "last_login_user_sid": "string",
      "last_reboot": "string",
      "last_seen": "string",
      "license_activation_state": "string",
      "linux_sensor_mode": "string",
      "local_ip": "string",
      "mac_address": "string",
      "machine_domain": "string",
      "major_version": "string",
      "managed_apps": {},
      "meta": {},
      "migration_completed_time": "string",
      "minor_version": "string",
      "modified_timestamp": "string",
      "notes": [],
      "os_build": "string",
      "os_product_name": "string",
      "os_version": "string",
      "ou": [],
      "platform_id": "string",
      "platform_name": "string",
      "pod_annotations": [],
      "pod_host_ip4": "string",
      "pod_host_ip6": "string",
      "pod_hostname": "string",
      "pod_id": "string",
      "pod_ip4": "string",
      "pod_ip6": "string",
      "pod_labels": [],
      "pod_name": "string",
      "pod_namespace": "string",
      "pod_service_account_name": "string",
      "pointer_size": "string",
      "policies": [],
      "product_type": "string",
      "product_type_desc": "string",
      "provision_status": "string",
      "reduced_functionality_mode": "string",
      "release_group": "string",
      "rtr_state": "string",
      "safe_mode": "string",
      "serial_number": "string",
      "service_pack_major": "string",
      "service_pack_minor": "string",
      "service_provider": "string",
      "service_provider_account_id": "string",
      "site_name": "string",
      "slow_changing_modified_timestamp": "string",
      "status": "string",
      "system_manufacturer": "string",
      "system_product_name": "string",
      "tags": [],
      "zone_group": "string"
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "agent_load_flags": "string",
      "agent_local_time": "string",
      "agent_version": "string",
      "base_image_version": "string",
      "bios_manufacturer": "string",
      "bios_version": "string",
      "build_number": "string",
      "chassis_type": "string",
      "chassis_type_desc": "string",
      "cid": "string",
      "cloud_service_compartment_id": "string",
      "config_id_base": "string",
      "config_id_build": "string",
      "config_id_platform": "string",
      "connection_ip": "string",
      "connection_mac_address": "string",
      "cpu_signature": "string",
      "cpu_vendor": "string",
      "criticality": "string",
      "default_gateway_ip": "string",
      "deployment_type": "string",
      "detection_suppression_status": "string",
      "device_id": "string",
      "device_policies": {},
      "email": "string",
      "external_ip": "string",
      "filesystem_containment_status": "string",
      "first_login_timestamp": "string",
      "first_login_user": "string",
      "first_seen": "string",
      "group_hash": "string",
      "groups": [],
      "host_deleted_status": "string",
      "host_hidden_status": "string",
      "host_utc_offset": "string",
      "hostname": "string",
      "instance_id": "string",
      "internet_exposure": "string",
      "k8s_cluster_git_version": "string",
      "k8s_cluster_id": "string",
      "k8s_cluster_version": "string",
      "kernel_version": "string",
      "last_login_timestamp": "string",
      "last_login_uid": "string",
      "last_login_user": "string",
      "last_login_user_sid": "string",
      "last_reboot": "string",
      "last_seen": "string",
      "license_activation_state": "string",
      "linux_sensor_mode": "string",
      "local_ip": "string",
      "mac_address": "string",
      "machine_domain": "string",
      "major_version": "string",
      "managed_apps": {},
      "meta": {},
      "migration_completed_time": "string",
      "minor_version": "string",
      "modified_timestamp": "string",
      "notes": [],
      "os_build": "string",
      "os_product_name": "string",
      "os_version": "string",
      "ou": [],
      "platform_id": "string",
      "platform_name": "string",
      "pod_annotations": [],
      "pod_host_ip4": "string",
      "pod_host_ip6": "string",
      "pod_hostname": "string",
      "pod_id": "string",
      "pod_ip4": "string",
      "pod_ip6": "string",
      "pod_labels": [],
      "pod_name": "string",
      "pod_namespace": "string",
      "pod_service_account_name": "string",
      "pointer_size": "string",
      "policies": [],
      "product_type": "string",
      "product_type_desc": "string",
      "provision_status": "string",
      "reduced_functionality_mode": "string",
      "release_group": "string",
      "rtr_state": "string",
      "safe_mode": "string",
      "serial_number": "string",
      "service_pack_major": "string",
      "service_pack_minor": "string",
      "service_provider": "string",
      "service_provider_account_id": "string",
      "site_name": "string",
      "slow_changing_modified_timestamp": "string",
      "status": "string",
      "system_manufacturer": "string",
      "system_product_name": "string",
      "tags": [],
      "zone_group": "string"
    }
  ]
}

---

---

queryContentUpdatePolicies

Search for Content Update Policies in your environment by providing an FQL filter and paging details.

Method GET

Route /policy/queries/content-update/v1

Scope Content Update Policy: READ

PEP 8 query_policies

Parameters

filter query · string

The filter expression that should be used to limit the results.

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return. [1-5000]

sort query · string

The property to sort by.

Available values (16)

created_by.asc	created_by.desc	created_timestamp.asc
created_timestamp.desc	enabled.asc	enabled.desc
modified_by.asc	modified_by.desc	modified_timestamp.asc
modified_timestamp.desc	name.asc	name.desc
platform_name.asc	platform_name.desc	precedence.asc
precedence.desc

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.query_policies(filter="string",
                                 offset=integer,
                                 limit=integer,
                                 sort="string")
print(response)

Operation ID

from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.queryContentUpdatePolicies(filter="string",
                                             offset=integer,
                                             limit=integer,
                                             sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryContentUpdatePolicies",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

PowerShell

Get-FalconContentPolicy -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/content_update_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.ContentUpdatePolicies.QueryContentUpdatePolicies(
    &content_update_policies.QueryContentUpdatePoliciesParams{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.contentUpdatePolicies.queryContentUpdatePolicies(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

Rust

use rusty_falcon::apis::content_update_policies_api::query_content_update_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_content_update_policies(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContentUpdatePolicies.new

response = api.query_content_update_policies(filter: 'string',
                                             offset: integer,
                                             limit: integer,
                                             sort: 'string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

---

---

queryContentUpdatePolicyMembers

Search for members of a Content Update Policy in your environment by providing an FQL filter and paging details.

Method GET

Route /policy/queries/content-update-members/v1

Scope Content Update Policy: READ

PEP 8 query_policy_members

Parameters

id query · string

The ID of the Content Update Policy to search for members of

filter query · string

The filter expression that should be used to limit the results.

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return. [1-5000]

sort query · string

The property to sort by.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.query_policy_members(id="string",
                                       filter="string",
                                       offset=integer,
                                       limit=integer,
                                       sort="string")
print(response)

Operation ID

from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.queryContentUpdatePolicyMembers(id="string",
                                                  filter="string",
                                                  offset=integer,
                                                  limit=integer,
                                                  sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryContentUpdatePolicyMembers",
                          id="string",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

PowerShell

Get-FalconContentPolicyMember -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/content_update_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  iD := "string"
  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.ContentUpdatePolicies.QueryContentUpdatePolicyMembers(
    &content_update_policies.QueryContentUpdatePolicyMembersParams{
      ID: &iD,
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.contentUpdatePolicies.queryContentUpdatePolicyMembers(
  "string",  // id
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

Rust

use rusty_falcon::apis::content_update_policies_api::query_content_update_policy_members;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_content_update_policy_members(
        &falcon.cfg,  // configuration
        Some("string"),  // id
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContentUpdatePolicies.new

response = api.query_content_update_policy_members(id: 'string',
                                                   filter: 'string',
                                                   offset: integer,
                                                   limit: integer,
                                                   sort: 'string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

---

---

queryPinnableContentVersions

Search for content versions available for pinning given the category.

Method GET

Route /policy/queries/content-update-pin-versions/v1

Scope Content Update Policy: READ

PEP 8 query_pinnable_content_versions

Parameters

category query · string

Content category

Available values (4)

rapid_response_al_bl_listing	sensor_operations	system_critical
vulnerability_management

sort query · string

value to sort returned content versions by. Allowed sort values are deployed_timestamp.(asc|desc) defaulting to deployed_timestamp.desc

Available values (2)

deployed_timestamp.asc

deployed_timestamp.desc

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.query_pinnable_content_versions(category="string",
                                                  sort="string")
print(response)

Operation ID

from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.queryPinnableContentVersions(category="string", sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryPinnableContentVersions",
                          category="string",
                          sort="string")
print(response)

PowerShell

Get-FalconContentVersion -Category "string" -Sort "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/content_update_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  sort := "string"

  response, err := client.ContentUpdatePolicies.QueryPinnableContentVersions(
    &content_update_policies.QueryPinnableContentVersionsParams{
      Category: "string",
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.contentUpdatePolicies.queryPinnableContentVersions(
  "string",  // category
  "string"  // sort
);

console.log(response);

Rust

use rusty_falcon::apis::content_update_policies_api::query_pinnable_content_versions;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_pinnable_content_versions(
        &falcon.cfg,  // configuration
        "string",  // category
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContentUpdatePolicies.new

response = api.query_pinnable_content_versions('string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

---

---

setContentUpdatePoliciesPrecedence

Sets the precedence of Content Update Policies based on the order of IDs specified in the request.

Method POST

Route /policy/entities/content-update-precedence/v1

Scope Content Update Policy: WRITE

PEP 8 set_precedence

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

ids body · array

The ids of all current content-update policies for the platform specified. The precedence will be set in the order the ids are specified

Code Examples

Python

PEP 8

from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.set_precedence(ids=id_list)
print(response)

Operation ID

from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.setContentUpdatePoliciesPrecedence(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "ids": ["string"]
}

response = falcon.command("setContentUpdatePoliciesPrecedence", body=body_payload)
print(response)

PowerShell

Set-FalconContentPrecedence -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/content_update_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ContentUpdatePolicies.SetContentUpdatePoliciesPrecedence(
    &content_update_policies.SetContentUpdatePoliciesPrecedenceParams{
      Body: &models.BaseSetContentUpdatePolicyPrecedenceReqV1{
        Ids: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.contentUpdatePolicies.setContentUpdatePoliciesPrecedence(
  {
    ids: []
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::content_update_policies_api::set_content_update_policies_precedence;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::BaseSetContentUpdatePolicyPrecedenceReqV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = BaseSetContentUpdatePolicyPrecedenceReqV1 {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = set_content_update_policies_precedence(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContentUpdatePolicies.new

body = Falcon::BaseSetContentUpdatePolicyPrecedenceReqV1.new(
  ids: []
)

response = api.set_content_update_policies_precedence(body)

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

---

---

updateContentUpdatePolicies

Update Content Update Policies by specifying the ID of the policy and details to update

Method PATCH

Route /policy/entities/content-update/v1

Scope Content Update Policy: WRITE

PEP 8 update_policies

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

Code Examples

Python

PEP 8

from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

resources = [
    {
        "description": "string",
        "id": "string",
        "name": "string",
        "settings": {
            "ring_assignment_settings": ["string"]
        }
    }
]

response = falcon.update_policies(resources=resources)
print(response)

Operation ID

from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

resources = [
    {
        "description": "string",
        "id": "string",
        "name": "string",
        "settings": {
            "ring_assignment_settings": ["string"]
        }
    }
]

response = falcon.updateContentUpdatePolicies(resources=resources)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "description": "string",
            "id": "string",
            "name": "string",
            "settings": {
                "ring_assignment_settings": ["string"]
            }
        }
    ]
}

response = falcon.command("updateContentUpdatePolicies", body=body_payload)
print(response)

PowerShell

Edit-FalconContentPolicy -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/content_update_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  id := "string"
  name := "string"

  response, err := client.ContentUpdatePolicies.UpdateContentUpdatePolicies(
    &content_update_policies.UpdateContentUpdatePoliciesParams{
      Body: &models.ContentUpdateUpdatePoliciesReqV1{
        Resources: []interface{}{
          {
          Description: &description,
          ID: &id,
          Name: &name,
          Settings: &struct{}{},
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.contentUpdatePolicies.updateContentUpdatePolicies(
  {
    resources: [{
        description: "string",
        id: "string",
        name: "string",
        settings: {
          ringAssignmentSettings: []
        }
      }]
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::content_update_policies_api::update_content_update_policies;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ContentUpdateUpdatePoliciesReqV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ContentUpdateUpdatePoliciesReqV1 {
        resources: vec![UpdatePolicyReqV1 {
            id: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = update_content_update_policies(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContentUpdatePolicies.new

body = Falcon::ContentUpdateUpdatePoliciesReqV1.new(
  resources: [{
      description: 'string',
      id: 'string',
      name: 'string',
      settings: {
        ring_assignment_settings: []
      }
    }]
)

response = api.update_content_update_policies(body)

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform_name": "string",
    "settings": {}
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}