Correlation Rules

The Correlation Rules service collection provides operations for managing correlation rules and templates. Create, update, delete, and query correlation rules. Export and import rule versions, publish rule versions, and manage rule templates.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

Operation	Description
aggregates.rule-versions.post.v1 `aggregate_rule_versions`	Get rules aggregates as specified via json in the request body.
combined.rules.get.v1 `get_rules_combined`	Find all rules matching the query and filter.
combined.rules.get.v2 `get_rules_combined_v2`	Find all rules matching the query and filter.
entities.latest-rules.get.v1 `get_latest_rule_versions`	Retrieve latest rule versions by rule IDs
entities.rule-versions.delete.v1 `delete_rule_versions`	Delete versions by IDs
entities.rule-versions_export.post.v1 `export_rule`	Export rule versions
entities.rule-versions_import.post.v1 `import_rule`	Import rule versions
entities.rule-versions_publish.patch.v1 `publish_rule_version`	Publish existing rule version
entities.rules.delete.v1 `delete_rules`	Delete rules by IDs
entities.rules.get.v1 `get_rules`	Retrieve rules by IDs
entities.rules.get.v2 `get_rules_v2`	Retrieve rule versions by IDs
entities.rules.patch.v1 `update_rule`	Update rules
entities.rules.post.v1 `create_rule`	Create rule
entities.templates.get.v1Mixin0 `get_rule_templates_by_id`	Retrieve rule templates by IDs
entities.templates_rules.post.v1 `create_rule_from_template`	Create rule from template
queries.rules.get.v1 `query_rules`	Find all rule IDs matching the query and filter.
queries.rules.get.v2 `query_rules_v2`	Find all rule version IDs matching the query and filter.
queries.templates.get.v1Mixin0 `search_rule_template_ids`	Search rule template IDs matching the filter.

aggregates.rule-versions.post.v1

Get rules aggregates as specified via json in the request body.

Method POST

Route /correlation-rules/aggregates/rule-versions/v1

Scope Correlation Rules: WRITE

PEP 8 aggregate_rule_versions

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

ids query · string or list of strings

The IDs

filter query · string

FQL query specifying the filter parameters.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.aggregate_rule_versions(filter="string", ids=id_list)
print(response)

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.aggregates_rule_versions_post_v1(filter="string", ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("aggregates_rule_versions_post_v1", ids=id_list, filter="string", body={})
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/correlation_rules"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.CorrelationRules.AggregatesRuleVersionsPostV1(
    &correlation_rules.AggregatesRuleVersionsPostV1Params{
      Body: []models.MsaAggregateQueryRequest{},
      Ids: []string{"ID1", "ID2", "ID3"},
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.correlationRules.aggregatesRuleVersionsPostV1(
  ["ID1", "ID2", "ID3"],  // ids
  [{}],  // body
  "string"  // filter
);

console.log(response);

use rusty_falcon::apis::correlation_rules_api::aggregates_rule_versions_post_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = aggregates_rule_versions_post_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
        vec![serde_json::json!({})],  // body
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CorrelationRules.new

body = [{}]

response = api.aggregates_rule_versions_post_v1(body, ['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "buckets": [],
      "doc_count_error_upper_bound": 0,
      "hits": {},
      "name": "string",
      "sum_other_doc_count": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "buckets": [],
      "doc_count_error_upper_bound": 0,
      "hits": {},
      "name": "string",
      "sum_other_doc_count": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "buckets": [],
      "doc_count_error_upper_bound": 0,
      "hits": {},
      "name": "string",
      "sum_other_doc_count": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "buckets": [],
      "doc_count_error_upper_bound": 0,
      "hits": {},
      "name": "string",
      "sum_other_doc_count": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "buckets": [],
      "doc_count_error_upper_bound": 0,
      "hits": {},
      "name": "string",
      "sum_other_doc_count": 0
    }
  ]
}

combined.rules.get.v1

Find all rules matching the query and filter.

Method GET

Route /correlation-rules/combined/rules/v1

Scope Correlation Rules: READ

PEP 8 get_rules_combined

Parameters

filter query · string

FQL query specifying the filter parameters

Available values (9)

`customer_id`	`user_id`	`user_uuid`
`status`	`name`	`created_on`
`last_updated_on`	`created_on`	`last_updated_on`

q query · string

Match query criteria, which includes all the filter string fields

sort query · string

Rule property to sort on.

Available values (4)

`created_on`	`created_on\|desc`	`last_updated_on`
`last_updated_on\|desc`

offset query · integer

Starting index of overall result set from which to return IDs

limit query · integer

Number of IDs to return

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.get_rules_combined(filter="string",
                                     q="string",
                                     sort="string",
                                     offset=integer,
                                     limit=integer)
print(response)

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.combined_rules_get_v1(filter="string",
                                        q="string",
                                        sort="string",
                                        offset=integer,
                                        limit=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("combined_rules_get_v1",
                          filter="string",
                          q="string",
                          sort="string",
                          offset=integer,
                          limit=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/correlation_rules"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  q := "string"
  sort := "string"
  offset := int64(0)
  limit := int64(0)

  response, err := client.CorrelationRules.CombinedRulesGetV1(
    &correlation_rules.CombinedRulesGetV1Params{
      Filter: &filter,
      Q: &q,
      Sort: &sort,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.correlationRules.combinedRulesGetV1(
  "string",  // filter
  "string",  // q
  "string",  // sort
  integer,  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::correlation_rules_api::combined_rules_get_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = combined_rules_get_v1(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // q
        Some("string"),  // sort
        Some(integer),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CorrelationRules.new

response = api.combined_rules_get_v1(filter: 'string',
                                     q: 'string',
                                     sort: 'string',
                                     offset: integer,
                                     limit: integer)

puts response

Responses

[
  {
    "anomaly": {},
    "api_client_id": "string",
    "author": "string",
    "comment": "string",
    "created_on": "string",
    "customer_id": "string",
    "description": "string",
    "executor_rule_id": "string",
    "guardrail_notifications": [],
    "id": "string",
    "last_execution": {},
    "last_updated_on": "string",
    "mitre_attack": [],
    "name": "string",
    "next_execution_on": "string",
    "notifications": [],
    "operation": {},
    "rule_id": "string",
    "search": {},
    "severity": 0,
    "state": "string",
    "status": "string",
    "status_msg": "string",
    "tactic": "string",
    "technique": "string",
    "template_id": "string",
    "type": "string",
    "updated_by_api_client_id": "string",
    "updated_by_user_id": "string",
    "updated_by_user_uuid": "string",
    "user_id": "string",
    "user_uuid": "string",
    "version": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

combined.rules.get.v2

Find all rules matching the query and filter.

Method GET

Route /correlation-rules/combined/rules/v2

Scope Correlation Rules: READ

PEP 8 get_rules_combined_v2

Parameters

filter query · string

FQL query specifying the filter parameters

Available values (9)

`customer_id`	`user_id`	`user_uuid`
`status`	`name`	`created_on`
`last_updated_on`	`created_on`	`last_updated_on`

q query · string

Match query criteria, which includes all the filter string fields

sort query · string

Rule property to sort on.

Available values (4)

`created_on`	`created_on\|desc`	`last_updated_on`
`last_updated_on\|desc`

offset query · integer

Starting index of overall result set from which to return IDs

limit query · integer

Number of IDs to return

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.get_rules_combined_v2(filter="string",
                                        q="string",
                                        sort="string",
                                        offset=integer,
                                        limit=integer)
print(response)

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.combined_rules_get_v2(filter="string",
                                        q="string",
                                        sort="string",
                                        offset=integer,
                                        limit=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("combined_rules_get_v2",
                          filter="string",
                          q="string",
                          sort="string",
                          offset=integer,
                          limit=integer)
print(response)

Get-FalconCorrelationRule -Filter "string" `
  -Query "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/correlation_rules"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  q := "string"
  sort := "string"
  offset := int64(0)
  limit := int64(0)

  response, err := client.CorrelationRules.CombinedRulesGetV2(
    &correlation_rules.CombinedRulesGetV2Params{
      Filter: &filter,
      Q: &q,
      Sort: &sort,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.correlationRules.combinedRulesGetV2(
  "string",  // filter
  "string",  // q
  "string",  // sort
  integer,  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::correlation_rules_api::combined_rules_get_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = combined_rules_get_v2(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // q
        Some("string"),  // sort
        Some(integer),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CorrelationRules.new

response = api.combined_rules_get_v2(filter: 'string',
                                     q: 'string',
                                     sort: 'string',
                                     offset: integer,
                                     limit: integer)

puts response

Responses

[
  {
    "anomaly": {},
    "api_client_id": "string",
    "author": "string",
    "comment": "string",
    "created_on": "string",
    "customer_id": "string",
    "description": "string",
    "executor_rule_id": "string",
    "guardrail_notifications": [],
    "id": "string",
    "last_execution": {},
    "last_updated_on": "string",
    "mitre_attack": [],
    "name": "string",
    "next_execution_on": "string",
    "notifications": [],
    "operation": {},
    "rule_id": "string",
    "search": {},
    "severity": 0,
    "state": "string",
    "status": "string",
    "status_msg": "string",
    "tactic": "string",
    "technique": "string",
    "template_id": "string",
    "type": "string",
    "updated_by_api_client_id": "string",
    "updated_by_user_id": "string",
    "updated_by_user_uuid": "string",
    "user_id": "string",
    "user_uuid": "string",
    "version": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

entities.latest-rules.get.v1

Retrieve latest rule versions by rule IDs

Method GET

Route /correlation-rules/entities/latest-rules/v1

Scope Correlation Rules: READ

PEP 8 get_latest_rule_versions

Parameters

rule_ids query · string or list of strings

The rule IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_latest_rule_versions(rule_ids=id_list)
print(response)

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_latest_rules_get_v1(rule_ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_latest_rules_get_v1",
                          rule_ids=id_list)
print(response)

Get-FalconCorrelationRule -RuleId @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/correlation_rules"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CorrelationRules.EntitiesLatestRulesGetV1(
    &correlation_rules.EntitiesLatestRulesGetV1Params{
      RuleIds: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.correlationRules.entitiesLatestRulesGetV1(["ID1", "ID2", "ID3"]);  // ruleIds

console.log(response);

use rusty_falcon::apis::correlation_rules_api::entities_latest_rules_get_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = entities_latest_rules_get_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // rule_ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CorrelationRules.new

response = api.entities_latest_rules_get_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "anomaly": {},
    "api_client_id": "string",
    "author": "string",
    "comment": "string",
    "created_on": "string",
    "customer_id": "string",
    "description": "string",
    "executor_rule_id": "string",
    "guardrail_notifications": [],
    "id": "string",
    "last_execution": {},
    "last_updated_on": "string",
    "mitre_attack": [],
    "name": "string",
    "next_execution_on": "string",
    "notifications": [],
    "operation": {},
    "rule_id": "string",
    "search": {},
    "severity": 0,
    "state": "string",
    "status": "string",
    "status_msg": "string",
    "tactic": "string",
    "technique": "string",
    "template_id": "string",
    "type": "string",
    "updated_by_api_client_id": "string",
    "updated_by_user_id": "string",
    "updated_by_user_uuid": "string",
    "user_id": "string",
    "user_uuid": "string",
    "version": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

entities.rule-versions.delete.v1

Delete versions by IDs

Method DELETE

Route /correlation-rules/entities/rule-versions/v1

Scope Correlation Rules: WRITE

PEP 8 delete_rule_versions

Parameters

ids query · string or list of strings

The IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_rule_versions(ids=id_list)
print(response)

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_rule_versions_delete_v1(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_rule_versions_delete_v1",
                          ids=id_list)
print(response)

Remove-FalconCorrelationRule -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/correlation_rules"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CorrelationRules.EntitiesRuleVersionsDeleteV1(
    &correlation_rules.EntitiesRuleVersionsDeleteV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.correlationRules.entitiesRuleVersionsDeleteV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::correlation_rules_api::entities_rule_versions_delete_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = entities_rule_versions_delete_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CorrelationRules.new

response = api.entities_rule_versions_delete_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

entities.rule-versions_export.post.v1

Export rule versions

Method POST

Route /correlation-rules/entities/rule-versions/export/v1

Scope Correlation Rules: WRITE

PEP 8 export_rule

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

get_latest body · boolean

Flag indicating if the latest rule version should be exported.

report_format body · string

Format to use for rule export.

search body · object

Rule search to perform. Overrides filter and sort keywords.

filter body · string

Filter to use to filter rules.

sort body · string

Sort to use for rule export.

Code Examples

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

search = {
    "filter": "string",
    "sort": "string"
}

response = falcon.export_rule(filter="string",
                              get_latest=boolean,
                              report_format="string",
                              search=search,
                              sort="string")
print(response)

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

search = {
    "filter": "string",
    "sort": "string"
}

response = falcon.entities_rule_versions_export_post_v1(filter="string",
                                                        get_latest=boolean,
                                                        report_format="string",
                                                        search=search,
                                                        sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "get_latest": boolean,
    "report_format": "string",
    "search": {
        "filter": "string",
        "sort": "string"
    }
}

response = falcon.command("entities_rule_versions_export_post_v1", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/correlation_rules"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  get_latest := boolean
  report_format := "string"

  response, err := client.CorrelationRules.EntitiesRuleVersionsExportPostV1(
    &correlation_rules.EntitiesRuleVersionsExportPostV1Params{
      Body: &models.CorrelationrulesapiRuleVersionReportRequest{
        GetLatest: &get_latest,
        ReportFormat: &report_format,
        Search: &struct{}{},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.correlationRules.entitiesRuleVersionsExportPostV1(
  {
    getLatest: boolean,
    reportFormat: "string",
    search: {
      filter: "string",
      sort: "string"
    }
}  // body
);

console.log(response);

use rusty_falcon::apis::correlation_rules_api::entities_rule_versions_export_post_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApiRuleVersionReportRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ApiRuleVersionReportRequest {
        report_format: Some("string".to_string()),
        search: Default::default(),
        ..Default::default()
    };

    let response = entities_rule_versions_export_post_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CorrelationRules.new

body = Falcon::CorrelationrulesapiRuleVersionReportRequest.new(
  get_latest: boolean,
  report_format: 'string',
  search: {
    filter: 'string',
    sort: 'string'
  }
)

response = api.entities_rule_versions_export_post_v1(body)

puts response

Responses

[
  {
    "href": "string",
    "id": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "href": "string",
      "id": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "href": "string",
      "id": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "href": "string",
      "id": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "href": "string",
      "id": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "href": "string",
      "id": "string"
    }
  ]
}

entities.rule-versions_import.post.v1

Import rule versions

Method POST

Route /correlation-rules/entities/rule-versions/import/v1

Scope Correlation Rules: WRITE

PEP 8 import_rule

Parameters

rule body · dictionary

Rule to be imported.

Code Examples

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.import_rule(rule={})
print(response)

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.entities_rule_versions_import_post_v1(rule={})
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("entities_rule_versions_import_post_v1")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/correlation_rules"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CorrelationRules.EntitiesRuleVersionsImportPostV1(
    &correlation_rules.EntitiesRuleVersionsImportPostV1Params{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.correlationRules.entitiesRuleVersionsImportPostV1();

console.log(response);

use rusty_falcon::apis::correlation_rules_api::entities_rule_versions_import_post_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = entities_rule_versions_import_post_v1(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CorrelationRules.new

response = api.entities_rule_versions_import_post_v1

puts response

Responses

[
  {
    "anomaly": {},
    "api_client_id": "string",
    "author": "string",
    "comment": "string",
    "created_on": "string",
    "customer_id": "string",
    "description": "string",
    "executor_rule_id": "string",
    "guardrail_notifications": [],
    "id": "string",
    "last_execution": {},
    "last_updated_on": "string",
    "mitre_attack": [],
    "name": "string",
    "next_execution_on": "string",
    "notifications": [],
    "operation": {},
    "rule_id": "string",
    "search": {},
    "severity": 0,
    "state": "string",
    "status": "string",
    "status_msg": "string",
    "tactic": "string",
    "technique": "string",
    "template_id": "string",
    "type": "string",
    "updated_by_api_client_id": "string",
    "updated_by_user_id": "string",
    "updated_by_user_uuid": "string",
    "user_id": "string",
    "user_uuid": "string",
    "version": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

entities.rule-versions_publish.patch.v1

Publish existing rule version

Method PATCH

Route /correlation-rules/entities/rule-versions/publish/v1

Scope Correlation Rules: WRITE

PEP 8 publish_rule_version

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

id body · string

Correlation rule version ID to be published.

Code Examples

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.publish_rule_version(id="string")
print(response)

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.entities_rule_versions_publish_patch_v1(id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "id": "string"
}

response = falcon.command("entities_rule_versions_publish_patch_v1", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/correlation_rules"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  id := "string"

  response, err := client.CorrelationRules.EntitiesRuleVersionsPublishPatchV1(
    &correlation_rules.EntitiesRuleVersionsPublishPatchV1Params{
      Body: &models.CorrelationrulesapiRuleVersionPublishRequestV1{
        ID: &id,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.correlationRules.entitiesRuleVersionsPublishPatchV1(
  {
    id: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::correlation_rules_api::entities_rule_versions_publish_patch_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApiRuleVersionPublishRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ApiRuleVersionPublishRequestV1 {
        id: Some("string".to_string()),
        ..Default::default()
    };

    let response = entities_rule_versions_publish_patch_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CorrelationRules.new

body = Falcon::CorrelationrulesapiRuleVersionPublishRequestV1.new(
  id: 'string'
)

response = api.entities_rule_versions_publish_patch_v1(body)

puts response

Responses

[
  {
    "anomaly": {},
    "api_client_id": "string",
    "author": "string",
    "comment": "string",
    "created_on": "string",
    "customer_id": "string",
    "description": "string",
    "executor_rule_id": "string",
    "guardrail_notifications": [],
    "id": "string",
    "last_execution": {},
    "last_updated_on": "string",
    "mitre_attack": [],
    "name": "string",
    "next_execution_on": "string",
    "notifications": [],
    "operation": {},
    "rule_id": "string",
    "search": {},
    "severity": 0,
    "state": "string",
    "status": "string",
    "status_msg": "string",
    "tactic": "string",
    "technique": "string",
    "template_id": "string",
    "type": "string",
    "updated_by_api_client_id": "string",
    "updated_by_user_id": "string",
    "updated_by_user_uuid": "string",
    "user_id": "string",
    "user_uuid": "string",
    "version": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

entities.rules.delete.v1

Delete rules by IDs

Method DELETE

Route /correlation-rules/entities/rules/v1

Scope Correlation Rules: WRITE

PEP 8 delete_rules

Parameters

ids query · string or list of strings

The IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_rules(ids=id_list)
print(response)

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_rules_delete_v1(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_rules_delete_v1",
                          ids=id_list)
print(response)

Remove-FalconCorrelationRule -RuleId @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/correlation_rules"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CorrelationRules.EntitiesRulesDeleteV1(
    &correlation_rules.EntitiesRulesDeleteV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.correlationRules.entitiesRulesDeleteV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::correlation_rules_api::entities_rules_delete_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = entities_rules_delete_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CorrelationRules.new

response = api.entities_rules_delete_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

entities.rules.get.v1

Retrieve rules by IDs

Method GET

Route /correlation-rules/entities/rules/v1

Scope Correlation Rules: READ

PEP 8 get_rules

Parameters

ids query · string or list of strings

The IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rules(ids=id_list)
print(response)

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_rules_get_v1(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_rules_get_v1",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/correlation_rules"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CorrelationRules.EntitiesRulesGetV1(
    &correlation_rules.EntitiesRulesGetV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.correlationRules.entitiesRulesGetV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::correlation_rules_api::entities_rules_get_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = entities_rules_get_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CorrelationRules.new

response = api.entities_rules_get_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "anomaly": {},
    "api_client_id": "string",
    "author": "string",
    "comment": "string",
    "created_on": "string",
    "customer_id": "string",
    "description": "string",
    "executor_rule_id": "string",
    "guardrail_notifications": [],
    "id": "string",
    "last_execution": {},
    "last_updated_on": "string",
    "mitre_attack": [],
    "name": "string",
    "next_execution_on": "string",
    "notifications": [],
    "operation": {},
    "rule_id": "string",
    "search": {},
    "severity": 0,
    "state": "string",
    "status": "string",
    "status_msg": "string",
    "tactic": "string",
    "technique": "string",
    "template_id": "string",
    "type": "string",
    "updated_by_api_client_id": "string",
    "updated_by_user_id": "string",
    "updated_by_user_uuid": "string",
    "user_id": "string",
    "user_uuid": "string",
    "version": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

entities.rules.get.v2

Retrieve rule versions by IDs

Method GET

Route /correlation-rules/entities/rules/v2

Scope Correlation Rules: READ

PEP 8 get_rules_v2

Parameters

ids query · string or list of strings

The IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rules_v2(ids=id_list)
print(response)

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_rules_get_v2(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_rules_get_v2",
                          ids=id_list)
print(response)

Get-FalconCorrelationRule -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/correlation_rules"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CorrelationRules.EntitiesRulesGetV2(
    &correlation_rules.EntitiesRulesGetV2Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.correlationRules.entitiesRulesGetV2(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::correlation_rules_api::entities_rules_get_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = entities_rules_get_v2(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CorrelationRules.new

response = api.entities_rules_get_v2(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "anomaly": {},
    "api_client_id": "string",
    "author": "string",
    "comment": "string",
    "created_on": "string",
    "customer_id": "string",
    "description": "string",
    "executor_rule_id": "string",
    "guardrail_notifications": [],
    "id": "string",
    "last_execution": {},
    "last_updated_on": "string",
    "mitre_attack": [],
    "name": "string",
    "next_execution_on": "string",
    "notifications": [],
    "operation": {},
    "rule_id": "string",
    "search": {},
    "severity": 0,
    "state": "string",
    "status": "string",
    "status_msg": "string",
    "tactic": "string",
    "technique": "string",
    "template_id": "string",
    "type": "string",
    "updated_by_api_client_id": "string",
    "updated_by_user_id": "string",
    "updated_by_user_uuid": "string",
    "user_id": "string",
    "user_uuid": "string",
    "version": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

entities.rules.patch.v1

Update rules

Method PATCH

Route /correlation-rules/entities/rules/v1

Scope Correlation Rules: WRITE

PEP 8 update_rule

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

anomaly body · object

Anomaly detection configuration.

comment body · string

Correlation rule comment.

description body · string

Correlation rule description.

guardrail_notifications body · array

List of guardrail notifications.

id body · string

Correlation rule ID to be updated.

mitre_attack body · array

List of MITRE ATT&CK tactic and technique mappings.

name body · string

Correlation rule name.

notifications body · array

List of notifications to implement.

operation body · object

Operation to perform.

search body · object

Search to perform.

severity body · integer

Correlation severity.

state body · string

status body · string

Correlation rule status.

tactic body · string

Identified tactic.

technique body · string

Identified technique.

customer_id body · string

CID for the tenant.

template_id body · string

Template identifier to base the rule on.

trigger_on_create body · boolean

Flag indicating if the rule triggers on creation.

Code Examples

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

anomaly = {
    "event_field_name": "string",
    "lookback_timeframe": "string",
    "scope": "string",
    "type": "string",
    "use_established_entity_only": "boolean"
}

guardrail_notifications = [
    {
        "config": {
            "cid": "string",
            "config_id": "string",
            "plugin_id": "string",
            "recipients": [
                "string"
            ],
            "severity": "string"
        },
        "options": {
            "additionalProp1": "string",
            "additionalProp2": "string",
            "additionalProp3": "string"
        },
        "type": "string"
    }
]

mitre_attack = [
    {
        "tactic_id": "string",
        "technique_id": "string"
    }
]

notifications = [
    {
        "config": {
            "cid": "string",
            "config_id": "string",
            "plugin_id": "string",
            "recipients": [
                "string"
            ],
            "severity": "string"
        },
        "options": {
            "additionalProp1": "string",
            "additionalProp2": "string",
            "additionalProp3": "string"
        },
        "type": "string"
    }
]

operation = {
    "schedule": {
        "definition": "string"
    },
    "start_on": "2026-04-17T16:10:23.160Z",
    "stop_on": "2026-04-17T16:10:23.160Z",
    "suppression": {
        "filter": {
            "field_based": {
                "field": "string"
            }
        },
        "suppression_period": "string"
    }
}

search = {
    "case_template_id": "string",
    "execution_mode": "string",
    "filter": "string",
    "lookback": "string",
    "outcome": "string",
    "trigger_mode": "string",
    "use_ingest_time": "boolean"
}

response = falcon.update_rule(anomaly=anomaly,
                              comment="string",
                              customer_id="string",
                              description="string",
                              guardrail_notifications=guardrail_notifications,
                              id="string",
                              mitre_attack=mitre_attack,
                              name="string",
                              notifications=notifications,
                              operation=operation,
                              search=search,
                              severity=integer,
                              status="string",
                              tactic="string",
                              technique="string",
                              template_id="string",
                              trigger_on_create=boolean)
print(response)

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

anomaly = {
    "event_field_name": "string",
    "lookback_timeframe": "string",
    "scope": "string",
    "type": "string",
    "use_established_entity_only": "boolean"
}

guardrail_notifications = [
    {
        "config": {
            "cid": "string",
            "config_id": "string",
            "plugin_id": "string",
            "recipients": [
                "string"
            ],
            "severity": "string"
        },
        "options": {
            "additionalProp1": "string",
            "additionalProp2": "string",
            "additionalProp3": "string"
        },
        "type": "string"
    }
]

mitre_attack = [
    {
        "tactic_id": "string",
        "technique_id": "string"
    }
]

notifications = [
    {
        "config": {
            "cid": "string",
            "config_id": "string",
            "plugin_id": "string",
            "recipients": [
                "string"
            ],
            "severity": "string"
        },
        "options": {
            "additionalProp1": "string",
            "additionalProp2": "string",
            "additionalProp3": "string"
        },
        "type": "string"
    }
]

operation = {
    "schedule": {
        "definition": "string"
    },
    "start_on": "2026-04-17T16:10:23.160Z",
    "stop_on": "2026-04-17T16:10:23.160Z",
    "suppression": {
        "filter": {
            "field_based": {
                "field": "string"
            }
        },
        "suppression_period": "string"
    }
}

search = {
    "case_template_id": "string",
    "execution_mode": "string",
    "filter": "string",
    "lookback": "string",
    "outcome": "string",
    "trigger_mode": "string",
    "use_ingest_time": "boolean"
}

response = falcon.entities_rules_patch_v1(anomaly=anomaly,
                                          comment="string",
                                          customer_id="string",
                                          description="string",
                                          guardrail_notifications=guardrail_notifications,
                                          id="string",
                                          mitre_attack=mitre_attack,
                                          name="string",
                                          notifications=notifications,
                                          operation=operation,
                                          search=search,
                                          severity=integer,
                                          status="string",
                                          tactic="string",
                                          technique="string",
                                          template_id="string",
                                          trigger_on_create=boolean)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = [
    {
        "anomaly": {
            "event_field_names": ["string"],
            "lookback_timeframe": "string",
            "scopes": ["string"],
            "type": "string",
            "use_established_entity_only": boolean
        },
        "comment": "string",
        "description": "string",
        "guardrail_notifications": [
            {
                "config": {},
                "options": {},
                "type": "string"
            }
        ],
        "id": "string",
        "mitre_attack": [
            {
                "tactic_id": "string",
                "technique_id": "string"
            }
        ],
        "name": "string",
        "notifications": [
            {
                "config": {},
                "options": {},
                "type": "string"
            }
        ],
        "operation": {
            "schedule": {},
            "start_on": "string",
            "stop_on": "string",
            "suppression": {}
        },
        "search": {
            "case_template_id": "string",
            "filter": "string",
            "lookback": "string",
            "outcome": "string",
            "trigger_mode": "string",
            "use_ingest_time": boolean
        },
        "severity": integer,
        "state": "string",
        "status": "string",
        "tactic": "string",
        "technique": "string"
    }
]

response = falcon.command("entities_rules_patch_v1", body=body_payload)
print(response)

Edit-FalconCorrelationRule -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/correlation_rules"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  description := "string"
  typeVar := "string"
  id := "string"
  tactic_id := "string"
  technique_id := "string"
  name := "string"
  severity := integer
  state := "string"
  status := "string"
  tactic := "string"
  technique := "string"

  response, err := client.CorrelationRules.EntitiesRulesPatchV1(
    &correlation_rules.EntitiesRulesPatchV1Params{
      Body: []*models.CorrelationrulesapiRulePatchRequestV1{
        {
          Anomaly: &struct{}{},
          Comment: &comment,
          Description: &description,
          GuardrailNotifications: []interface{}{
            {
            Config: &struct{}{},
            Options: &struct{}{},
            Type: &typeVar,
            },
          },
          ID: &id,
          MitreAttack: []interface{}{
            {
            TacticID: &tactic_id,
            TechniqueID: &technique_id,
            },
          },
          Name: &name,
          Notifications: []interface{}{
            {
            Config: &struct{}{},
            Options: &struct{}{},
            Type: &typeVar,
            },
          },
          Operation: &struct{}{},
          Search: &struct{}{},
          Severity: &severity,
          State: &state,
          Status: &status,
          Tactic: &tactic,
          Technique: &technique,
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.correlationRules.entitiesRulesPatchV1(
  [{
    anomaly: {
      eventFieldNames: [],
      lookbackTimeframe: "string",
      scopes: [{
          customFieldName: "string",
          role: "string",
          scope: "string"
        }],
      type: "string",
      useEstablishedEntityOnly: boolean
    },
    comment: "string",
    description: "string",
    guardrailNotifications: [{
        config: {
          channelId: "string",
          cid: "string",
          configId: "string",
          pluginId: "string",
          recipients: [],
          severity: "string",
          teamId: "string"
        },
        options: {},
        type: "string"
      }],
    id: "string",
    mitreAttack: [{
        tacticId: "string",
        techniqueId: "string"
      }],
    name: "string",
    notifications: [{
        config: {
          channelId: "string",
          cid: "string",
          configId: "string",
          pluginId: "string",
          recipients: [],
          severity: "string",
          teamId: "string"
        },
        options: {},
        type: "string"
      }],
    operation: {
      schedule: {
        definition: "string"
      },
      startOn: "string",
      stopOn: "string",
      suppression: {
        filter: {},
        suppressionPeriod: "string"
      }
    },
    search: {
      caseTemplateId: "string",
      filter: "string",
      lookback: "string",
      outcome: "string",
      triggerMode: "string",
      useIngestTime: boolean
    },
    severity: integer,
    state: "string",
    status: "string",
    tactic: "string",
    technique: "string"
}]  // body
);

console.log(response);

use rusty_falcon::apis::correlation_rules_api::entities_rules_patch_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApiRulePatchRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = vec![ApiRulePatchRequestV1 {
            id: Some("string".to_string()),
            ..Default::default()
        }];

    let response = entities_rules_patch_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CorrelationRules.new

body = [Falcon::CorrelationrulesapiRulePatchRequestV1.new(
  anomaly: {
    event_field_names: [],
    lookback_timeframe: 'string',
    scopes: [{
        custom_field_name: 'string',
        role: 'string',
        scope: 'string'
      }],
    type: 'string',
    use_established_entity_only: boolean
  },
  comment: 'string',
  description: 'string',
  guardrail_notifications: [{
      config: {
        channel_id: 'string',
        cid: 'string',
        config_id: 'string',
        plugin_id: 'string',
        recipients: [],
        severity: 'string',
        team_id: 'string'
      },
      options: {},
      type: 'string'
    }],
  id: 'string',
  mitre_attack: [{
      tactic_id: 'string',
      technique_id: 'string'
    }],
  name: 'string',
  notifications: [{
      config: {
        channel_id: 'string',
        cid: 'string',
        config_id: 'string',
        plugin_id: 'string',
        recipients: [],
        severity: 'string',
        team_id: 'string'
      },
      options: {},
      type: 'string'
    }],
  operation: {
    schedule: {
      definition: 'string'
    },
    start_on: 'string',
    stop_on: 'string',
    suppression: {
      filter: {},
      suppression_period: 'string'
    }
  },
  search: {
    case_template_id: 'string',
    filter: 'string',
    lookback: 'string',
    outcome: 'string',
    trigger_mode: 'string',
    use_ingest_time: boolean
  },
  severity: integer,
  state: 'string',
  status: 'string',
  tactic: 'string',
  technique: 'string'
)]

response = api.entities_rules_patch_v1(body)

puts response

Responses

[
  {
    "anomaly": {},
    "api_client_id": "string",
    "author": "string",
    "comment": "string",
    "created_on": "string",
    "customer_id": "string",
    "description": "string",
    "executor_rule_id": "string",
    "guardrail_notifications": [],
    "id": "string",
    "last_execution": {},
    "last_updated_on": "string",
    "mitre_attack": [],
    "name": "string",
    "next_execution_on": "string",
    "notifications": [],
    "operation": {},
    "rule_id": "string",
    "search": {},
    "severity": 0,
    "state": "string",
    "status": "string",
    "status_msg": "string",
    "tactic": "string",
    "technique": "string",
    "template_id": "string",
    "type": "string",
    "updated_by_api_client_id": "string",
    "updated_by_user_id": "string",
    "updated_by_user_uuid": "string",
    "user_id": "string",
    "user_uuid": "string",
    "version": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

entities.rules.post.v1

Create rule

Method POST

Route /correlation-rules/entities/rules/v1

Scope Correlation Rules: WRITE

PEP 8 create_rule

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

anomaly body · object

Anomaly detection configuration.

comment body · string

Correlation rule comment.

customer_id body · string

CID for the tenant.

description body · string

Correlation rule description.

guardrail_notifications body · array

List of guardrail notifications.

mitre_attack body · array

List of MITRE ATT&CK tactic and technique mappings.

name body · string

Correlation rule name.

notifications body · array

List of notifications to implement.

operation body · object

Operation to perform.

search body · object

Search to perform.

severity body · integer

Correlation severity.

status body · string

Correlation rule status.

tactic body · string

Identified tactic.

technique body · string

Identified technique.

template_id body · string

Template identifier to base the rule on.

trigger_on_create body · boolean

Flag indicating if the rule triggers on creation.

Code Examples

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

anomaly = {
    "event_field_name": "string",
    "lookback_timeframe": "string",
    "scope": "string",
    "type": "string",
    "use_established_entity_only": "boolean"
}

guardrail_notifications = [
    {
        "config": {
            "cid": "string",
            "config_id": "string",
            "plugin_id": "string",
            "recipients": [
                "string"
            ],
            "severity": "string"
        },
        "options": {
            "additionalProp1": "string",
            "additionalProp2": "string",
            "additionalProp3": "string"
        },
        "type": "string"
    }
]

mitre_attack = [
    {
        "tactic_id": "string",
        "technique_id": "string"
    }
]

notifications = [
    {
        "config": {
            "cid": "string",
            "config_id": "string",
            "plugin_id": "string",
            "recipients": [
                "string"
            ],
            "severity": "string"
        },
        "options": {
            "additionalProp1": "string",
            "additionalProp2": "string",
            "additionalProp3": "string"
        },
        "type": "string"
    }
]

operation = {
    "schedule": {
        "definition": "string"
    },
    "start_on": "2026-04-17T16:10:23.160Z",
    "stop_on": "2026-04-17T16:10:23.160Z",
    "suppression": {
        "filter": {
            "field_based": {
                "field": "string"
            }
        },
        "suppression_period": "string"
    }
}

search = {
    "case_template_id": "string",
    "execution_mode": "string",
    "filter": "string",
    "lookback": "string",
    "outcome": "string",
    "trigger_mode": "string",
    "use_ingest_time": "boolean"
}

response = falcon.create_rule(anomaly=anomaly,
                              comment="string",
                              customer_id="string",
                              description="string",
                              guardrail_notifications=guardrail_notifications,
                              mitre_attack=mitre_attack,
                              name="string",
                              notifications=notifications,
                              operation=operation,
                              search=search,
                              severity=integer,
                              status="string",
                              tactic="string",
                              technique="string",
                              template_id="string",
                              trigger_on_create=boolean)
print(response)

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

anomaly = {
    "event_field_name": "string",
    "lookback_timeframe": "string",
    "scope": "string",
    "type": "string",
    "use_established_entity_only": "boolean"
}

guardrail_notifications = [
    {
        "config": {
            "cid": "string",
            "config_id": "string",
            "plugin_id": "string",
            "recipients": [
                "string"
            ],
            "severity": "string"
        },
        "options": {
            "additionalProp1": "string",
            "additionalProp2": "string",
            "additionalProp3": "string"
        },
        "type": "string"
    }
]

mitre_attack = [
    {
        "tactic_id": "string",
        "technique_id": "string"
    }
]

notifications = [
    {
        "config": {
            "cid": "string",
            "config_id": "string",
            "plugin_id": "string",
            "recipients": [
                "string"
            ],
            "severity": "string"
        },
        "options": {
            "additionalProp1": "string",
            "additionalProp2": "string",
            "additionalProp3": "string"
        },
        "type": "string"
    }
]

operation = {
    "schedule": {
        "definition": "string"
    },
    "start_on": "2026-04-17T16:10:23.160Z",
    "stop_on": "2026-04-17T16:10:23.160Z",
    "suppression": {
        "filter": {
            "field_based": {
                "field": "string"
            }
        },
        "suppression_period": "string"
    }
}

search = {
    "case_template_id": "string",
    "execution_mode": "string",
    "filter": "string",
    "lookback": "string",
    "outcome": "string",
    "trigger_mode": "string",
    "use_ingest_time": "boolean"
}

response = falcon.entities_rules_post_v1(anomaly=anomaly,
                                         comment="string",
                                         customer_id="string",
                                         description="string",
                                         guardrail_notifications=guardrail_notifications,
                                         mitre_attack=mitre_attack,
                                         name="string",
                                         notifications=notifications,
                                         operation=operation,
                                         search=search,
                                         severity=integer,
                                         status="string",
                                         tactic="string",
                                         technique="string",
                                         template_id="string",
                                         trigger_on_create=boolean)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "anomaly": {
        "event_field_names": ["string"],
        "lookback_timeframe": "string",
        "scopes": [
            {
                "custom_field_name": "string",
                "role": "string",
                "scope": "string"
            }
        ],
        "type": "string",
        "use_established_entity_only": boolean
    },
    "comment": "string",
    "customer_id": "string",
    "description": "string",
    "guardrail_notifications": [
        {
            "config": {
                "channel_id": "string",
                "cid": "string",
                "config_id": "string",
                "plugin_id": "string",
                "recipients": ["string"],
                "severity": "string",
                "team_id": "string"
            },
            "options": {},
            "type": "string"
        }
    ],
    "mitre_attack": [
        {
            "tactic_id": "string",
            "technique_id": "string"
        }
    ],
    "name": "string",
    "notifications": [
        {
            "config": {
                "channel_id": "string",
                "cid": "string",
                "config_id": "string",
                "plugin_id": "string",
                "recipients": ["string"],
                "severity": "string",
                "team_id": "string"
            },
            "options": {},
            "type": "string"
        }
    ],
    "operation": {
        "schedule": {
            "definition": "string"
        },
        "start_on": "string",
        "stop_on": "string",
        "suppression": {
            "filter": {},
            "suppression_period": "string"
        }
    },
    "search": {
        "case_template_id": "string",
        "execution_mode": "string",
        "filter": "string",
        "lookback": "string",
        "outcome": "string",
        "trigger_mode": "string",
        "use_ingest_time": boolean
    },
    "severity": integer,
    "status": "string",
    "tactic": "string",
    "technique": "string",
    "template_id": "string",
    "trigger_on_create": boolean
}

response = falcon.command("entities_rules_post_v1", body=body_payload)
print(response)

New-FalconCorrelationRule -Name "string" `
  -Severity integer `
  -Search @{} `
  -Operation @{} `
  -Status "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/correlation_rules"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  customer_id := "string"
  description := "string"
  typeVar := "string"
  tactic_id := "string"
  technique_id := "string"
  name := "string"
  severity := integer
  status := "string"
  tactic := "string"
  technique := "string"
  template_id := "string"
  trigger_on_create := boolean

  response, err := client.CorrelationRules.EntitiesRulesPostV1(
    &correlation_rules.EntitiesRulesPostV1Params{
      Body: &models.CorrelationrulesapiRuleCreateRequestV1{
        Anomaly: &struct{}{},
        Comment: &comment,
        CustomerID: &customer_id,
        Description: &description,
        GuardrailNotifications: []interface{}{
          {
          Config: &struct{}{},
          Options: &struct{}{},
          Type: &typeVar,
          },
        },
        MitreAttack: []interface{}{
          {
          TacticID: &tactic_id,
          TechniqueID: &technique_id,
          },
        },
        Name: &name,
        Notifications: []interface{}{
          {
          Config: &struct{}{},
          Options: &struct{}{},
          Type: &typeVar,
          },
        },
        Operation: &struct{}{},
        Search: &struct{}{},
        Severity: &severity,
        Status: &status,
        Tactic: &tactic,
        Technique: &technique,
        TemplateID: &template_id,
        TriggerOnCreate: &trigger_on_create,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.correlationRules.entitiesRulesPostV1(
  {
    anomaly: {
      eventFieldNames: [],
      lookbackTimeframe: "string",
      scopes: [{
          customFieldName: "string",
          role: "string",
          scope: "string"
        }],
      type: "string",
      useEstablishedEntityOnly: boolean
    },
    comment: "string",
    customerId: "string",
    description: "string",
    guardrailNotifications: [{
        config: {
          channelId: "string",
          cid: "string",
          configId: "string",
          pluginId: "string",
          recipients: [],
          severity: "string",
          teamId: "string"
        },
        options: {},
        type: "string"
      }],
    mitreAttack: [{
        tacticId: "string",
        techniqueId: "string"
      }],
    name: "string",
    notifications: [{
        config: {
          channelId: "string",
          cid: "string",
          configId: "string",
          pluginId: "string",
          recipients: [],
          severity: "string",
          teamId: "string"
        },
        options: {},
        type: "string"
      }],
    operation: {
      schedule: {
        definition: "string"
      },
      startOn: "string",
      stopOn: "string",
      suppression: {
        filter: {},
        suppressionPeriod: "string"
      }
    },
    search: {
      caseTemplateId: "string",
      executionMode: "string",
      filter: "string",
      lookback: "string",
      outcome: "string",
      triggerMode: "string",
      useIngestTime: boolean
    },
    severity: integer,
    status: "string",
    tactic: "string",
    technique: "string",
    templateId: "string",
    triggerOnCreate: boolean
}  // body
);

console.log(response);

use rusty_falcon::apis::correlation_rules_api::entities_rules_post_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApiRuleCreateRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ApiRuleCreateRequestV1 {
        customer_id: Some("string".to_string()),
        name: Some("string".to_string()),
        operation: Default::default(),
        search: Default::default(),
        severity: Some(integer),
        status: Some("string".to_string()),
        template_id: Some("string".to_string()),
        ..Default::default()
    };

    let response = entities_rules_post_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CorrelationRules.new

body = Falcon::CorrelationrulesapiRuleCreateRequestV1.new(
  anomaly: {
    event_field_names: [],
    lookback_timeframe: 'string',
    scopes: [{
        custom_field_name: 'string',
        role: 'string',
        scope: 'string'
      }],
    type: 'string',
    use_established_entity_only: boolean
  },
  comment: 'string',
  customer_id: 'string',
  description: 'string',
  guardrail_notifications: [{
      config: {
        channel_id: 'string',
        cid: 'string',
        config_id: 'string',
        plugin_id: 'string',
        recipients: [],
        severity: 'string',
        team_id: 'string'
      },
      options: {},
      type: 'string'
    }],
  mitre_attack: [{
      tactic_id: 'string',
      technique_id: 'string'
    }],
  name: 'string',
  notifications: [{
      config: {
        channel_id: 'string',
        cid: 'string',
        config_id: 'string',
        plugin_id: 'string',
        recipients: [],
        severity: 'string',
        team_id: 'string'
      },
      options: {},
      type: 'string'
    }],
  operation: {
    schedule: {
      definition: 'string'
    },
    start_on: 'string',
    stop_on: 'string',
    suppression: {
      filter: {},
      suppression_period: 'string'
    }
  },
  search: {
    case_template_id: 'string',
    execution_mode: 'string',
    filter: 'string',
    lookback: 'string',
    outcome: 'string',
    trigger_mode: 'string',
    use_ingest_time: boolean
  },
  severity: integer,
  status: 'string',
  tactic: 'string',
  technique: 'string',
  template_id: 'string',
  trigger_on_create: boolean
)

response = api.entities_rules_post_v1(body)

puts response

Responses

[
  {
    "anomaly": {},
    "api_client_id": "string",
    "author": "string",
    "comment": "string",
    "created_on": "string",
    "customer_id": "string",
    "description": "string",
    "executor_rule_id": "string",
    "guardrail_notifications": [],
    "id": "string",
    "last_execution": {},
    "last_updated_on": "string",
    "mitre_attack": [],
    "name": "string",
    "next_execution_on": "string",
    "notifications": [],
    "operation": {},
    "rule_id": "string",
    "search": {},
    "severity": 0,
    "state": "string",
    "status": "string",
    "status_msg": "string",
    "tactic": "string",
    "technique": "string",
    "template_id": "string",
    "type": "string",
    "updated_by_api_client_id": "string",
    "updated_by_user_id": "string",
    "updated_by_user_uuid": "string",
    "user_id": "string",
    "user_uuid": "string",
    "version": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

entities.templates.get.v1Mixin0

Retrieve rule templates by IDs

Method GET

Route /correlation-rules/entities/templates/v1

Scope Correlation Rules: READ

PEP 8 get_rule_templates_by_id

Parameters

ids query · string or list of strings

The IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rule_templates_by_id(ids=id_list)
print(response)

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_templates_get_v1Mixin0(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_templates_get_v1Mixin0",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/correlation_rules"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CorrelationRules.EntitiesTemplatesGetV1Mixin0(
    &correlation_rules.EntitiesTemplatesGetV1Mixin0Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.correlationRules.entitiesTemplatesGetV1Mixin0(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CorrelationRules.new

response = api.entities_templates_get_v1_mixin0(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "author": "string",
    "created_on": "string",
    "description": "string",
    "id": "string",
    "last_updated_on": "string",
    "license_details": {},
    "mitre_attack": [],
    "name": "string",
    "operation": {},
    "search": {},
    "severity": 0,
    "type": "string",
    "vendors": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "author": "string",
      "created_on": "string",
      "description": "string",
      "id": "string",
      "last_updated_on": "string",
      "license_details": {},
      "mitre_attack": [],
      "name": "string",
      "operation": {},
      "search": {},
      "severity": 0,
      "type": "string",
      "vendors": []
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "author": "string",
      "created_on": "string",
      "description": "string",
      "id": "string",
      "last_updated_on": "string",
      "license_details": {},
      "mitre_attack": [],
      "name": "string",
      "operation": {},
      "search": {},
      "severity": 0,
      "type": "string",
      "vendors": []
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "author": "string",
      "created_on": "string",
      "description": "string",
      "id": "string",
      "last_updated_on": "string",
      "license_details": {},
      "mitre_attack": [],
      "name": "string",
      "operation": {},
      "search": {},
      "severity": 0,
      "type": "string",
      "vendors": []
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "author": "string",
      "created_on": "string",
      "description": "string",
      "id": "string",
      "last_updated_on": "string",
      "license_details": {},
      "mitre_attack": [],
      "name": "string",
      "operation": {},
      "search": {},
      "severity": 0,
      "type": "string",
      "vendors": []
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "author": "string",
      "created_on": "string",
      "description": "string",
      "id": "string",
      "last_updated_on": "string",
      "license_details": {},
      "mitre_attack": [],
      "name": "string",
      "operation": {},
      "search": {},
      "severity": 0,
      "type": "string",
      "vendors": []
    }
  ]
}

entities.templates_rules.post.v1

Create rule from template

Method POST

Route /correlation-rules/entities/templates/rules/v1

Scope Correlation Rules: WRITE

PEP 8 create_rule_from_template

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

customer_id body · string

Customer ID for the rule template.

templates body · array

List of rule template definitions to create rules from.

Code Examples

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

templates = [
    {
        "comment": "string",
        "description": "string",
        "guardrail_notifications": [
            {
                "config": {
                    "cid": "string",
                    "config_id": "string",
                    "plugin_id": "string",
                    "recipients": [
                        "string"
                    ],
                    "severity": "string"
                },
                "options": {
                    "additionalProp1": "string",
                    "additionalProp2": "string",
                    "additionalProp3": "string"
                },
                "type": "string"
            }
        ],
        "mitre_attack": [
            {
                "tactic_id": "string",
                "technique_id": "string"
            }
        ],
        "name": "string",
        "notifications": [
            {
                "config": {
                    "cid": "string",
                    "config_id": "string",
                    "plugin_id": "string",
                    "recipients": [
                        "string"
                    ],
                    "severity": "string"
                },
                "options": {
                    "additionalProp1": "string",
                    "additionalProp2": "string",
                    "additionalProp3": "string"
                },
                "type": "string"
            }
        ],
        "operation": {
            "schedule": {
                "definition": "string"
            },
            "start_on": "2026-02-04T21:13:29.753Z",
            "stop_on": "2026-02-04T21:13:29.753Z",
            "suppression": {
                "filter": {
                    "field_based": {
                        "field": "string"
                    }
                },
                "suppression_period": "string"
            }
        },
        "search": {
            "case_template_id": "string",
            "execution_mode": "string",
            "filter": "string",
            "lookback": "string",
            "outcome": "string",
            "trigger_mode": "string",
            "use_ingest_time": True
        },
        "severity": 0,
        "status": "string",
        "template_id": "string",
        "trigger_on_create": True
    }
]

response = falcon.create_rule_from_template(customer_id="string",
                                            templates=templates)
print(response)

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

templates = [
    {
        "comment": "string",
        "description": "string",
        "guardrail_notifications": [
            {
                "config": {
                    "cid": "string",
                    "config_id": "string",
                    "plugin_id": "string",
                    "recipients": [
                        "string"
                    ],
                    "severity": "string"
                },
                "options": {
                    "additionalProp1": "string",
                    "additionalProp2": "string",
                    "additionalProp3": "string"
                },
                "type": "string"
            }
        ],
        "mitre_attack": [
            {
                "tactic_id": "string",
                "technique_id": "string"
            }
        ],
        "name": "string",
        "notifications": [
            {
                "config": {
                    "cid": "string",
                    "config_id": "string",
                    "plugin_id": "string",
                    "recipients": [
                        "string"
                    ],
                    "severity": "string"
                },
                "options": {
                    "additionalProp1": "string",
                    "additionalProp2": "string",
                    "additionalProp3": "string"
                },
                "type": "string"
            }
        ],
        "operation": {
            "schedule": {
                "definition": "string"
            },
            "start_on": "2026-02-04T21:13:29.753Z",
            "stop_on": "2026-02-04T21:13:29.753Z",
            "suppression": {
                "filter": {
                    "field_based": {
                        "field": "string"
                    }
                },
                "suppression_period": "string"
            }
        },
        "search": {
            "case_template_id": "string",
            "execution_mode": "string",
            "filter": "string",
            "lookback": "string",
            "outcome": "string",
            "trigger_mode": "string",
            "use_ingest_time": True
        },
        "severity": 0,
        "status": "string",
        "template_id": "string",
        "trigger_on_create": True
    }
]

response = falcon.entities_templates_rules_post_v1(customer_id="string",
                                                   templates=templates)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = [
    {
        "customer_id": "string",
        "templates": [
            {
                "comment": "string",
                "description": "string",
                "guardrail_notifications": ["string"],
                "mitre_attack": ["string"],
                "name": "string",
                "notifications": ["string"],
                "operation": {},
                "search": {},
                "severity": integer,
                "status": "string",
                "template_id": "string",
                "trigger_on_create": boolean
            }
        ]
    }
]

response = falcon.command("entities_templates_rules_post_v1", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/correlation_rules"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  customer_id := "string"
  comment := "string"
  description := "string"
  typeVar := "string"
  tactic_id := "string"
  technique_id := "string"
  name := "string"
  severity := integer
  status := "string"
  template_id := "string"
  trigger_on_create := boolean

  response, err := client.CorrelationRules.EntitiesTemplatesRulesPostV1(
    &correlation_rules.EntitiesTemplatesRulesPostV1Params{
      Body: []*models.CorrelationrulesapiDeployTemplateRequestV1{
        {
          CustomerID: &customer_id,
          Templates: []interface{}{
            {
            Comment: &comment,
            Description: &description,
            GuardrailNotifications: []interface{}{
              {
              Config: &struct{}{},
              Options: &struct{}{},
              Type: &typeVar,
              },
            },
            MitreAttack: []interface{}{
              {
              TacticID: &tactic_id,
              TechniqueID: &technique_id,
              },
            },
            Name: &name,
            Notifications: []interface{}{
              {
              Config: &struct{}{},
              Options: &struct{}{},
              Type: &typeVar,
              },
            },
            Operation: &struct{}{},
            Search: &struct{}{},
            Severity: &severity,
            Status: &status,
            TemplateID: &template_id,
            TriggerOnCreate: &trigger_on_create,
            },
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.correlationRules.entitiesTemplatesRulesPostV1(
  [{
    customerId: "string",
    templates: [{
        comment: "string",
        description: "string",
        guardrailNotifications: [{
            config: {},
            options: {},
            type: "string"
          }],
        mitreAttack: [{
            tacticId: "string",
            techniqueId: "string"
          }],
        name: "string",
        notifications: [{
            config: {},
            options: {},
            type: "string"
          }],
        operation: {
          schedule: {},
          startOn: "string",
          stopOn: "string",
          suppression: {}
        },
        search: {
          caseTemplateId: "string",
          executionMode: "string",
          filter: "string",
          lookback: "string",
          outcome: "string",
          triggerMode: "string",
          useIngestTime: boolean
        },
        severity: integer,
        status: "string",
        templateId: "string",
        triggerOnCreate: boolean
      }]
}]  // body
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CorrelationRules.new

body = [Falcon::CorrelationrulesapiDeployTemplateRequestV1.new(
  customer_id: 'string',
  templates: [{
      comment: 'string',
      description: 'string',
      guardrail_notifications: [{
          config: {},
          options: {},
          type: 'string'
        }],
      mitre_attack: [{
          tactic_id: 'string',
          technique_id: 'string'
        }],
      name: 'string',
      notifications: [{
          config: {},
          options: {},
          type: 'string'
        }],
      operation: {
        schedule: {},
        start_on: 'string',
        stop_on: 'string',
        suppression: {}
      },
      search: {
        case_template_id: 'string',
        execution_mode: 'string',
        filter: 'string',
        lookback: 'string',
        outcome: 'string',
        trigger_mode: 'string',
        use_ingest_time: boolean
      },
      severity: integer,
      status: 'string',
      template_id: 'string',
      trigger_on_create: boolean
    }]
)]

response = api.entities_templates_rules_post_v1(body)

puts response

Responses

[
  {
    "anomaly": {},
    "api_client_id": "string",
    "author": "string",
    "comment": "string",
    "created_on": "string",
    "customer_id": "string",
    "description": "string",
    "executor_rule_id": "string",
    "guardrail_notifications": [],
    "id": "string",
    "last_execution": {},
    "last_updated_on": "string",
    "mitre_attack": [],
    "name": "string",
    "next_execution_on": "string",
    "notifications": [],
    "operation": {},
    "rule_id": "string",
    "search": {},
    "severity": 0,
    "state": "string",
    "status": "string",
    "status_msg": "string",
    "tactic": "string",
    "technique": "string",
    "template_id": "string",
    "type": "string",
    "updated_by_api_client_id": "string",
    "updated_by_user_id": "string",
    "updated_by_user_uuid": "string",
    "user_id": "string",
    "user_uuid": "string",
    "version": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "anomaly": {},
      "api_client_id": "string",
      "author": "string",
      "comment": "string",
      "created_on": "string",
      "customer_id": "string",
      "description": "string",
      "executor_rule_id": "string",
      "guardrail_notifications": [],
      "id": "string",
      "last_execution": {},
      "last_updated_on": "string",
      "mitre_attack": [],
      "name": "string",
      "next_execution_on": "string",
      "notifications": [],
      "operation": {},
      "rule_id": "string",
      "search": {},
      "severity": 0,
      "state": "string",
      "status": "string",
      "status_msg": "string",
      "tactic": "string",
      "technique": "string",
      "template_id": "string",
      "type": "string",
      "updated_by_api_client_id": "string",
      "updated_by_user_id": "string",
      "updated_by_user_uuid": "string",
      "user_id": "string",
      "user_uuid": "string",
      "version": 0
    }
  ]
}

queries.rules.get.v1

Find all rule IDs matching the query and filter.

Method GET

Route /correlation-rules/queries/rules/v1

Scope Correlation Rules: READ

PEP 8 query_rules

Parameters

filter query · string

FQL query specifying the filter parameters

Available values (9)

`customer_id`	`user_id`	`user_uuid`
`status`	`name`	`created_on`
`last_updated_on`	`created_on`	`last_updated_on`

q query · string

Match query criteria, which includes all the filter string fields

sort query · string

Rule property to sort on.

Available values (4)

`created_on`	`created_on\|desc`	`last_updated_on`
`last_updated_on\|desc`

offset query · integer

Starting index of overall result set from which to return IDs

limit query · integer

Number of IDs to return

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.query_rules(filter="string",
                              q="string",
                              sort="string",
                              offset=integer,
                              limit=integer)
print(response)

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.queries_rules_get_v1(filter="string",
                                       q="string",
                                       sort="string",
                                       offset=integer,
                                       limit=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_rules_get_v1",
                          filter="string",
                          q="string",
                          sort="string",
                          offset=integer,
                          limit=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/correlation_rules"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  q := "string"
  sort := "string"
  offset := int64(0)
  limit := int64(0)

  response, err := client.CorrelationRules.QueriesRulesGetV1(
    &correlation_rules.QueriesRulesGetV1Params{
      Filter: &filter,
      Q: &q,
      Sort: &sort,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.correlationRules.queriesRulesGetV1(
  "string",  // filter
  "string",  // q
  "string",  // sort
  integer,  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::correlation_rules_api::queries_rules_get_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = queries_rules_get_v1(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // q
        Some("string"),  // sort
        Some(integer),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CorrelationRules.new

response = api.queries_rules_get_v1(filter: 'string',
                                    q: 'string',
                                    sort: 'string',
                                    offset: integer,
                                    limit: integer)

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

queries.rules.get.v2

Find all rule version IDs matching the query and filter.

Method GET

Route /correlation-rules/queries/rules/v2

Scope Correlation Rules: READ

PEP 8 query_rules_v2

Parameters

filter query · string

FQL query specifying the filter parameters

Available values (9)

`customer_id`	`user_id`	`user_uuid`
`status`	`name`	`created_on`
`last_updated_on`	`created_on`	`last_updated_on`

q query · string

Match query criteria, which includes all the filter string fields

sort query · string

Rule property to sort on.

Available values (4)

`created_on`	`created_on\|desc`	`last_updated_on`
`last_updated_on\|desc`

offset query · integer

Starting index of overall result set from which to return IDs

limit query · integer

Number of IDs to return

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.query_rules_v2(filter="string",
                                 q="string",
                                 sort="string",
                                 offset=integer,
                                 limit=integer)
print(response)

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.queries_rules_get_v2(filter="string",
                                       q="string",
                                       sort="string",
                                       offset=integer,
                                       limit=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_rules_get_v2",
                          filter="string",
                          q="string",
                          sort="string",
                          offset=integer,
                          limit=integer)
print(response)

Get-FalconCorrelationRule -Filter "string" `
  -Query "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/correlation_rules"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  q := "string"
  sort := "string"
  offset := int64(0)
  limit := int64(0)

  response, err := client.CorrelationRules.QueriesRulesGetV2(
    &correlation_rules.QueriesRulesGetV2Params{
      Filter: &filter,
      Q: &q,
      Sort: &sort,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.correlationRules.queriesRulesGetV2(
  "string",  // filter
  "string",  // q
  "string",  // sort
  integer,  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::correlation_rules_api::queries_rules_get_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = queries_rules_get_v2(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // q
        Some("string"),  // sort
        Some(integer),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CorrelationRules.new

response = api.queries_rules_get_v2(filter: 'string',
                                    q: 'string',
                                    sort: 'string',
                                    offset: integer,
                                    limit: integer)

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

queries.templates.get.v1Mixin0

Search rule template IDs matching the filter.

Method GET

Route /correlation-rules/queries/templates/v1

Scope Correlation Rules: READ

PEP 8 search_rule_template_ids

Parameters

filter query · string

FQL query specifying the filter parameters

Available values (9)

`name`	`description`	`vendor`
`outcome`	`mitre_attack.tactic_id`	`mitre_attack.technique_id`
`type`	`created_on`	`last_updated_on`

sort query · string

Rule property to sort on.

Available values (4)

`created_on`	`created_on\|desc`	`last_updated_on`
`last_updated_on\|desc`

offset query · integer

Starting index of overall result set from which to return IDs

limit query · integer

Number of IDs to return

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.search_rule_template_ids(filter="string",
                                           sort="string",
                                           offset=integer,
                                           limit=integer)
print(response)

from falconpy import CorrelationRules

falcon = CorrelationRules(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.queries_templates_get_v1Mixin0(filter="string",
                                                 sort="string",
                                                 offset=integer,
                                                 limit=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_templates_get_v1Mixin0",
                          filter="string",
                          sort="string",
                          offset=integer,
                          limit=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/correlation_rules"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  offset := int64(0)
  limit := int64(0)

  response, err := client.CorrelationRules.QueriesTemplatesGetV1Mixin0(
    &correlation_rules.QueriesTemplatesGetV1Mixin0Params{
      Filter: &filter,
      Sort: &sort,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.correlationRules.queriesTemplatesGetV1Mixin0(
  "string",  // filter
  "string",  // sort
  integer,  // offset
  integer  // limit
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CorrelationRules.new

response = api.queries_templates_get_v1_mixin0(filter: 'string',
                                               sort: 'string',
                                               offset: integer,
                                               limit: integer)

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

Correlation Rules

Table of Contents

aggregates.rule-versions.post.v1

Parameters

combined.rules.get.v1

Parameters

combined.rules.get.v2

Parameters

entities.latest-rules.get.v1

Parameters

entities.rule-versions.delete.v1

Parameters

entities.rule-versions_export.post.v1

Parameters

entities.rule-versions_import.post.v1

Parameters

entities.rule-versions_publish.patch.v1

Parameters

entities.rules.delete.v1

Parameters

entities.rules.get.v1

Parameters

entities.rules.get.v2

Parameters

entities.rules.patch.v1

Parameters

entities.rules.post.v1

Parameters

entities.templates.get.v1Mixin0

Parameters

entities.templates_rules.post.v1

Parameters

queries.rules.get.v1

Parameters

queries.rules.get.v2

Parameters

queries.templates.get.v1Mixin0

Parameters