Correlation Rules Admin

The Correlation Rules Admin service collection provides administrative operations for managing correlation rules. Change ownership of existing correlation rules to assign them to different API clients or users.

Language	Last Update
Python	v1.6.5
PowerShell
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

Operation	Description
entities.rules_ownership.put.v1 `change_correlation_rule_owner`	Change the owner of an existing Correlation Rule
entities.rules_ownership.put.v2 `entities_rules_ownership_put_v2`	Bulk change the owner of existing Correlation Rules

entities.rules_ownership.put.v1

Change the owner of an existing Correlation Rule

Method PUT

Route /correlation-rules/entities/rules/ownership/v1

Scope Correlation Rules Admin: WRITE

PEP 8 change_correlation_rule_owner

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

api_client_id body · string

The API client ID.

id body · string

The rule ID.

user_id body · string

The user ID.

user_uuid body · string

The user UUID.

Code Examples

from falconpy import CorrelationRulesAdmin

falcon = CorrelationRulesAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.change_correlation_rule_owner(api_client_id="string",
                                                id="string",
                                                user_id="string",
                                                user_uuid="string")
print(response)

from falconpy import CorrelationRulesAdmin

falcon = CorrelationRulesAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.entities_rules_ownership_put_v1(api_client_id="string",
                                                  id="string",
                                                  user_id="string",
                                                  user_uuid="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "api_client_id": "string",
    "id": "string",
    "user_id": "string",
    "user_uuid": "string"
}

response = falcon.command("entities_rules_ownership_put_v1", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/correlation_rules_admin"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  api_client_id := "string"
  id := "string"
  user_id := "string"
  user_uuid := "string"

  response, err := client.CorrelationRulesAdmin.EntitiesRulesOwnershipPutV1(
    &correlation_rules_admin.EntitiesRulesOwnershipPutV1Params{
      Body: &models.CorrelationrulesapiRuleOwnerPutRequestV1{
        ApiClientID: &api_client_id,
        ID: &id,
        UserID: &user_id,
        UserUuid: &user_uuid,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.correlationRulesAdmin.entitiesRulesOwnershipPutV1(
  {
    apiClientId: "string",
    id: "string",
    userId: "string",
    userUuid: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::correlation_rules_admin_api::entities_rules_ownership_put_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApiRuleOwnerPutRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ApiRuleOwnerPutRequestV1 {
        id: Some("string".to_string()),
        ..Default::default()
    };

    let response = entities_rules_ownership_put_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CorrelationRulesAdmin.new

body = Falcon::CorrelationrulesapiRuleOwnerPutRequestV1.new(
  api_client_id: 'string',
  id: 'string',
  user_id: 'string',
  user_uuid: 'string'
)

response = api.entities_rules_ownership_put_v1(body)

puts response

Responses

[
  {
    "anomaly": {},
    "api_client_id": "string",
    "author": "string",
    "comment": "string",
    "created_on": "string",
    "customer_id": "string",
    "description": "string",
    "executor_rule_id": "string",
    "guardrail_notifications": [],
    "id": "string",
    "last_execution": {},
    "last_updated_on": "string",
    "mitre_attack": [],
    "name": "string",
    "next_execution_on": "string",
    "notifications": [],
    "operation": {},
    "rule_id": "string",
    "search": {},
    "severity": 0,
    "state": "string",
    "status": "string",
    "status_msg": "string",
    "tactic": "string",
    "technique": "string",
    "template_id": "string",
    "type": "string",
    "updated_by_api_client_id": "string",
    "updated_by_user_id": "string",
    "updated_by_user_uuid": "string",
    "user_id": "string",
    "user_uuid": "string",
    "version": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

entities.rules_ownership.put.v2

Bulk change the owner of existing Correlation Rules

Method PUT

Route /correlation-rules/entities/rules/ownership/v2

Scope Correlation Rules Admin: WRITE

PEP 8 entities_rules_ownership_put_v2

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

api_client_id body · string

The api_client_id value.

ids body · array

The ids value.

user_id body · string

The user_id value.

user_uuid body · string

The user_uuid value.

Code Examples

from falconpy import CorrelationRulesAdmin

falcon = CorrelationRulesAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_rules_ownership_put_v2(api_client_id="string",
                                                  ids=id_list,
                                                  user_id="string",
                                                  user_uuid="string")
print(response)

from falconpy import CorrelationRulesAdmin

falcon = CorrelationRulesAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_rules_ownership_put_v2(api_client_id="string",
                                                  ids=id_list,
                                                  user_id="string",
                                                  user_uuid="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "api_client_id": "string",
    "ids": ["string"],
    "user_id": "string",
    "user_uuid": "string"
}

response = falcon.command("entities_rules_ownership_put_v2", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/correlation_rules_admin"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  api_client_id := "string"
  user_id := "string"
  user_uuid := "string"

  response, err := client.CorrelationRulesAdmin.EntitiesRulesOwnershipPutV2(
    &correlation_rules_admin.EntitiesRulesOwnershipPutV2Params{
      Body: &models.CorrelationrulesapiBulkRuleOwnerPutRequestV1{
        ApiClientID: &api_client_id,
        Ids: []string{"string"},
        UserID: &user_id,
        UserUuid: &user_uuid,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.correlationRulesAdmin.entitiesRulesOwnershipPutV2(
  {
    apiClientId: "string",
    ids: [],
    userId: "string",
    userUuid: "string"
}  // body
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CorrelationRulesAdmin.new

body = Falcon::CorrelationrulesapiBulkRuleOwnerPutRequestV1.new(
  api_client_id: 'string',
  ids: [],
  user_id: 'string',
  user_uuid: 'string'
)

response = api.entities_rules_ownership_put_v2(body)

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

Correlation Rules Admin

Table of Contents

entities.rules_ownership.put.v1

Parameters

entities.rules_ownership.put.v2

Parameters