CSPM Registration

The CSPM Registration service collection provides operations for registering and managing cloud accounts across AWS, Azure, and GCP environments. Configure cloud security posture monitoring, manage policy settings, and schedule compliance scans across your multi-cloud infrastructure.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

Sample Code

Operation	Description
AzureRefreshCertificate `azure_refresh_certificate`	Refresh certificate and returns JSON object(s) that contain the base64 encoded certificate for a service principal.
ConnectCSPMGCPAccount `connect_gcp_account`	Creates a new GCP account with newly-uploaded service account or connects with existing service account with only the following fields: parent_id, parent_type and service_account_id
CreateCSPMAwsAccount `create_aws_account`	Creates a new account in our system for a customer and generates a script for them to run in their AWS cloud environment to grant us access.
CreateCSPMAzureAccount `create_azure_account`	Creates a new account in our system for a customer and generates a script for them to run in their cloud environment to grant us access.
CreateCSPMAzureManagementGroup `create_azure_management_group`	Creates a new management group in our system for a customer.
CreateCSPMGCPAccount `create_gcp_account`	Creates a new account in our system for a customer and generates a new service account for them to add access to in their GCP environment to grant us access.
DeleteCSPMAwsAccount `delete_aws_account`	Deletes an existing AWS account or organization in our system.
DeleteCSPMAzureAccount `delete_azure_account`	Deletes an Azure subscription from the system.
DeleteCSPMAzureManagementGroup `delete_azure_management_group`	Deletes Azure management groups from the system.
DeleteCSPMGCPAccount `delete_gcp_account`	Deletes a GCP account from the system.
DiscoverCloudAzureDownloadCertificate	Returns JSON object(s) that contain the base64 encoded certificate for a service principal.
GetBehaviorDetections `get_behavior_detections`	Get list of detected behaviors
getCloudEventIDs `get_cloud_event_ids`	Deprecated: use cdrapi entities/event-details/v1 ‘logscale_related_events_query’ instead. deprecated
GetConfigurationDetectionEntities `get_configuration_detection_entities`	Get misconfigurations based on the ID - including custom policy detections in addition to default policy detections.
GetConfigurationDetectionIDsV2 `get_configuration_detection_ids_v2`	Get list of active misconfiguration ids - including custom policy detections in addition to default policy detections.
GetConfigurationDetections `get_configuration_detections`	Get list of active misconfigurations. deprecated
GetCSPMAwsAccount `get_aws_account`	Returns information about the current status of an AWS account.
GetCSPMAwsAccountScriptsAttachment `get_aws_account_scripts_attachment`	Return a script for customer to run in their cloud environment to grant us access to their AWS environment as a downloadable attachment.
GetCSPMAwsConsoleSetupURLs `get_aws_console_setup_urls`	Return a URL for customer to visit in their cloud environment to grant us access to their AWS environment.
GetCSPMAzureAccount `get_azure_account`	Return information about Azure account registration
GetCSPMAzureManagementGroup `get_azure_management_group`	Return information about Azure management group registration
GetCSPMAzureUserScriptsAttachment `get_azure_user_scripts_attachment`	Return a script for customer to run in their cloud environment to grant us access to their Azure environment as a downloadable attachment
GetCSPMGCPAccount `get_gcp_account`	Returns information about the current status of an GCP account.
GetCSPMGCPServiceAccountsExt `get_gcp_service_account`	Returns the service account id and client email for external clients.
GetCSPMGCPUserScriptsAttachment `get_gcp_user_scripts_attachment`	Return a script for customer to run in their cloud environment to grant us access to their GCP environment as a downloadable attachment
GetCSPMGCPValidateAccountsExt `validate_gcp_account`	Run a synchronous health check.
GetCSPMPoliciesDetails `get_policy_details`	Given an array of policy IDs, returns detailed policies information.
GetCSPMPolicy `get_policy`	Given a policy ID, returns detailed policy information.
GetCSPMPolicySettings `get_policy_settings`	Returns information about current policy settings.
GetCSPMScanSchedule `get_scan_schedule`	Returns scan schedule configuration for one or more cloud platforms.
GetIOAEvents `get_ioa_events`	For CSPM IOA events, gets list of IOA events.
GetIOAUsers `get_ioa_users`	For CSPM IOA users, gets list of IOA users.
PatchCSPMAwsAccount `update_aws_account`	Patches a existing account in our system for a customer.
UpdateCSPMAzureAccount `update_azure_account`	Patches a existing account in our system for a customer.
UpdateCSPMAzureAccountClientID `update_azure_account_client_id`	Update an Azure service account in our system by with the user-created client_id created with the public key we’ve provided
UpdateCSPMAzureTenantDefaultSubscriptionID `update_azure_tenant_default_subscription_id`	Update an Azure default subscription_id in our system for given tenant_id
UpdateCSPMGCPAccount `update_gcp_account`	Patches a existing account in our system for a customer.
UpdateCSPMGCPServiceAccountsExt `update_gcp_service_account`	Patches the service account key for external clients.
UpdateCSPMPolicySettings `update_policy_settings`	Updates a policy setting - can be used to override policy severity or to disable a policy entirely.
UpdateCSPMScanSchedule `update_scan_schedule`	Updates scan schedule configuration for one or more cloud platforms.
ValidateCSPMGCPServiceAccountExt `validate_gcp_service_account`	Validates credentials for a service account

AzureRefreshCertificate

Refresh certificate and returns JSON object(s) that contain the base64 encoded certificate for a service principal.

Method POST

Route /cloud-connect-cspm-azure/entities/refresh-certificate/v1

Scope CSPM registration: WRITE

PEP 8 azure_refresh_certificate

Parameters

tenant_id query · string or list of strings

Azure Tenant ID

years_valid query · string

Years the certificate should be valid. Max 2

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.azure_refresh_certificate(tenant_id=id_list,
                                                years_valid="string",
                                                stream=boolean)
    save_file.write(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.AzureRefreshCertificate(tenant_id=id_list,
                                              years_valid="string",
                                              stream=boolean)
    save_file.write(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.command("AzureRefreshCertificate",
                              tenant_id=id_list,
                              years_valid="string")
    save_file.write(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  yearsValid := "string"

  response, err := client.CspmRegistration.AzureRefreshCertificate(
    &cspm_registration.AzureRefreshCertificateParams{
      TenantID: []string{"ID1", "ID2", "ID3"},
      YearsValid: &yearsValid,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.azureRefreshCertificate(
  ["ID1", "ID2", "ID3"],  // tenantId
  "string"  // yearsValid
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::azure_refresh_certificate;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = azure_refresh_certificate(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // tenant_id
        Some("string"),  // years_valid
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

response = api.azure_refresh_certificate(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "client_id": "string",
    "end_date": "string",
    "public_certificate": "string",
    "public_certificate_raw": "string",
    "tenant_id": "string",
    "valid": false
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_id": "string",
      "end_date": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "tenant_id": "string",
      "valid": false
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_id": "string",
      "end_date": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "tenant_id": "string",
      "valid": false
    }
  ]
}

ConnectCSPMGCPAccount

Creates a new GCP account with newly-uploaded service account or connects with existing service account with only the following fields: parent_id, parent_type and service_account_id

Method POST

Route /cloud-connect-cspm-gcp/entities/account/v2

Scope CSPM registration: WRITE

PEP 8 connect_gcp_account

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

client_email body · string

GCP account email.

client_id body · string

GCP account client ID.

parent_id body · string

GCP parent ID.

parent_type body · string

GCP parent type.

private_key body · string

GCP private key.

private_key_id body · string

GCP private key ID.

project_id body · string

GCP project ID.

service_account_id body · integer

GCP service account ID.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.connect_gcp_account(client_email="string",
                                      client_id="string",
                                      parent_id="string",
                                      parent_type="string",
                                      private_key="string",
                                      private_key_id="string",
                                      project_id="string",
                                      service_account_id=integer)
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.ConnectCSPMGCPAccount(client_email="string",
                                        client_id="string",
                                        parent_id="string",
                                        parent_type="string",
                                        private_key="string",
                                        private_key_id="string",
                                        project_id="string",
                                        service_account_id=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "client_email": "string",
            "client_id": "string",
            "parent_id": "string",
            "parent_type": "string",
            "private_key": "string",
            "private_key_id": "string",
            "project_id": "string",
            "service_account_conditions": [
                {
                    "feature": "string",
                    "is_visible": boolean,
                    "last_transition": "string",
                    "message": "string",
                    "reason": "string",
                    "status": "string",
                    "type": "string"
                }
            ],
            "service_account_id": integer
        }
    ]
}

response = falcon.command("ConnectCSPMGCPAccount", body=body_payload)
print(response)

New-FalconCloudGcpAccount

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  client_email := "string"
  client_id := "string"
  parent_id := "string"
  parent_type := "string"
  private_key := "string"
  private_key_id := "string"
  project_id := "string"
  feature := "string"
  is_visible := boolean
  last_transition := "string"
  message := "string"
  reason := "string"
  status := "string"
  typeVar := "string"
  service_account_id := integer

  response, err := client.CspmRegistration.ConnectCSPMGCPAccount(
    &cspm_registration.ConnectCSPMGCPAccountParams{
      Body: &models.RegistrationGCPAccountExtRequestV2{
        Resources: []interface{}{
          {
          ClientEmail: &client_email,
          ClientID: &client_id,
          ParentID: &parent_id,
          ParentType: &parent_type,
          PrivateKey: &private_key,
          PrivateKeyID: &private_key_id,
          ProjectID: &project_id,
          ServiceAccountConditions: []interface{}{
            {
            Feature: &feature,
            IsVisible: &is_visible,
            LastTransition: &last_transition,
            Message: &message,
            Reason: &reason,
            Status: &status,
            Type: &typeVar,
            },
          },
          ServiceAccountID: &service_account_id,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.connectCSPMGCPAccount(
  {
    resources: [{
        clientEmail: "string",
        clientId: "string",
        parentId: "string",
        parentType: "string",
        privateKey: "string",
        privateKeyId: "string",
        projectId: "string",
        serviceAccountConditions: [{
            feature: "string",
            isVisible: boolean,
            lastTransition: "string",
            message: "string",
            reason: "string",
            status: "string",
            type: "string"
          }],
        serviceAccountId: integer
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::connect_cspmgcp_account;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RegistrationGcpAccountExtRequestV2;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RegistrationGcpAccountExtRequestV2 {
        resources: vec![GCPAccountReqObjV2 {
            parent_id: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = connect_cspmgcp_account(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

body = Falcon::RegistrationGCPAccountExtRequestV2.new(
  resources: [{
      client_email: 'string',
      client_id: 'string',
      parent_id: 'string',
      parent_type: 'string',
      private_key: 'string',
      private_key_id: 'string',
      project_id: 'string',
      service_account_conditions: [{
          feature: 'string',
          is_visible: boolean,
          last_transition: 'string',
          message: 'string',
          reason: 'string',
          status: 'string',
          type: 'string'
        }],
      service_account_id: integer
    }]
)

response = api.connect_cspm_gcp_account(body)

puts response

Responses

[
  {
    "client_email": "string",
    "client_id": "string",
    "parent_id": "string",
    "parent_type": "string",
    "project_id": "string",
    "service_account_conditions": [],
    "service_account_id": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_email": "string",
      "client_id": "string",
      "parent_id": "string",
      "parent_type": "string",
      "project_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_email": "string",
      "client_id": "string",
      "parent_id": "string",
      "parent_type": "string",
      "project_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_email": "string",
      "client_id": "string",
      "parent_id": "string",
      "parent_type": "string",
      "project_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_email": "string",
      "client_id": "string",
      "parent_id": "string",
      "parent_type": "string",
      "project_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0
    }
  ]
}

CreateCSPMAwsAccount

Creates a new account in our system for a customer and generates a script for them to run in their AWS cloud environment to grant us access.

Method POST

Route /cloud-connect-cspm-aws/entities/account/v1

Scope CSPM registration: WRITE

PEP 8 create_aws_account

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

account_id body · string

AWS Account ID.

account_type body · string

AWS account type.

behavior_assessment_enabled body · boolean

Indicate if behavior assessment should be enabled.

cloudtrail_region body · string

AWS Cloudtrail Region.

deployment_method body · string

Deployment method.

dspm_enabled body · boolean

Flag indicating if DSPM should be enabled.

dspm_role body · string

DSPM role.

falcon_client_id body · string

Falcon Client ID.

iam_role_arn body · string

IAM role ARN to use.

is_master body · boolean

Indicate if this is the primary account.

organization_id body · string

AWS Organization ID.

root_stack_id body · string

Root stack ID.

sensor_management_enabled body · boolean

Indicate if sensor management should be enabled.

target_ous body · string or list of strings

List of target OUs.

use_existing_cloudtrail body · boolean

Indicate if the existing CloudTrail should be used.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.create_aws_account(account_id="string",
                                     account_type="string",
                                     behavior_assessment_enabled=boolean,
                                     cloudtrail_region="string",
                                     deployment_method="string",
                                     dspm_enabled=boolean,
                                     dspm_role="string",
                                     falcon_client_id="string",
                                     iam_role_arn="string",
                                     is_master=boolean,
                                     organization_id="string",
                                     root_stack_id="string",
                                     sensor_management_enabled=boolean,
                                     target_ous=id_list,
                                     use_existing_cloudtrail=boolean)
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.CreateCSPMAwsAccount(account_id="string",
                                       account_type="string",
                                       behavior_assessment_enabled=boolean,
                                       cloudtrail_region="string",
                                       deployment_method="string",
                                       dspm_enabled=boolean,
                                       dspm_role="string",
                                       falcon_client_id="string",
                                       iam_role_arn="string",
                                       is_master=boolean,
                                       organization_id="string",
                                       root_stack_id="string",
                                       sensor_management_enabled=boolean,
                                       target_ous=id_list,
                                       use_existing_cloudtrail=boolean)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "resources": [
        {
            "account_id": "string",
            "account_type": "string",
            "behavior_assessment_enabled": boolean,
            "cloudtrail_region": "string",
            "deployment_method": "string",
            "dspm_enabled": boolean,
            "dspm_host_account_id": "string",
            "dspm_role": "string",
            "falcon_client_id": "string",
            "iam_role_arn": "string",
            "is_master": boolean,
            "organization_id": "string",
            "root_stack_id": "string",
            "sensor_management_enabled": boolean,
            "target_ous": ["string"],
            "use_existing_cloudtrail": boolean,
            "vulnerability_scanning_enabled": boolean,
            "vulnerability_scanning_host_account_id": "string",
            "vulnerability_scanning_role": "string"
        }
    ]
}

response = falcon.command("CreateCSPMAwsAccount", body=body_payload)
print(response)

New-FalconCloudAwsAccount -AccountId "string" -CloudtrailRegion "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  account_id := "string"
  account_type := "string"
  behavior_assessment_enabled := boolean
  cloudtrail_region := "string"
  deployment_method := "string"
  dspm_enabled := boolean
  dspm_host_account_id := "string"
  dspm_role := "string"
  falcon_client_id := "string"
  iam_role_arn := "string"
  is_master := boolean
  organization_id := "string"
  root_stack_id := "string"
  sensor_management_enabled := boolean
  use_existing_cloudtrail := boolean
  vulnerability_scanning_enabled := boolean
  vulnerability_scanning_host_account_id := "string"
  vulnerability_scanning_role := "string"

  response, err := client.CspmRegistration.CreateCSPMAwsAccount(
    &cspm_registration.CreateCSPMAwsAccountParams{
      Body: &models.RegistrationAWSAccountCreateRequestExtV2{
        Resources: []interface{}{
          {
          AccountID: &account_id,
          AccountType: &account_type,
          BehaviorAssessmentEnabled: &behavior_assessment_enabled,
          CloudtrailRegion: &cloudtrail_region,
          DeploymentMethod: &deployment_method,
          DspmEnabled: &dspm_enabled,
          DspmHostAccountID: &dspm_host_account_id,
          DspmRole: &dspm_role,
          FalconClientID: &falcon_client_id,
          IamRoleArn: &iam_role_arn,
          IsMaster: &is_master,
          OrganizationID: &organization_id,
          RootStackID: &root_stack_id,
          SensorManagementEnabled: &sensor_management_enabled,
          TargetOus: []string{"string"},
          UseExistingCloudtrail: &use_existing_cloudtrail,
          VulnerabilityScanningEnabled: &vulnerability_scanning_enabled,
          VulnerabilityScanningHostAccountID: &vulnerability_scanning_host_account_id,
          VulnerabilityScanningRole: &vulnerability_scanning_role,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.createCSPMAwsAccount(
  {
    resources: [{
        accountId: "string",
        accountType: "string",
        behaviorAssessmentEnabled: boolean,
        cloudtrailRegion: "string",
        deploymentMethod: "string",
        dspmEnabled: boolean,
        dspmHostAccountId: "string",
        dspmRole: "string",
        falconClientId: "string",
        iamRoleArn: "string",
        isMaster: boolean,
        organizationId: "string",
        rootStackId: "string",
        sensorManagementEnabled: boolean,
        targetOus: [],
        useExistingCloudtrail: boolean,
        vulnerabilityScanningEnabled: boolean,
        vulnerabilityScanningHostAccountId: "string",
        vulnerabilityScanningRole: "string"
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::create_cspm_aws_account;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RegistrationAwsAccountCreateRequestExtV2;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RegistrationAwsAccountCreateRequestExtV2 {
        resources: vec![AWSAccountExtV2 {
            account_id: Some("string".to_string()),
            cloudtrail_region: Some("string".to_string()),
            iam_role_arn: Some("string".to_string()),
            organization_id: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = create_cspm_aws_account(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

body = Falcon::RegistrationAWSAccountCreateRequestExtV2.new(
  resources: [{
      account_id: 'string',
      account_type: 'string',
      behavior_assessment_enabled: boolean,
      cloudtrail_region: 'string',
      deployment_method: 'string',
      dspm_enabled: boolean,
      dspm_host_account_id: 'string',
      dspm_role: 'string',
      falcon_client_id: 'string',
      iam_role_arn: 'string',
      is_master: boolean,
      organization_id: 'string',
      root_stack_id: 'string',
      sensor_management_enabled: boolean,
      target_ous: [],
      use_existing_cloudtrail: boolean,
      vulnerability_scanning_enabled: boolean,
      vulnerability_scanning_host_account_id: 'string',
      vulnerability_scanning_role: 'string'
    }]
)

response = api.create_cspm_aws_account(body)

puts response

Responses

[
  {
    "CreatedAt": "string",
    "DeletedAt": "string",
    "ID": 0,
    "UpdatedAt": "string",
    "account_id": "string",
    "account_name": "string",
    "account_type": "string",
    "active_regions": [],
    "aws_cloudtrail_bucket_name": "string",
    "aws_cloudtrail_region": "string",
    "aws_eventbus_arn": "string",
    "aws_permissions_status": [],
    "behavior_assessment_enabled": false,
    "cid": "string",
    "cloud_registration_enabled": false,
    "cloud_scopes": [],
    "cloudformation_root_stack_arn": "string",
    "cloudformation_update_url": "string",
    "cloudformation_url": "string",
    "conditions": [],
    "cspm_enabled": false,
    "d4c": {},
    "d4c_migrated": false,
    "dspm_enabled": false,
    "dspm_host_account_id": "string",
    "dspm_role_arn": "string",
    "environment": "string",
    "eventbus_name": "string",
    "external_id": "string",
    "falcon_client_id": "string",
    "features": [],
    "iam_role_arn": "string",
    "intermediate_role_arn": "string",
    "inventory_filter": [],
    "is_cloud_registration": false,
    "is_cspm_lite": false,
    "is_custom_rolename": false,
    "is_delegated_admin": false,
    "is_master": false,
    "ngsiem_enabled": false,
    "organization_id": "string",
    "remediation_cloudformation_url": "string",
    "remediation_region": "string",
    "remediation_tou_accepted": "string",
    "resource_name_prefix": "string",
    "resource_name_suffix": "string",
    "root_account_id": "string",
    "root_iam_role": false,
    "s3_url": "string",
    "secondary_role_arn": "string",
    "sensor_management_enabled": false,
    "settings": {},
    "status": "string",
    "target_ous": [],
    "template_source_region": "string",
    "use_existing_cloudtrail": false,
    "valid": false,
    "vulnerability_scanning_enabled": false,
    "vulnerability_scanning_host_account_id": "string",
    "vulnerability_scanning_role_arn": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_id": "string",
      "account_name": "string",
      "account_type": "string",
      "active_regions": [],
      "aws_cloudtrail_bucket_name": "string",
      "aws_cloudtrail_region": "string",
      "aws_eventbus_arn": "string",
      "aws_permissions_status": [],
      "behavior_assessment_enabled": false,
      "cid": "string",
      "cloud_registration_enabled": false,
      "cloud_scopes": [],
      "cloudformation_root_stack_arn": "string",
      "cloudformation_update_url": "string",
      "cloudformation_url": "string",
      "conditions": [],
      "cspm_enabled": false,
      "d4c": {},
      "d4c_migrated": false,
      "dspm_enabled": false,
      "dspm_host_account_id": "string",
      "dspm_role_arn": "string",
      "environment": "string",
      "eventbus_name": "string",
      "external_id": "string",
      "falcon_client_id": "string",
      "features": [],
      "iam_role_arn": "string",
      "intermediate_role_arn": "string",
      "inventory_filter": [],
      "is_cloud_registration": false,
      "is_cspm_lite": false,
      "is_custom_rolename": false,
      "is_delegated_admin": false,
      "is_master": false,
      "ngsiem_enabled": false,
      "organization_id": "string",
      "remediation_cloudformation_url": "string",
      "remediation_region": "string",
      "remediation_tou_accepted": "string",
      "resource_name_prefix": "string",
      "resource_name_suffix": "string",
      "root_account_id": "string",
      "root_iam_role": false,
      "s3_url": "string",
      "secondary_role_arn": "string",
      "sensor_management_enabled": false,
      "settings": {},
      "status": "string",
      "target_ous": [],
      "template_source_region": "string",
      "use_existing_cloudtrail": false,
      "valid": false,
      "vulnerability_scanning_enabled": false,
      "vulnerability_scanning_host_account_id": "string",
      "vulnerability_scanning_role_arn": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

CreateCSPMAzureAccount

Creates a new account in our system for a customer and generates a script for them to run in their cloud environment to grant us access.

Method POST

Route /cloud-connect-cspm-azure/entities/account/v1

Scope CSPM registration: WRITE

PEP 8 create_azure_account

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

account_type body · string

Azure account type.

client_id body · string

Azure Client ID.

default_subscription body · boolean

Indicate if this is the default subscription.

subscription_id body · string

Azure Subscription ID.

tenant_id body · string

Azure Tenant ID.

years_valid body · integer

Number of years this account is valid.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.create_azure_account(account_type="string",
                                       client_id="string",
                                       default_subscription=boolean,
                                       subscription_id="string",
                                       tenant_id="string",
                                       years_valid=integer)
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.CreateCSPMAzureAccount(account_type="string",
                                         client_id="string",
                                         default_subscription=boolean,
                                         subscription_id="string",
                                         tenant_id="string",
                                         years_valid=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "account_type": "string",
            "client_id": "string",
            "default_subscription": boolean,
            "subscription_id": "string",
            "tenant_id": "string",
            "years_valid": integer
        }
    ]
}

response = falcon.command("CreateCSPMAzureAccount", body=body_payload)
print(response)

New-FalconCloudAzureAccount

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  account_type := "string"
  client_id := "string"
  default_subscription := boolean
  subscription_id := "string"
  tenant_id := "string"
  years_valid := integer

  response, err := client.CspmRegistration.CreateCSPMAzureAccount(
    &cspm_registration.CreateCSPMAzureAccountParams{
      Body: &models.RegistrationAzureAccountCreateRequestExternalV1{
        Resources: []interface{}{
          {
          AccountType: &account_type,
          ClientID: &client_id,
          DefaultSubscription: &default_subscription,
          SubscriptionID: &subscription_id,
          TenantID: &tenant_id,
          YearsValid: &years_valid,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.createCSPMAzureAccount(
  {
    resources: [{
        accountType: "string",
        clientId: "string",
        defaultSubscription: boolean,
        subscriptionId: "string",
        tenantId: "string",
        yearsValid: integer
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::create_cspm_azure_account;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RegistrationAzureAccountCreateRequestExternalV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RegistrationAzureAccountCreateRequestExternalV1 {
        resources: vec![],
        ..Default::default()
    };

    let response = create_cspm_azure_account(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

body = Falcon::RegistrationAzureAccountCreateRequestExternalV1.new(
  resources: [{
      account_type: 'string',
      client_id: 'string',
      default_subscription: boolean,
      subscription_id: 'string',
      tenant_id: 'string',
      years_valid: integer
    }]
)

response = api.create_cspm_azure_account(body)

puts response

Responses

[
  {
    "CreatedAt": "string",
    "DeletedAt": "string",
    "ID": 0,
    "UpdatedAt": "string",
    "account_type": "string",
    "azure_permissions_status": [],
    "cid": "string",
    "client_id": "string",
    "cloud_scopes": [],
    "conditions": [],
    "credentials_end_date": "string",
    "credentials_type": "string",
    "default_subscription_id": "string",
    "environment": "string",
    "ioa_status": "string",
    "iom_status": "string",
    "is_cspm_lite": false,
    "object_id": "string",
    "parent_management_group_id": "string",
    "parent_management_group_name": "string",
    "primary_domain": "string",
    "public_certificate": "string",
    "public_certificate_raw": "string",
    "role_assignments": [],
    "show_modal": false,
    "status": "string",
    "subscription_id": "string",
    "subscription_name": "string",
    "tenant_id": "string",
    "tenant_name": "string",
    "years_valid": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_type": "string",
      "azure_permissions_status": [],
      "cid": "string",
      "client_id": "string",
      "cloud_scopes": [],
      "conditions": [],
      "credentials_end_date": "string",
      "credentials_type": "string",
      "default_subscription_id": "string",
      "environment": "string",
      "ioa_status": "string",
      "iom_status": "string",
      "is_cspm_lite": false,
      "object_id": "string",
      "parent_management_group_id": "string",
      "parent_management_group_name": "string",
      "primary_domain": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "role_assignments": [],
      "show_modal": false,
      "status": "string",
      "subscription_id": "string",
      "subscription_name": "string",
      "tenant_id": "string",
      "tenant_name": "string",
      "years_valid": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_type": "string",
      "azure_permissions_status": [],
      "cid": "string",
      "client_id": "string",
      "cloud_scopes": [],
      "conditions": [],
      "credentials_end_date": "string",
      "credentials_type": "string",
      "default_subscription_id": "string",
      "environment": "string",
      "ioa_status": "string",
      "iom_status": "string",
      "is_cspm_lite": false,
      "object_id": "string",
      "parent_management_group_id": "string",
      "parent_management_group_name": "string",
      "primary_domain": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "role_assignments": [],
      "show_modal": false,
      "status": "string",
      "subscription_id": "string",
      "subscription_name": "string",
      "tenant_id": "string",
      "tenant_name": "string",
      "years_valid": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_type": "string",
      "azure_permissions_status": [],
      "cid": "string",
      "client_id": "string",
      "cloud_scopes": [],
      "conditions": [],
      "credentials_end_date": "string",
      "credentials_type": "string",
      "default_subscription_id": "string",
      "environment": "string",
      "ioa_status": "string",
      "iom_status": "string",
      "is_cspm_lite": false,
      "object_id": "string",
      "parent_management_group_id": "string",
      "parent_management_group_name": "string",
      "primary_domain": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "role_assignments": [],
      "show_modal": false,
      "status": "string",
      "subscription_id": "string",
      "subscription_name": "string",
      "tenant_id": "string",
      "tenant_name": "string",
      "years_valid": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_type": "string",
      "azure_permissions_status": [],
      "cid": "string",
      "client_id": "string",
      "cloud_scopes": [],
      "conditions": [],
      "credentials_end_date": "string",
      "credentials_type": "string",
      "default_subscription_id": "string",
      "environment": "string",
      "ioa_status": "string",
      "iom_status": "string",
      "is_cspm_lite": false,
      "object_id": "string",
      "parent_management_group_id": "string",
      "parent_management_group_name": "string",
      "primary_domain": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "role_assignments": [],
      "show_modal": false,
      "status": "string",
      "subscription_id": "string",
      "subscription_name": "string",
      "tenant_id": "string",
      "tenant_name": "string",
      "years_valid": 0
    }
  ]
}

CreateCSPMAzureManagementGroup

Creates a new management group in our system for a customer.

Method POST

Route /cloud-connect-cspm-azure/entities/management-group/v1

Scope CSPM registration: WRITE

PEP 8 create_azure_management_group

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

default_subscription_id body · string

ID of the default azure subscription.

tenant_id body · string

Azure Tenant ID.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.create_azure_management_group(default_subscription_id="string",
                                                tenant_id="string")
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.CreateCSPMAzureManagementGroup(default_subscription_id="string",
                                                 tenant_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "default_subscription_id": "string",
            "tenant_id": "string"
        }
    ]
}

response = falcon.command("CreateCSPMAzureManagementGroup", body=body_payload)
print(response)

New-FalconCloudAzureGroup

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  default_subscription_id := "string"
  tenant_id := "string"

  response, err := client.CspmRegistration.CreateCSPMAzureManagementGroup(
    &cspm_registration.CreateCSPMAzureManagementGroupParams{
      Body: &models.RegistrationAzureManagementGroupCreateRequestExternalV1{
        Resources: []interface{}{
          {
          DefaultSubscriptionID: &default_subscription_id,
          TenantID: &tenant_id,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.createCSPMAzureManagementGroup(
  {
    resources: [{
        defaultSubscriptionId: "string",
        tenantId: "string"
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::create_cspm_azure_management_group;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RegistrationAzureManagementGroupCreateRequestExternalV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RegistrationAzureManagementGroupCreateRequestExternalV1 {
        resources: vec![AzureManagementGroupExternalV1 {
            tenant_id: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = create_cspm_azure_management_group(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

body = Falcon::RegistrationAzureManagementGroupCreateRequestExternalV1.new(
  resources: [{
      default_subscription_id: 'string',
      tenant_id: 'string'
    }]
)

response = api.create_cspm_azure_management_group(body)

puts response

Responses

[
  {
    "CreatedAt": "string",
    "DeletedAt": "string",
    "ID": 0,
    "UpdatedAt": "string",
    "account_type": "string",
    "azure_permissions_status": [],
    "cid": "string",
    "client_id": "string",
    "cloud_scopes": [],
    "conditions": [],
    "credentials_end_date": "string",
    "credentials_type": "string",
    "default_subscription_id": "string",
    "environment": "string",
    "ioa_status": "string",
    "iom_status": "string",
    "is_cspm_lite": false,
    "object_id": "string",
    "parent_management_group_id": "string",
    "parent_management_group_name": "string",
    "primary_domain": "string",
    "public_certificate": "string",
    "public_certificate_raw": "string",
    "role_assignments": [],
    "show_modal": false,
    "status": "string",
    "subscription_id": "string",
    "subscription_name": "string",
    "tenant_id": "string",
    "tenant_name": "string",
    "years_valid": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_type": "string",
      "azure_permissions_status": [],
      "cid": "string",
      "client_id": "string",
      "cloud_scopes": [],
      "conditions": [],
      "credentials_end_date": "string",
      "credentials_type": "string",
      "default_subscription_id": "string",
      "environment": "string",
      "ioa_status": "string",
      "iom_status": "string",
      "is_cspm_lite": false,
      "object_id": "string",
      "parent_management_group_id": "string",
      "parent_management_group_name": "string",
      "primary_domain": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "role_assignments": [],
      "show_modal": false,
      "status": "string",
      "subscription_id": "string",
      "subscription_name": "string",
      "tenant_id": "string",
      "tenant_name": "string",
      "years_valid": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_type": "string",
      "azure_permissions_status": [],
      "cid": "string",
      "client_id": "string",
      "cloud_scopes": [],
      "conditions": [],
      "credentials_end_date": "string",
      "credentials_type": "string",
      "default_subscription_id": "string",
      "environment": "string",
      "ioa_status": "string",
      "iom_status": "string",
      "is_cspm_lite": false,
      "object_id": "string",
      "parent_management_group_id": "string",
      "parent_management_group_name": "string",
      "primary_domain": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "role_assignments": [],
      "show_modal": false,
      "status": "string",
      "subscription_id": "string",
      "subscription_name": "string",
      "tenant_id": "string",
      "tenant_name": "string",
      "years_valid": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_type": "string",
      "azure_permissions_status": [],
      "cid": "string",
      "client_id": "string",
      "cloud_scopes": [],
      "conditions": [],
      "credentials_end_date": "string",
      "credentials_type": "string",
      "default_subscription_id": "string",
      "environment": "string",
      "ioa_status": "string",
      "iom_status": "string",
      "is_cspm_lite": false,
      "object_id": "string",
      "parent_management_group_id": "string",
      "parent_management_group_name": "string",
      "primary_domain": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "role_assignments": [],
      "show_modal": false,
      "status": "string",
      "subscription_id": "string",
      "subscription_name": "string",
      "tenant_id": "string",
      "tenant_name": "string",
      "years_valid": 0
    }
  ]
}

CreateCSPMGCPAccount

Creates a new account in our system for a customer and generates a new service account for them to add access to in their GCP environment to grant us access.

Method POST

Route /cloud-connect-cspm-gcp/entities/account/v1

Scope CSPM registration: WRITE

PEP 8 create_gcp_account

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

parent_id body · string

GCP parent ID.

parent_type body · string

GCP parent type.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.create_gcp_account(parent_id="string", parent_type="string")
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.CreateCSPMGCPAccount(parent_id="string", parent_type="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "parent_id": "string",
            "parent_type": "string"
        }
    ]
}

response = falcon.command("CreateCSPMGCPAccount", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  parent_id := "string"
  parent_type := "string"

  response, err := client.CspmRegistration.CreateCSPMGCPAccount(
    &cspm_registration.CreateCSPMGCPAccountParams{
      Body: &models.RegistrationGCPAccountCreateRequestExtV1{
        Resources: []interface{}{
          {
          ParentID: &parent_id,
          ParentType: &parent_type,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.createCSPMGCPAccount(
  {
    resources: [{
        parentId: "string",
        parentType: "string"
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::create_cspmgcp_account;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RegistrationGcpAccountCreateRequestExtV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RegistrationGcpAccountCreateRequestExtV1 {
        resources: vec![GCPAccountExtV1 {
            parent_id: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = create_cspmgcp_account(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

body = Falcon::RegistrationGCPAccountCreateRequestExtV1.new(
  resources: [{
      parent_id: 'string',
      parent_type: 'string'
    }]
)

response = api.create_cspm_gcp_account(body)

puts response

Responses

[
  {
    "CreatedAt": "string",
    "DeletedAt": "string",
    "ID": 0,
    "UpdatedAt": "string",
    "cid": "string",
    "cloud_registration_enabled": false,
    "cloud_scopes": [],
    "conditions": [],
    "cspm_enabled": false,
    "display_name": "string",
    "environment": "string",
    "folder_id": "string",
    "folder_name": "string",
    "gcp_permissions_status": [],
    "organization_id": "string",
    "organization_name": "string",
    "parent_id": "string",
    "parent_type": "string",
    "project_id": "string",
    "service_account_client_email": "string",
    "service_account_client_id": "string",
    "service_account_conditions": [],
    "service_account_id": 0,
    "service_account_private_key_id": "string",
    "service_account_project_id": "string",
    "status": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "cid": "string",
      "cloud_registration_enabled": false,
      "cloud_scopes": [],
      "conditions": [],
      "cspm_enabled": false,
      "display_name": "string",
      "environment": "string",
      "folder_id": "string",
      "folder_name": "string",
      "gcp_permissions_status": [],
      "organization_id": "string",
      "organization_name": "string",
      "parent_id": "string",
      "parent_type": "string",
      "project_id": "string",
      "service_account_client_email": "string",
      "service_account_client_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0,
      "service_account_private_key_id": "string",
      "service_account_project_id": "string",
      "status": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "cid": "string",
      "cloud_registration_enabled": false,
      "cloud_scopes": [],
      "conditions": [],
      "cspm_enabled": false,
      "display_name": "string",
      "environment": "string",
      "folder_id": "string",
      "folder_name": "string",
      "gcp_permissions_status": [],
      "organization_id": "string",
      "organization_name": "string",
      "parent_id": "string",
      "parent_type": "string",
      "project_id": "string",
      "service_account_client_email": "string",
      "service_account_client_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0,
      "service_account_private_key_id": "string",
      "service_account_project_id": "string",
      "status": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "cid": "string",
      "cloud_registration_enabled": false,
      "cloud_scopes": [],
      "conditions": [],
      "cspm_enabled": false,
      "display_name": "string",
      "environment": "string",
      "folder_id": "string",
      "folder_name": "string",
      "gcp_permissions_status": [],
      "organization_id": "string",
      "organization_name": "string",
      "parent_id": "string",
      "parent_type": "string",
      "project_id": "string",
      "service_account_client_email": "string",
      "service_account_client_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0,
      "service_account_private_key_id": "string",
      "service_account_project_id": "string",
      "status": "string"
    }
  ]
}

DeleteCSPMAwsAccount

Deletes an existing AWS account or organization in our system.

Method DELETE

Route /cloud-connect-cspm-aws/entities/account/v1

Scope CSPM registration: WRITE

PEP 8 delete_aws_account

Parameters

ids query · string or list of strings

AWS account IDs to remove

organization-ids query · string or list of strings

AWS organization IDs to remove

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

organization_ids body · string or list of strings

AWS Organization IDs to be removed.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_aws_account(ids=id_list, organization_ids=id_list)
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteCSPMAwsAccount(ids=id_list, organization_ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteCSPMAwsAccount",
                          ids=id_list,
                          organization_ids=id_list)
print(response)

Remove-FalconCloudAwsAccount -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CspmRegistration.DeleteCSPMAwsAccount(
    &cspm_registration.DeleteCSPMAwsAccountParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      OrganizationIds: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.deleteCSPMAwsAccount(
  ["ID1", "ID2", "ID3"],  // ids
  ["ID1", "ID2", "ID3"]  // organizationIds
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::delete_cspm_aws_account;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_cspm_aws_account(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
        Some(vec!["string".to_string()]),  // organization_ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

response = api.delete_cspm_aws_account(ids: ['ID1', 'ID2', 'ID3'],
                                       organization_ids: ['ID1', 'ID2', 'ID3'])

puts response

Responses

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

DeleteCSPMAzureAccount

Deletes an Azure subscription from the system.

Method DELETE

Route /cloud-connect-cspm-azure/entities/account/v1

Scope CSPM registration: WRITE

PEP 8 delete_azure_account

Parameters

ids query · string or list of strings

Azure subscription IDs to remove

tenant_ids query · string or list of strings

Tenant ids to remove

retain_tenant query · string

Should the tenant be retainined. (true / false)

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_azure_account(ids=id_list,
                                       retain_tenant="string",
                                       tenant_ids=id_list)
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteCSPMAzureAccount(ids=id_list,
                                         retain_tenant="string",
                                         tenant_ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteCSPMAzureAccount",
                          ids=id_list,
                          tenant_ids=id_list,
                          retain_tenant="string")
print(response)

Remove-FalconCloudAzureAccount -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  retainTenant := "string"

  response, err := client.CspmRegistration.DeleteCSPMAzureAccount(
    &cspm_registration.DeleteCSPMAzureAccountParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      TenantIds: []string{"ID1", "ID2", "ID3"},
      RetainTenant: &retainTenant,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.deleteCSPMAzureAccount(
  ["ID1", "ID2", "ID3"],  // ids
  ["ID1", "ID2", "ID3"],  // tenantIds
  "string"  // retainTenant
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::delete_cspm_azure_account;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_cspm_azure_account(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
        Some(vec!["string".to_string()]),  // tenant_ids
        Some("string"),  // retain_tenant
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

response = api.delete_cspm_azure_account(ids: ['ID1', 'ID2', 'ID3'],
                                         tenant_ids: ['ID1', 'ID2', 'ID3'],
                                         retain_tenant: 'string')

puts response

Responses

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_type": "string",
      "azure_permissions_status": [],
      "cid": "string",
      "client_id": "string",
      "cloud_scopes": [],
      "conditions": [],
      "credentials_end_date": "string",
      "credentials_type": "string",
      "default_subscription_id": "string",
      "environment": "string",
      "ioa_status": "string",
      "iom_status": "string",
      "is_cspm_lite": false,
      "object_id": "string",
      "parent_management_group_id": "string",
      "parent_management_group_name": "string",
      "primary_domain": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "role_assignments": [],
      "show_modal": false,
      "status": "string",
      "subscription_id": "string",
      "subscription_name": "string",
      "tenant_id": "string",
      "tenant_name": "string",
      "years_valid": 0
    }
  ]
}

DeleteCSPMAzureManagementGroup

Deletes Azure management groups from the system.

Method DELETE

Route /cloud-connect-cspm-azure/entities/management-group/v1

Scope CSPM registration: WRITE

PEP 8 delete_azure_management_group

Parameters

tenant_ids query · string or list of strings

Tenant ids to remove

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_azure_management_group(tenant_ids=id_list)
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteCSPMAzureManagementGroup(tenant_ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteCSPMAzureManagementGroup",
                          tenant_ids=id_list)
print(response)

Remove-FalconCloudAzureGroup

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CspmRegistration.DeleteCSPMAzureManagementGroup(
    &cspm_registration.DeleteCSPMAzureManagementGroupParams{
      TenantIds: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.deleteCSPMAzureManagementGroup(["ID1", "ID2", "ID3"]);  // tenantIds

console.log(response);

use rusty_falcon::apis::cspm_registration_api::delete_cspm_azure_management_group;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_cspm_azure_management_group(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // tenant_ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

response = api.delete_cspm_azure_management_group(tenant_ids: ['ID1', 'ID2', 'ID3'])

puts response

Responses

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

DeleteCSPMGCPAccount

Deletes a GCP account from the system.

Method DELETE

Route /cloud-connect-cspm-gcp/entities/account/v1

Scope CSPM registration: WRITE

PEP 8 delete_gcp_account

Parameters

ids query · string or list of strings

Hierarchical Resource IDs of accounts

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_gcp_account(ids=id_list)
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteCSPMGCPAccount(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteCSPMGCPAccount",
                          ids=id_list)
print(response)

Remove-FalconCloudGcpAccount -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CspmRegistration.DeleteCSPMGCPAccount(
    &cspm_registration.DeleteCSPMGCPAccountParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.deleteCSPMGCPAccount(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::cspm_registration_api::delete_cspmgcp_account;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_cspmgcp_account(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

response = api.delete_cspm_gcp_account(ids: ['ID1', 'ID2', 'ID3'])

puts response

Responses

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

DiscoverCloudAzureDownloadCertificate

Returns JSON object(s) that contain the base64 encoded certificate for a service principal.

Method GET

Route /cloud-connect-cspm-azure/entities/download-certificate/v1

Scope CSPM registration: READ

Parameters

tenant_id query · string or list of strings

Azure Tenant ID

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Examples coming soon.

Get-FalconCloudAzureCertificate -TenantId @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CspmRegistration.AzureDownloadCertificate(
    &cspm_registration.AzureDownloadCertificateParams{
      TenantID: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.azureDownloadCertificate(["ID1", "ID2", "ID3"]);  // tenantId

console.log(response);

use rusty_falcon::apis::cspm_registration_api::azure_download_certificate;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = azure_download_certificate(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // tenant_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

response = api.azure_download_certificate(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "client_id": "string",
    "end_date": "string",
    "public_certificate": "string",
    "public_certificate_raw": "string",
    "tenant_id": "string",
    "valid": false
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_id": "string",
      "end_date": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "tenant_id": "string",
      "valid": false
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_id": "string",
      "end_date": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "tenant_id": "string",
      "valid": false
    }
  ]
}

GetBehaviorDetections

Get list of detected behaviors

Method GET

Route /detects/entities/ioa/v1

Scope CSPM registration: READ

PEP 8 get_behavior_detections

Parameters

cloud_provider query · string

Cloud Provider (e.g.: aws|azure)

Available values (2)

aws azure

service query · string

Cloud Service (e.g. EC2 | EBS | S3)

Available values (54)

`ACM`	`ACR`	`Any`
`App Engine`	`AppService`	`BigQuery`
`Cloud Load Balancing`	`Cloud Logging`	`Cloud SQL`
`Cloud Storage`	`CloudFormation`	`CloudTrail`
`CloudWatch Logs`	`Cloudfront`	`Compute Engine`
`Config`	`Disk`	`DynamoDB`
`EBS`	`EC2`	`ECR`
`EFS`	`EKS`	`ELB`
`EMR`	`Elasticache`	`GuardDuty`
`IAM`	`Identity`	`KMS`
`KeyVault`	`Kinesis`	`Kubernetes`
`Lambda`	`LoadBalancer`	`Monitor`
`NLB/ALB`	`NetworkSecurityGroup`	`PostgreSQL`
`RDS`	`Redshift`	`S3`
`SES`	`SNS`	`SQLDatabase`
`SQLServer`	`SQS`	`SSM`
`Serverless Application Repository`	`StorageAccount`	`Subscriptions`
`VPC`	`VirtualMachine`	`VirtualNetwork`

account_id query · string

Cloud Account ID (e.g.: AWS accountID, Azure subscriptionID)

aws_account_id query · string

AWS Account ID

azure_subscription_id query · string

Azure Subscription ID

azure_tenant_id query · string

Azure Tenant ID

state query · string

State (e.g.: open | closed)

Available values (2)

closed open

date_time_since query · string

Filter to get all events after this date, in format RFC3339 : e.g. 2006-01-02T15:04:05Z07:00

since query · string

Filter events using a duration string (e.g. 24h)

severity query · string

Policy Severity

Available values (4)

`Critical`	`High`	`Informational`
`Medium`

next_token query · string

String to get next page of results, is associated with a previous execution of GetBehaviorDetections. Must include all filters from previous execution.

limit query · integer

The maximum records to return. [1-500]

resource_id query · string or list of strings

Resource ID

resource_uuid query · string or list of strings

Resource UUID

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_behavior_detections(account_id="string",
                                          aws_account_id="string",
                                          azure_subscription_id="string",
                                          azure_tenant_id="string",
                                          cloud_provider="string",
                                          date_time_since="string",
                                          limit=integer,
                                          next_token="string",
                                          resource_id=id_list,
                                          resource_uuid=id_list,
                                          service="string",
                                          severity="string",
                                          since="string",
                                          state="string")
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetBehaviorDetections(account_id="string",
                                        aws_account_id="string",
                                        azure_subscription_id="string",
                                        azure_tenant_id="string",
                                        cloud_provider="string",
                                        date_time_since="string",
                                        limit=integer,
                                        next_token="string",
                                        resource_id=id_list,
                                        resource_uuid=id_list,
                                        service="string",
                                        severity="string",
                                        since="string",
                                        state="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetBehaviorDetections",
                          cloud_provider="string",
                          service="string",
                          account_id="string",
                          aws_account_id="string",
                          azure_subscription_id="string",
                          azure_tenant_id="string",
                          state="string",
                          date_time_since="string",
                          since="string",
                          severity="string",
                          next_token="string",
                          limit=integer,
                          resource_id=id_list,
                          resource_uuid=id_list)
print(response)

Get-FalconCloudIoa -CloudPlatform "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cloudProvider := "string"
  service := "string"
  accountID := "string"
  awsAccountID := "string"
  azureSubscriptionID := "string"
  azureTenantID := "string"
  state := "string"
  dateTimeSince := "string"
  since := "string"
  severity := "string"
  nextToken := "string"
  limit := int64(0)

  response, err := client.CspmRegistration.GetBehaviorDetections(
    &cspm_registration.GetBehaviorDetectionsParams{
      CloudProvider: &cloudProvider,
      Service: &service,
      AccountID: &accountID,
      AwsAccountID: &awsAccountID,
      AzureSubscriptionID: &azureSubscriptionID,
      AzureTenantID: &azureTenantID,
      State: &state,
      DateTimeSince: &dateTimeSince,
      Since: &since,
      Severity: &severity,
      NextToken: &nextToken,
      Limit: &limit,
      ResourceID: []string{"ID1", "ID2", "ID3"},
      ResourceUUID: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.getBehaviorDetections(
  "string",  // cloudProvider
  "string",  // service
  "string",  // accountId
  "string",  // awsAccountId
  "string",  // azureSubscriptionId
  "string",  // azureTenantId
  "string",  // state
  "string",  // dateTimeSince
  "string",  // since
  "string",  // severity
  "string",  // nextToken
  integer,  // limit
  ["ID1", "ID2", "ID3"],  // resourceId
  ["ID1", "ID2", "ID3"]  // resourceUuid
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::get_behavior_detections;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_behavior_detections(
        &falcon.cfg,  // configuration
        Some("string"),  // cloud_provider
        Some("string"),  // service
        Some("string"),  // account_id
        Some("string"),  // aws_account_id
        Some("string"),  // azure_subscription_id
        Some("string"),  // azure_tenant_id
        Some("string"),  // state
        Some("string"),  // date_time_since
        Some("string"),  // since
        Some("string"),  // severity
        Some("string"),  // next_token
        Some(integer),  // limit
        Some(vec!["string".to_string()]),  // resource_id
        Some(vec!["string".to_string()]),  // resource_uuid
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

response = api.get_behavior_detections(cloud_provider: 'string',
                                       service: 'string',
                                       account_id: 'string',
                                       aws_account_id: 'string',
                                       azure_subscription_id: 'string',
                                       azure_tenant_id: 'string',
                                       state: 'string',
                                       date_time_since: 'string',
                                       since: 'string',
                                       severity: 'string',
                                       next_token: 'string',
                                       limit: integer,
                                       resource_id: ['ID1', 'ID2', 'ID3'],
                                       resource_uuid: ['ID1', 'ID2', 'ID3'])

puts response

Responses

{
  "confidence": "string",
  "events": [],
  "max_score": 0
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "MetaInfo": {
      "pagination": {},
      "powered_by": "string",
      "query_time": 0.0,
      "trace_id": "string",
      "writes": {}
    },
    "pagination": {
      "Paging": {},
      "next_token": "string"
    }
  },
  "resources": {
    "confidence": "string",
    "events": [],
    "max_score": 0
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "MetaInfo": {
      "pagination": {},
      "powered_by": "string",
      "query_time": 0.0,
      "trace_id": "string",
      "writes": {}
    },
    "pagination": {
      "Paging": {},
      "next_token": "string"
    }
  },
  "resources": {
    "confidence": "string",
    "events": [],
    "max_score": 0
  }
}

getCloudEventIDs

Deprecated: use cdrapi entities/event-details/v1 ‘logscale_related_events_query’ instead.

Method GET

Route /detects/queries/cloud-events/v1

Scope CSPM registration: READ

PEP 8 get_cloud_event_ids

Parameters

id query · string

IOA Aggregate Event ID

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.get_cloud_event_ids(id="string")
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.getCloudEventIDs(id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("getCloudEventIDs",
                          id="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CspmRegistration.GetCloudEventIDs(
    &cspm_registration.GetCloudEventIDsParams{
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.getCloudEventIDs("string");  // id

console.log(response);

use rusty_falcon::apis::cspm_registration_api::get_cloud_event_ids;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_cloud_event_ids(
        &falcon.cfg,  // configuration
        "string",  // x_cs_useruuid
        "string",  // id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

response = api.get_cloud_event_ids('string', 'string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

GetConfigurationDetectionEntities

Get misconfigurations based on the ID - including custom policy detections in addition to default policy detections.

Method GET

Route /detects/entities/iom/v2

Scope CSPM registration: READ

PEP 8 get_configuration_detection_entities

Parameters

ids query · string or list of strings

detection ids

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_configuration_detection_entities(ids=id_list)
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetConfigurationDetectionEntities(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetConfigurationDetectionEntities",
                          ids=id_list)
print(response)

Get-FalconCloudIom -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CspmRegistration.GetConfigurationDetectionEntities(
    &cspm_registration.GetConfigurationDetectionEntitiesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.getConfigurationDetectionEntities(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::cspm_registration_api::get_configuration_detection_entities;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_configuration_detection_entities(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

response = api.get_configuration_detection_entities(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "account_id": "string",
    "account_name": "string",
    "agent_id": "string",
    "azure_tenant_id": "string",
    "cid": "string",
    "cloud_groups_v2": [],
    "cloud_labels": [],
    "cloud_provider": "string",
    "cloud_scopes": [],
    "custom_policy_id": 0,
    "finding": {},
    "findings": [],
    "groups": [],
    "id": "string",
    "is_managed": false,
    "policy_id": 0,
    "policy_statement": "string",
    "policy_type": "string",
    "region": "string",
    "report_date_time": "string",
    "resource_attributes": {},
    "resource_create_time": "string",
    "resource_id": "string",
    "resource_id_type": "string",
    "resource_url": "string",
    "resource_uuid": "string",
    "scan_id": "string",
    "scan_time": "string",
    "service": "string",
    "severity": "string",
    "status": "string",
    "tags": {},
    "vm_id": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

GetConfigurationDetectionIDsV2

Get list of active misconfiguration ids - including custom policy detections in addition to default policy detections.

Method GET

Route /detects/queries/iom/v2

Scope CSPM registration: READ

PEP 8 get_configuration_detection_ids_v2

Parameters

filter query · string

use_current_scan_ids - *use this to get records for latest scans (ignored when next_token is set)* account_name account_id agent_id attack_types azure_subscription_id cloud_provider cloud_service_keyword custom_policy_id is_managed policy_id policy_type resource_id region status scan_time severity severity_string

Available values (6)

`this`	`to`	`get`
`records`	`for`	`latest`

sort query · string

The property to sort by (e.g. timestamp|desc or policy_id|asc) Default: timestamp|desc Available fields:

Available values (16)

`account_name`	`account_id`	`attack_types`
`azure_subscription_id`	`cloud_provider`	`cloud_service_keyword`
`status`	`is_managed`	`policy_id`
`policy_type`	`resource_id`	`region`
`scan_time`	`severity`	`severity_string`
`timestamp`

limit query · integer

The max number of detections to return

offset query · integer

Offset returned detections. Cannot be combined with next_token filter

next_token query · string

String to get next page of results. Cannot be combined with any filter except limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.get_configuration_detection_ids_v2(filter="string",
                                                     limit=integer,
                                                     next_token="string",
                                                     offset=integer,
                                                     sort="string")
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.GetConfigurationDetectionIDsV2(filter="string",
                                                 limit=integer,
                                                 next_token="string",
                                                 offset=integer,
                                                 sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetConfigurationDetectionIDsV2",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer,
                          next_token="string")
print(response)

Get-FalconCloudIom -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)
  nextToken := "string"

  response, err := client.CspmRegistration.GetConfigurationDetectionIDsV2(
    &cspm_registration.GetConfigurationDetectionIDsV2Params{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      NextToken: &nextToken,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.getConfigurationDetectionIDsV2(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer,  // offset
  "string"  // nextToken
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::get_configuration_detection_ids_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_configuration_detection_ids_v2(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
        Some("string"),  // next_token
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

response = api.get_configuration_detection_ids_v2(filter: 'string',
                                                  sort: 'string',
                                                  limit: integer,
                                                  offset: integer,
                                                  next_token: 'string')

puts response

Responses

[
  "string"
]

{
  "pagination": {
    "limit": 0,
    "offset": 0,
    "total": 0
  },
  "powered_by": "string",
  "query_time": 0.0,
  "trace_id": "string",
  "writes": {
    "resources_affected": 0
  }
}

{
  "pagination": {
    "limit": 0,
    "offset": 0,
    "total": 0
  },
  "powered_by": "string",
  "query_time": 0.0,
  "trace_id": "string",
  "writes": {
    "resources_affected": 0
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "pagination": {
    "limit": 0,
    "offset": 0,
    "total": 0
  },
  "powered_by": "string",
  "query_time": 0.0,
  "trace_id": "string",
  "writes": {
    "resources_affected": 0
  }
}

GetConfigurationDetections

Get list of active misconfigurations.

Method GET

Route /detects/entities/iom/v1

Scope CSPM registration: READ

PEP 8 get_configuration_detections

Parameters

cloud_provider query · string

Cloud Provider (e.g.: aws|azure|gcp)

Available values (3)

aws azure gcp

account_id query · string

AWS account ID or GCP Project Number or Azure subscription ID

azure_subscription_id query · string

Azure Subscription ID

azure_tenant_id query · string

Azure Tenant ID

status query · string

Status (e.g.: new|reoccurring|all)

Available values (3)

all new reoccurring

region query · string

Cloud Provider Region

severity query · string

Policy Severity

Available values (4)

`Critical`	`High`	`Informational`
`Medium`

service query · string

Cloud Service (e.g.: EBS|EC2|S3 etc.)

Available values (54)

`ACM`	`ACR`	`Any`
`App Engine`	`AppService`	`BigQuery`
`Cloud Load Balancing`	`Cloud Logging`	`Cloud SQL`
`Cloud Storage`	`CloudFormation`	`CloudTrail`
`CloudWatch Logs`	`Cloudfront`	`Compute Engine`
`Config`	`Disk`	`DynamoDB`
`EBS`	`EC2`	`ECR`
`EFS`	`EKS`	`ELB`
`EMR`	`Elasticache`	`GuardDuty`
`IAM`	`Identity`	`KMS`
`KeyVault`	`Kinesis`	`Kubernetes`
`Lambda`	`LoadBalancer`	`Monitor`
`NLB/ALB`	`NetworkSecurityGroup`	`PostgreSQL`
`RDS`	`Redshift`	`S3`
`SES`	`SNS`	`SQLDatabase`
`SQLServer`	`SQS`	`SSM`
`Serverless Application Repository`	`StorageAccount`	`Subscriptions`
`VPC`	`VirtualMachine`	`VirtualNetwork`

next_token query · string

String to get next page of results, is associated with a previous execution of GetConfigurationDetections. Cannot be combined with any filter except limit.

limit query · integer

The maximum records to return. [1-500]

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

aws_account_id body · string

AWS account ID.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.get_configuration_detections(account_id="string",
                                               aws_account_id="string",
                                               azure_subscription_id="string",
                                               azure_tenant_id="string",
                                               cloud_provider="string",
                                               limit=integer,
                                               next_token="string",
                                               region="string",
                                               service="string",
                                               severity="string",
                                               status="string")
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.GetConfigurationDetections(account_id="string",
                                             aws_account_id="string",
                                             azure_subscription_id="string",
                                             azure_tenant_id="string",
                                             cloud_provider="string",
                                             limit=integer,
                                             next_token="string",
                                             region="string",
                                             service="string",
                                             severity="string",
                                             status="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetConfigurationDetections",
                          cloud_provider="string",
                          account_id="string",
                          azure_subscription_id="string",
                          azure_tenant_id="string",
                          status="string",
                          region="string",
                          severity="string",
                          service="string",
                          next_token="string",
                          limit=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cloudProvider := "string"
  accountID := "string"
  azureSubscriptionID := "string"
  azureTenantID := "string"
  status := "string"
  region := "string"
  severity := "string"
  service := "string"
  nextToken := "string"
  limit := int64(0)

  response, err := client.CspmRegistration.GetConfigurationDetections(
    &cspm_registration.GetConfigurationDetectionsParams{
      CloudProvider: &cloudProvider,
      AccountID: &accountID,
      AzureSubscriptionID: &azureSubscriptionID,
      AzureTenantID: &azureTenantID,
      Status: &status,
      Region: &region,
      Severity: &severity,
      Service: &service,
      NextToken: &nextToken,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.getConfigurationDetections(
  "string",  // cloudProvider
  "string",  // accountId
  "string",  // azureSubscriptionId
  "string",  // azureTenantId
  "string",  // status
  "string",  // region
  "string",  // severity
  "string",  // service
  "string",  // nextToken
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::get_configuration_detections;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_configuration_detections(
        &falcon.cfg,  // configuration
        Some("string"),  // cloud_provider
        Some("string"),  // account_id
        Some("string"),  // azure_subscription_id
        Some("string"),  // azure_tenant_id
        Some("string"),  // status
        Some("string"),  // region
        Some("string"),  // severity
        Some("string"),  // service
        Some("string"),  // next_token
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

response = api.get_configuration_detections(cloud_provider: 'string',
                                            account_id: 'string',
                                            azure_subscription_id: 'string',
                                            azure_tenant_id: 'string',
                                            status: 'string',
                                            region: 'string',
                                            severity: 'string',
                                            service: 'string',
                                            next_token: 'string',
                                            limit: integer)

puts response

Responses

{
  "events": []
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "MetaInfo": {
      "pagination": {},
      "powered_by": "string",
      "query_time": 0.0,
      "trace_id": "string",
      "writes": {}
    },
    "pagination": {
      "Paging": {},
      "next_token": "string"
    }
  },
  "resources": {
    "events": []
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

GetCSPMAwsAccount

Returns information about the current status of an AWS account.

Method GET

Route /cloud-connect-cspm-aws/entities/account/v1

Scope CSPM registration: READ

PEP 8 get_aws_account

Parameters

scan-type query · string

Type of scan, dry or full, to perform on selected accounts

Available values (2)

dry full

ids query · string or list of strings

AWS account IDs

iam_role_arns query · string or list of strings

AWS IAM role ARNs

organization-ids query · string or list of strings

AWS organization IDs

status query · string

Account status to filter results by.

Available values (2)

provisioned operational

limit query · integer

The maximum records to return. Defaults to 100.

cspm_lite query · string

Only return CSPM Lite accounts

Available values (2)

true false

migrated query · string

Only return migrated d4c accounts

Available values (2)

true false

offset query · integer

The offset to start retrieving records from

group_by query · string

Field to group by.

Available values (1)

organization

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

scan_type body · string

Type of scan, dry or full, to perform on selected accounts

organization_ids body · string or list of strings

AWS organization IDs.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_aws_account(scan_type="string",
                                  cspm_lite="string",
                                  ids=id_list,
                                  iam_role_arns=id_list,
                                  organization_ids=id_list,
                                  limit=integer,
                                  migrated="string",
                                  offset=integer,
                                  status="string",
                                  group_by="string")
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetCSPMAwsAccount(scan_type="string",
                                    cspm_lite="string",
                                    ids=id_list,
                                    iam_role_arns=id_list,
                                    organization_ids=id_list,
                                    limit=integer,
                                    migrated="string",
                                    offset=integer,
                                    status="string",
                                    group_by="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetCSPMAwsAccount",
                          scan_type="string",
                          ids=id_list,
                          iam_role_arns=id_list,
                          organization_ids=id_list,
                          status="string",
                          limit=integer,
                          cspm_lite="string",
                          migrated="string",
                          offset=integer,
                          group_by="string")
print(response)

Get-FalconCloudAwsAccount

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  status := "string"
  limit := int64(0)
  cspmLite := "string"
  migrated := "string"
  offset := int64(0)
  groupBy := "string"

  response, err := client.CspmRegistration.GetCSPMAwsAccount(
    &cspm_registration.GetCSPMAwsAccountParams{
      ScanType: "string",
      Ids: []string{"ID1", "ID2", "ID3"},
      IamRoleArns: []string{"ID1", "ID2", "ID3"},
      OrganizationIds: []string{"ID1", "ID2", "ID3"},
      Status: &status,
      Limit: &limit,
      CspmLite: &cspmLite,
      Migrated: &migrated,
      Offset: &offset,
      GroupBy: &groupBy,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.getCSPMAwsAccount(
  "string",  // scanType
  ["ID1", "ID2", "ID3"],  // ids
  ["ID1", "ID2", "ID3"],  // iamRoleArns
  ["ID1", "ID2", "ID3"],  // organizationIds
  "string",  // status
  integer,  // limit
  "string",  // cspmLite
  "string",  // migrated
  integer,  // offset
  "string"  // groupBy
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::get_cspm_aws_account;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_cspm_aws_account(
        &falcon.cfg,  // configuration
        Some("string"),  // scan_type
        Some(vec!["string".to_string()]),  // ids
        Some(vec!["string".to_string()]),  // iam_role_arns
        Some(vec!["string".to_string()]),  // organization_ids
        Some("string"),  // status
        Some(integer),  // limit
        Some("string"),  // cspm_lite
        Some("string"),  // migrated
        Some(integer),  // offset
        Some("string"),  // group_by
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

response = api.get_cspm_aws_account(scan_type: 'string',
                                    ids: ['ID1', 'ID2', 'ID3'],
                                    iam_role_arns: ['ID1', 'ID2', 'ID3'],
                                    organization_ids: ['ID1', 'ID2', 'ID3'],
                                    status: 'string',
                                    limit: integer,
                                    cspm_lite: 'string',
                                    migrated: 'string',
                                    offset: integer,
                                    group_by: 'string')

puts response

Responses

[
  {
    "CreatedAt": "string",
    "DeletedAt": "string",
    "ID": 0,
    "UpdatedAt": "string",
    "account_id": "string",
    "account_name": "string",
    "account_type": "string",
    "active_regions": [],
    "aws_cloudtrail_bucket_name": "string",
    "aws_cloudtrail_region": "string",
    "aws_eventbus_arn": "string",
    "aws_permissions_status": [],
    "behavior_assessment_enabled": false,
    "cid": "string",
    "cloud_registration_enabled": false,
    "cloud_scopes": [],
    "cloudformation_root_stack_arn": "string",
    "cloudformation_update_url": "string",
    "cloudformation_url": "string",
    "conditions": [],
    "cspm_enabled": false,
    "d4c": {},
    "d4c_migrated": false,
    "dspm_enabled": false,
    "dspm_host_account_id": "string",
    "dspm_role_arn": "string",
    "environment": "string",
    "eventbus_name": "string",
    "external_id": "string",
    "falcon_client_id": "string",
    "features": [],
    "iam_role_arn": "string",
    "intermediate_role_arn": "string",
    "inventory_filter": [],
    "is_cloud_registration": false,
    "is_cspm_lite": false,
    "is_custom_rolename": false,
    "is_delegated_admin": false,
    "is_master": false,
    "ngsiem_enabled": false,
    "organization_id": "string",
    "remediation_cloudformation_url": "string",
    "remediation_region": "string",
    "remediation_tou_accepted": "string",
    "resource_name_prefix": "string",
    "resource_name_suffix": "string",
    "root_account_id": "string",
    "root_iam_role": false,
    "s3_url": "string",
    "secondary_role_arn": "string",
    "sensor_management_enabled": false,
    "settings": {},
    "status": "string",
    "target_ous": [],
    "template_source_region": "string",
    "use_existing_cloudtrail": false,
    "valid": false,
    "vulnerability_scanning_enabled": false,
    "vulnerability_scanning_host_account_id": "string",
    "vulnerability_scanning_role_arn": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_id": "string",
      "account_name": "string",
      "account_type": "string",
      "active_regions": [],
      "aws_cloudtrail_bucket_name": "string",
      "aws_cloudtrail_region": "string",
      "aws_eventbus_arn": "string",
      "aws_permissions_status": [],
      "behavior_assessment_enabled": false,
      "cid": "string",
      "cloud_registration_enabled": false,
      "cloud_scopes": [],
      "cloudformation_root_stack_arn": "string",
      "cloudformation_update_url": "string",
      "cloudformation_url": "string",
      "conditions": [],
      "cspm_enabled": false,
      "d4c": {},
      "d4c_migrated": false,
      "dspm_enabled": false,
      "dspm_host_account_id": "string",
      "dspm_role_arn": "string",
      "environment": "string",
      "eventbus_name": "string",
      "external_id": "string",
      "falcon_client_id": "string",
      "features": [],
      "iam_role_arn": "string",
      "intermediate_role_arn": "string",
      "inventory_filter": [],
      "is_cloud_registration": false,
      "is_cspm_lite": false,
      "is_custom_rolename": false,
      "is_delegated_admin": false,
      "is_master": false,
      "ngsiem_enabled": false,
      "organization_id": "string",
      "remediation_cloudformation_url": "string",
      "remediation_region": "string",
      "remediation_tou_accepted": "string",
      "resource_name_prefix": "string",
      "resource_name_suffix": "string",
      "root_account_id": "string",
      "root_iam_role": false,
      "s3_url": "string",
      "secondary_role_arn": "string",
      "sensor_management_enabled": false,
      "settings": {},
      "status": "string",
      "target_ous": [],
      "template_source_region": "string",
      "use_existing_cloudtrail": false,
      "valid": false,
      "vulnerability_scanning_enabled": false,
      "vulnerability_scanning_host_account_id": "string",
      "vulnerability_scanning_role_arn": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

GetCSPMAwsAccountScriptsAttachment

Return a script for customer to run in their cloud environment to grant us access to their AWS environment as a downloadable attachment.

Method GET

Route /cloud-connect-cspm-aws/entities/user-scripts-download/v1

PEP 8 get_aws_account_scripts_attachment

Parameters

ids query · string or list of strings

AWS account IDs

template query · string

Template to be rendered

Available values (2)

aws-bash aws-terraform

account_type query · string

Type of account, it can be commercial or gov

Available values (2)

commercial gov

accounts query · string or list of strings

The list of accounts to register, values should be in the form: account,profile

behavior_assessment_enabled query · string

Enable behavior assessment. Allowed values:

Available values (2)

true false

sensor_management_enabled query · string

Enable sensor management. Allowed values:

Available values (2)

true false

dspm_enabled query · string

Flag indicating if DSPM is enabled. Allowed values:

Available values (2)

true false

dspm_regions query · string or list of strings

List of DSPM regions. Comma delimited.

dspm_role query · string

DSPM role.

use_existing_cloudtrail query · string

Use the existing cloudtrail log. Allowed values:

Available values (2)

true false

organization_id query · string

The AWS organization ID to be registered

aws_profile query · string

The AWS profile to be used during registration

custom_role_name query · string

The custom IAM role to be used during registration

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_aws_account_scripts_attachment(account_type="string",
                                                     accounts=id_list,
                                                     aws_profile="string",
                                                     behavior_assessment_enabled="string",
                                                     custom_role_name="string",
                                                     dspm_enabled="string",
                                                     dspm_regions=id_list,
                                                     dspm_role="string",
                                                     ids=id_list,
                                                     organization_id="string",
                                                     sensor_management_enabled="string",
                                                     template="string",
                                                     use_existing_cloudtrail="string")
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetCSPMAwsAccountScriptsAttachment(account_type="string",
                                                     accounts=id_list,
                                                     aws_profile="string",
                                                     behavior_assessment_enabled="string",
                                                     custom_role_name="string",
                                                     dspm_enabled="string",
                                                     dspm_regions=id_list,
                                                     dspm_role="string",
                                                     ids=id_list,
                                                     organization_id="string",
                                                     sensor_management_enabled="string",
                                                     template="string",
                                                     use_existing_cloudtrail="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetCSPMAwsAccountScriptsAttachment",
                          ids=id_list,
                          template="string",
                          account_type="string",
                          accounts=id_list,
                          behavior_assessment_enabled="string",
                          sensor_management_enabled="string",
                          dspm_enabled="string",
                          dspm_regions=id_list,
                          dspm_role="string",
                          use_existing_cloudtrail="string",
                          organization_id="string",
                          aws_profile="string",
                          custom_role_name="string")
print(response)

Receive-FalconCloudAwsScript -Path "string"

GetCSPMAwsConsoleSetupURLs

Return a URL for customer to visit in their cloud environment to grant us access to their AWS environment.

Method GET

Route /cloud-connect-cspm-aws/entities/console-setup-urls/v1

Scope CSPM registration: READ

PEP 8 get_aws_console_setup_urls

Parameters

ids query · string or list of strings

AWS account IDs

use_existing_cloudtrail query · string

Use the existing AWS cloudtrail. (true / false)

Available values (2)

true false

region query · string

Region

tags query · string

Base64 encoded JSON string to be used as AWS tags

template query · string

Template to be rendered

Available values (8)

`aws-url`	`aws-iom-url`	`aws-ioa-url`
`aws-sensor-management-url`	`aws-dspm-url`	`aws-idp-url`
`aws-modular-cft-url`	`aws-modular-cft-gov-commercial-url`

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_aws_console_setup_urls(ids=id_list,
                                             use_existing_cloudtrail="string",
                                             region="string",
                                             tags="string",
                                             template="string")
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetCSPMAwsConsoleSetupURLs(ids=id_list,
                                             use_existing_cloudtrail="string",
                                             region="string",
                                             tags="string",
                                             template="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetCSPMAwsConsoleSetupURLs",
                          ids=id_list,
                          use_existing_cloudtrail="string",
                          region="string",
                          tags="string",
                          template="string")
print(response)

Get-FalconCloudAwsLink

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  useExistingCloudtrail := "string"
  region := "string"
  tags := "string"
  template := "string"

  response, err := client.CspmRegistration.GetCSPMAwsConsoleSetupURLs(
    &cspm_registration.GetCSPMAwsConsoleSetupURLsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      UseExistingCloudtrail: &useExistingCloudtrail,
      Region: &region,
      Tags: &tags,
      Template: &template,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.getCSPMAwsConsoleSetupURLs(
  ["ID1", "ID2", "ID3"],  // ids
  "string",  // useExistingCloudtrail
  "string",  // region
  "string",  // tags
  "string"  // template
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::get_cspm_aws_console_setup_urls;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_cspm_aws_console_setup_urls(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
        Some("string"),  // use_existing_cloudtrail
        Some("string"),  // region
        Some("string"),  // tags
        Some("string"),  // template
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

response = api.get_cspm_aws_console_setup_urls(ids: ['ID1', 'ID2', 'ID3'],
                                               use_existing_cloudtrail: 'string',
                                               region: 'string',
                                               tags: 'string',
                                               template: 'string')

puts response

Responses

[
  {
    "account_id": "string",
    "url": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "account_id": "string",
      "url": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

GetCSPMAzureAccount

Return information about Azure account registration

Method GET

Route /cloud-connect-cspm-azure/entities/account/v1

Scope CSPM registration: READ

PEP 8 get_azure_account

Parameters

ids query · string or list of strings

SubscriptionIDs of accounts to select for this status operation. If this is empty then all accounts are returned.

tenant_ids query · string or list of strings

Tenant ids to filter azure accounts

scan-type query · string

Type of scan, dry or full, to perform on selected accounts

status query · string

Account status to filter results by.

Available values (2)

Event_DiscoverAccountStatusProvisioned Event_DiscoverAccountStatusOperational

cspm_lite query · string

Only return CSPM Lite accounts

Available values (2)

false true

limit query · integer

The maximum records to return. Defaults to 100.

offset query · integer

The offset to start retrieving records from

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

scan_type body · string

Type of scan, dry or full, to perform on selected accounts

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_azure_account(scan_type="string",
                                    cspm_lite="string",
                                    ids=id_list,
                                    limit=integer,
                                    offset=integer,
                                    status="string",
                                    tenant_ids=id_list)
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetCSPMAzureAccount(scan_type="string",
                                      cspm_lite="string",
                                      ids=id_list,
                                      limit=integer,
                                      offset=integer,
                                      status="string",
                                      tenant_ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetCSPMAzureAccount",
                          ids=id_list,
                          tenant_ids=id_list,
                          scan_type="string",
                          status="string",
                          cspm_lite="string",
                          limit=integer,
                          offset=integer)
print(response)

Get-FalconCloudAzureAccount

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  status := "string"
  cspmLite := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.CspmRegistration.GetCSPMAzureAccount(
    &cspm_registration.GetCSPMAzureAccountParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      TenantIds: []string{"ID1", "ID2", "ID3"},
      ScanType: "string",
      Status: &status,
      CspmLite: &cspmLite,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.getCSPMAzureAccount(
  ["ID1", "ID2", "ID3"],  // ids
  ["ID1", "ID2", "ID3"],  // tenantIds
  "string",  // scanType
  "string",  // status
  "string",  // cspmLite
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::get_cspm_azure_account;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_cspm_azure_account(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
        Some(vec!["string".to_string()]),  // tenant_ids
        Some("string"),  // scan_type
        Some("string"),  // status
        Some("string"),  // cspm_lite
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

response = api.get_cspm_azure_account(ids: ['ID1', 'ID2', 'ID3'],
                                      tenant_ids: ['ID1', 'ID2', 'ID3'],
                                      scan_type: 'string',
                                      status: 'string',
                                      cspm_lite: 'string',
                                      limit: integer,
                                      offset: integer)

puts response

Responses

[
  {
    "CreatedAt": "string",
    "DeletedAt": "string",
    "ID": 0,
    "UpdatedAt": "string",
    "account_type": "string",
    "azure_permissions_status": [],
    "cid": "string",
    "client_id": "string",
    "cloud_scopes": [],
    "conditions": [],
    "credentials_end_date": "string",
    "credentials_type": "string",
    "default_subscription_id": "string",
    "environment": "string",
    "ioa_status": "string",
    "iom_status": "string",
    "is_cspm_lite": false,
    "object_id": "string",
    "parent_management_group_id": "string",
    "parent_management_group_name": "string",
    "primary_domain": "string",
    "public_certificate": "string",
    "public_certificate_raw": "string",
    "role_assignments": [],
    "show_modal": false,
    "status": "string",
    "subscription_id": "string",
    "subscription_name": "string",
    "tenant_id": "string",
    "tenant_name": "string",
    "years_valid": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_type": "string",
      "azure_permissions_status": [],
      "cid": "string",
      "client_id": "string",
      "cloud_scopes": [],
      "conditions": [],
      "credentials_end_date": "string",
      "credentials_type": "string",
      "default_subscription_id": "string",
      "environment": "string",
      "ioa_status": "string",
      "iom_status": "string",
      "is_cspm_lite": false,
      "object_id": "string",
      "parent_management_group_id": "string",
      "parent_management_group_name": "string",
      "primary_domain": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "role_assignments": [],
      "show_modal": false,
      "status": "string",
      "subscription_id": "string",
      "subscription_name": "string",
      "tenant_id": "string",
      "tenant_name": "string",
      "years_valid": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_type": "string",
      "azure_permissions_status": [],
      "cid": "string",
      "client_id": "string",
      "cloud_scopes": [],
      "conditions": [],
      "credentials_end_date": "string",
      "credentials_type": "string",
      "default_subscription_id": "string",
      "environment": "string",
      "ioa_status": "string",
      "iom_status": "string",
      "is_cspm_lite": false,
      "object_id": "string",
      "parent_management_group_id": "string",
      "parent_management_group_name": "string",
      "primary_domain": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "role_assignments": [],
      "show_modal": false,
      "status": "string",
      "subscription_id": "string",
      "subscription_name": "string",
      "tenant_id": "string",
      "tenant_name": "string",
      "years_valid": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_type": "string",
      "azure_permissions_status": [],
      "cid": "string",
      "client_id": "string",
      "cloud_scopes": [],
      "conditions": [],
      "credentials_end_date": "string",
      "credentials_type": "string",
      "default_subscription_id": "string",
      "environment": "string",
      "ioa_status": "string",
      "iom_status": "string",
      "is_cspm_lite": false,
      "object_id": "string",
      "parent_management_group_id": "string",
      "parent_management_group_name": "string",
      "primary_domain": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "role_assignments": [],
      "show_modal": false,
      "status": "string",
      "subscription_id": "string",
      "subscription_name": "string",
      "tenant_id": "string",
      "tenant_name": "string",
      "years_valid": 0
    }
  ]
}

GetCSPMAzureManagementGroup

Return information about Azure management group registration

Method GET

Route /cloud-connect-cspm-azure/entities/management-group/v1

Scope CSPM registration: READ

PEP 8 get_azure_management_group

Parameters

tenant_ids query · string or list of strings

Tenant ids to filter azure accounts

limit query · integer

The maximum records to return. Defaults to 100.

offset query · integer

The offset to start retrieving records from

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_azure_management_group(limit=integer,
                                             offset=integer,
                                             tenant_ids=id_list)
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetCSPMAzureManagementGroup(limit=integer,
                                              offset=integer,
                                              tenant_ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetCSPMAzureManagementGroup",
                          tenant_ids=id_list,
                          limit=integer,
                          offset=integer)
print(response)

Get-FalconCloudAzureGroup

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)

  response, err := client.CspmRegistration.GetCSPMAzureManagementGroup(
    &cspm_registration.GetCSPMAzureManagementGroupParams{
      TenantIds: []string{"ID1", "ID2", "ID3"},
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.getCSPMAzureManagementGroup(
  ["ID1", "ID2", "ID3"],  // tenantIds
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::get_cspm_azure_management_group;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_cspm_azure_management_group(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // tenant_ids
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

response = api.get_cspm_azure_management_group(tenant_ids: ['ID1', 'ID2', 'ID3'],
                                               limit: integer,
                                               offset: integer)

puts response

Responses

[
  {
    "CreatedAt": "string",
    "DeletedAt": "string",
    "ID": 0,
    "UpdatedAt": "string",
    "azure_management_group_id": "string",
    "azure_management_group_name": "string",
    "azure_permissions_status": [],
    "cid": "string",
    "client_id": "string",
    "conditions": [],
    "credentials_end_date": "string",
    "credentials_type": "string",
    "default_subscription_id": "string",
    "object_id": "string",
    "public_certificate": "string",
    "public_certificate_raw": "string",
    "role_assignments": [],
    "status": "string",
    "tenant_id": "string",
    "years_valid": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "azure_management_group_id": "string",
      "azure_management_group_name": "string",
      "azure_permissions_status": [],
      "cid": "string",
      "client_id": "string",
      "conditions": [],
      "credentials_end_date": "string",
      "credentials_type": "string",
      "default_subscription_id": "string",
      "object_id": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "role_assignments": [],
      "status": "string",
      "tenant_id": "string",
      "years_valid": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "azure_management_group_id": "string",
      "azure_management_group_name": "string",
      "azure_permissions_status": [],
      "cid": "string",
      "client_id": "string",
      "conditions": [],
      "credentials_end_date": "string",
      "credentials_type": "string",
      "default_subscription_id": "string",
      "object_id": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "role_assignments": [],
      "status": "string",
      "tenant_id": "string",
      "years_valid": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "azure_management_group_id": "string",
      "azure_management_group_name": "string",
      "azure_permissions_status": [],
      "cid": "string",
      "client_id": "string",
      "conditions": [],
      "credentials_end_date": "string",
      "credentials_type": "string",
      "default_subscription_id": "string",
      "object_id": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "role_assignments": [],
      "status": "string",
      "tenant_id": "string",
      "years_valid": 0
    }
  ]
}

GetCSPMAzureUserScriptsAttachment

Return a script for customer to run in their cloud environment to grant us access to their Azure environment as a downloadable attachment

Method GET

Route /cloud-connect-cspm-azure/entities/user-scripts-download/v1

Scope CSPM registration: READ

PEP 8 get_azure_user_scripts_attachment

Parameters

tenant-id query · string

Tenant ID to generate script for. Defaults to most recently registered tenant.

subscription_ids query · string or list of strings

Subscription IDs to generate script for. Defaults to all.

account_type query · string

Account type. (‘commercial’ or ‘gov’)

Available values (2)

commercial gov

template query · string

Template to be rendered

azure_management_group query · boolean

Use Azure Management Group

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

tenant_id body · string

Azure Tenant ID to generate script for. Defaults to the most recently registered tenant.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.get_azure_user_scripts_attachment(account_type="string",
                                                        azure_management_group=boolean,
                                                        tenant_id="string",
                                                        subscription_ids=id_list,
                                                        template="string",
                                                        stream=boolean)
    save_file.write(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.GetCSPMAzureUserScriptsAttachment(account_type="string",
                                                        azure_management_group=boolean,
                                                        tenant_id="string",
                                                        subscription_ids=id_list,
                                                        template="string",
                                                        stream=boolean)
    save_file.write(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.command("GetCSPMAzureUserScriptsAttachment",
                              tenant_id="string",
                              subscription_ids=id_list,
                              account_type="string",
                              template="string",
                              azure_management_group=boolean)
    save_file.write(response)

Receive-FalconCloudAzureScript -Path "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  accountType := "string"
  template := "string"
  azureManagementGroup := boolean

  response, err := client.CspmRegistration.GetCSPMAzureUserScriptsAttachment(
    &cspm_registration.GetCSPMAzureUserScriptsAttachmentParams{
      TenantID: "string",
      SubscriptionIds: []string{"ID1", "ID2", "ID3"},
      AccountType: &accountType,
      Template: &template,
      AzureManagementGroup: &azureManagementGroup,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.getCSPMAzureUserScriptsAttachment(
  "string",  // tenantId
  ["ID1", "ID2", "ID3"],  // subscriptionIds
  "string",  // accountType
  "string",  // template
  boolean  // azureManagementGroup
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::get_cspm_azure_user_scripts_attachment;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_cspm_azure_user_scripts_attachment(
        &falcon.cfg,  // configuration
        Some("string"),  // tenant_id
        Some(vec!["string".to_string()]),  // subscription_ids
        Some("string"),  // account_type
        Some("string"),  // template
        Some(boolean),  // azure_management_group
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

response = api.get_cspm_azure_user_scripts_attachment(tenant_id: 'string',
                                                      subscription_ids: ['ID1', 'ID2', 'ID3'],
                                                      account_type: 'string',
                                                      template: 'string',
                                                      azure_management_group: boolean)

puts response

Responses

[
  {
    "bash": "string",
    "service_account_public_keys": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "bash": "string",
      "service_account_public_keys": []
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "bash": "string",
      "service_account_public_keys": []
    }
  ]
}

GetCSPMGCPAccount

Returns information about the current status of an GCP account.

Method GET

Route /cloud-connect-cspm-gcp/entities/account/v1

Scope CSPM registration: READ

PEP 8 get_gcp_account

Parameters

parent_type query · string

GCP Hierarchy Parent Type, organization/folder/project

Available values (3)

Folder Organization Project

ids query · string or list of strings

Hierarchical Resource IDs of accounts

scan-type query · string

Type of scan, dry or full, to perform on selected accounts

Available values (2)

dry full

status query · string

Account status to filter results by.

Available values (2)

operational provisioned

limit query · integer

The maximum records to return. Defaults to 100.

offset query · integer

The offset to start retrieving records from

sort query · string

Order fields in ascending or descending order. Ex: parent_type|asc.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

scan_type body · string

Type of scan, dry or full, to perform on selected accounts.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_gcp_account(ids=id_list,
                                  limit=integer,
                                  offset=integer,
                                  parent_type="string",
                                  scan_type="string",
                                  sort="string",
                                  status="string")
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetCSPMGCPAccount(ids=id_list,
                                    limit=integer,
                                    offset=integer,
                                    parent_type="string",
                                    scan_type="string",
                                    sort="string",
                                    status="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetCSPMGCPAccount",
                          parent_type="string",
                          ids=id_list,
                          scan_type="string",
                          status="string",
                          limit=integer,
                          offset=integer,
                          sort="string")
print(response)

Get-FalconCloudGcpAccount

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  parentType := "string"
  status := "string"
  limit := int64(0)
  offset := int64(0)
  sort := "string"

  response, err := client.CspmRegistration.GetCSPMGCPAccount(
    &cspm_registration.GetCSPMGCPAccountParams{
      ParentType: &parentType,
      Ids: []string{"ID1", "ID2", "ID3"},
      ScanType: "string",
      Status: &status,
      Limit: &limit,
      Offset: &offset,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.getCSPMGCPAccount(
  "string",  // parentType
  ["ID1", "ID2", "ID3"],  // ids
  "string",  // scanType
  "string",  // status
  integer,  // limit
  integer,  // offset
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::get_cspmcgp_account;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_cspmcgp_account(
        &falcon.cfg,  // configuration
        Some("string"),  // parent_type
        Some(vec!["string".to_string()]),  // ids
        Some("string"),  // scan_type
        Some("string"),  // status
        Some(integer),  // limit
        Some(integer),  // offset
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

response = api.get_cspm_gcp_account(parent_type: 'string',
                                    ids: ['ID1', 'ID2', 'ID3'],
                                    scan_type: 'string',
                                    status: 'string',
                                    limit: integer,
                                    offset: integer,
                                    sort: 'string')

puts response

Responses

[
  {
    "CreatedAt": "string",
    "DeletedAt": "string",
    "ID": 0,
    "UpdatedAt": "string",
    "cid": "string",
    "cloud_registration_enabled": false,
    "cloud_scopes": [],
    "conditions": [],
    "cspm_enabled": false,
    "display_name": "string",
    "environment": "string",
    "folder_id": "string",
    "folder_name": "string",
    "gcp_permissions_status": [],
    "organization_id": "string",
    "organization_name": "string",
    "parent_id": "string",
    "parent_type": "string",
    "project_id": "string",
    "service_account_client_email": "string",
    "service_account_client_id": "string",
    "service_account_conditions": [],
    "service_account_id": 0,
    "service_account_private_key_id": "string",
    "service_account_project_id": "string",
    "status": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "cid": "string",
      "cloud_registration_enabled": false,
      "cloud_scopes": [],
      "conditions": [],
      "cspm_enabled": false,
      "display_name": "string",
      "environment": "string",
      "folder_id": "string",
      "folder_name": "string",
      "gcp_permissions_status": [],
      "organization_id": "string",
      "organization_name": "string",
      "parent_id": "string",
      "parent_type": "string",
      "project_id": "string",
      "service_account_client_email": "string",
      "service_account_client_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0,
      "service_account_private_key_id": "string",
      "service_account_project_id": "string",
      "status": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "cid": "string",
      "cloud_registration_enabled": false,
      "cloud_scopes": [],
      "conditions": [],
      "cspm_enabled": false,
      "display_name": "string",
      "environment": "string",
      "folder_id": "string",
      "folder_name": "string",
      "gcp_permissions_status": [],
      "organization_id": "string",
      "organization_name": "string",
      "parent_id": "string",
      "parent_type": "string",
      "project_id": "string",
      "service_account_client_email": "string",
      "service_account_client_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0,
      "service_account_private_key_id": "string",
      "service_account_project_id": "string",
      "status": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "cid": "string",
      "cloud_registration_enabled": false,
      "cloud_scopes": [],
      "conditions": [],
      "cspm_enabled": false,
      "display_name": "string",
      "environment": "string",
      "folder_id": "string",
      "folder_name": "string",
      "gcp_permissions_status": [],
      "organization_id": "string",
      "organization_name": "string",
      "parent_id": "string",
      "parent_type": "string",
      "project_id": "string",
      "service_account_client_email": "string",
      "service_account_client_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0,
      "service_account_private_key_id": "string",
      "service_account_project_id": "string",
      "status": "string"
    }
  ]
}

GetCSPMGCPServiceAccountsExt

Returns the service account id and client email for external clients.

Method GET

Route /cloud-connect-cspm-gcp/entities/service-accounts/v1

Scope CSPM registration: READ

PEP 8 get_gcp_service_account

Parameters

id query · string

Service Account ID

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.get_gcp_service_account(id="string")
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.GetCSPMGCPServiceAccountsExt(id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetCSPMGCPServiceAccountsExt",
                          id="string")
print(response)

Get-FalconCloudGcpServiceAccount -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  iD := "string"

  response, err := client.CspmRegistration.GetCSPMGCPServiceAccountsExt(
    &cspm_registration.GetCSPMGCPServiceAccountsExtParams{
      ID: &iD,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.getCSPMGCPServiceAccountsExt("string");  // id

console.log(response);

use rusty_falcon::apis::cspm_registration_api::get_cspmgcp_service_accounts_ext;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_cspmgcp_service_accounts_ext(
        &falcon.cfg,  // configuration
        Some("string"),  // id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

response = api.get_cspm_gcp_service_accounts_ext(id: 'string')

puts response

Responses

[
  {
    "client_email": "string",
    "client_id": "string",
    "project_id": "string",
    "service_account_conditions": [],
    "service_account_id": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_email": "string",
      "client_id": "string",
      "project_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_email": "string",
      "client_id": "string",
      "project_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0
    }
  ]
}

GetCSPMGCPUserScriptsAttachment

Return a script for customer to run in their cloud environment to grant us access to their GCP environment as a downloadable attachment

Method GET

Route /cloud-connect-cspm-gcp/entities/user-scripts-download/v1

Scope CSPM registration: READ

PEP 8 get_gcp_user_scripts_attachment

Parameters

parent_type query · string

GCP Hierarchy Parent Type, organization/folder/project

Available values (3)

Folder Organization Project

ids query · string or list of strings

Hierarchical Resource IDs of accounts

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.get_gcp_user_scripts_attachment(ids=id_list,
                                                      parent_type="string",
                                                      stream=boolean)
    save_file.write(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.GetCSPMGCPUserScriptsAttachment(ids=id_list,
                                                      parent_type="string",
                                                      stream=boolean)
    save_file.write(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.command("GetCSPMGCPUserScriptsAttachment",
                              parent_type="string",
                              ids=id_list)
    save_file.write(response)

Receive-FalconCloudGcpScript -Path "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  parentType := "string"

  response, err := client.CspmRegistration.GetCSPMGCPUserScriptsAttachment(
    &cspm_registration.GetCSPMGCPUserScriptsAttachmentParams{
      ParentType: &parentType,
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.getCSPMGCPUserScriptsAttachment(
  "string",  // parentType
  ["ID1", "ID2", "ID3"]  // ids
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::get_cspmgcp_user_scripts_attachment;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_cspmgcp_user_scripts_attachment(
        &falcon.cfg,  // configuration
        Some("string"),  // parent_type
        Some(vec!["string".to_string()]),  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

response = api.get_cspm_gcp_user_scripts_attachment(parent_type: 'string',
                                                    ids: ['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "bash": "string",
    "service_account_emails": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "bash": "string",
      "service_account_emails": []
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "bash": "string",
      "service_account_emails": []
    }
  ]
}

GetCSPMGCPValidateAccountsExt

Run a synchronous health check.

Method POST

Route /cloud-connect-cspm-gcp/entities/account/validate/v1

Scope CSPM registration: WRITE

PEP 8 validate_gcp_account

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

GCP Account IDs to validate.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.validate_gcp_account(resources=id_list)
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetCSPMGCPValidateAccountsExt(resources=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "resources": [
        {
            "parent_id": "string"
        }
    ]
}

response = falcon.command("GetCSPMGCPValidateAccountsExt", body=body_payload)
print(response)

Invoke-FalconCloudGcpHealthCheck

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  parent_id := "string"

  response, err := client.CspmRegistration.GetCSPMGCPValidateAccountsExt(
    &cspm_registration.GetCSPMGCPValidateAccountsExtParams{
      Body: &models.RegistrationGCPAccountValidationRequestV1{
        Resources: []interface{}{
          {
          ParentID: &parent_id,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.getCSPMGCPValidateAccountsExt(
  {
    resources: [{
        parentId: "string"
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::get_cspmgcp_validate_accounts_ext;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RegistrationGcpAccountValidationRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RegistrationGcpAccountValidationRequestV1 {
        resources: vec![GCPAccountValidationReqObjV1 {
            parent_id: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = get_cspmgcp_validate_accounts_ext(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

body = Falcon::RegistrationGCPAccountValidationRequestV1.new(
  resources: [{
      parent_id: 'string'
    }]
)

response = api.get_cspm_gcp_validate_accounts_ext(body)

puts response

Responses

[
  {
    "conditions": [],
    "gcp_permissions_status": [],
    "parent_id": "string",
    "service_account_conditions": [],
    "service_account_id": 0,
    "status": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "conditions": [],
      "gcp_permissions_status": [],
      "parent_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0,
      "status": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "conditions": [],
      "gcp_permissions_status": [],
      "parent_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0,
      "status": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "conditions": [],
      "gcp_permissions_status": [],
      "parent_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0,
      "status": "string"
    }
  ]
}

GetCSPMPoliciesDetails

Given an array of policy IDs, returns detailed policies information.

Method GET

Route /settings/entities/policy-details/v2

Scope CSPM registration: READ

PEP 8 get_policy_details

Parameters

ids query · integer or list of integers

Policy IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_policy_details(ids=id_list)
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetCSPMPoliciesDetails(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetCSPMPoliciesDetails",
                          ids=id_list)
print(response)

Get-FalconCloudPolicy -PolicyId integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CspmRegistration.GetCSPMPoliciesDetails(
    &cspm_registration.GetCSPMPoliciesDetailsParams{
      Ids: []integer{0},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.getCSPMPoliciesDetails(integer);  // ids

console.log(response);

use rusty_falcon::apis::cspm_registration_api::get_cspm_policies_details;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_cspm_policies_details(
        &falcon.cfg,  // configuration
        vec![],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

response = api.get_cspm_policies_details([0])

puts response

Responses

[
  {
    "CreatedAt": "string",
    "DeletedAt": "string",
    "ID": 0,
    "UpdatedAt": "string",
    "account_scope": "string",
    "alert_logic": "string",
    "api_command": "string",
    "asset_type_id": 0,
    "attack_tool": "string",
    "attack_tool_command": "string",
    "attack_types": [],
    "cis_benchmark_ids": [],
    "cisa_benchmark_ids": [],
    "cli_command": "string",
    "cloud_asset_type": "string",
    "cloud_document": "string",
    "cloud_platform": 0,
    "cloud_platform_type": "string",
    "cloud_service": 0,
    "cloud_service_friendly": "string",
    "cloud_service_id": 0,
    "cloud_service_subtype": "string",
    "cloud_service_type": "string",
    "compliance": {},
    "confidence": "string",
    "controls": [],
    "default_severity": "string",
    "deprecated": false,
    "description": "string",
    "event_type": "string",
    "fql_policy": "string",
    "hipaa_benchmark_ids": [],
    "hitrust_benchmark_ids": [],
    "internal_only": false,
    "is_enabled": false,
    "is_remediable": false,
    "iso_benchmark_ids": [],
    "mitre_attack_cloud_matrix": "string",
    "mitre_attack_cloud_subtype": "string",
    "nist_benchmark_ids": [],
    "pci_benchmark_ids": [],
    "policy_confidence_score": 0,
    "policy_fail_query": "string",
    "policy_pass_query": "string",
    "policy_remediation": "string",
    "policy_severity": 0,
    "policy_severity_score": 0,
    "policy_statement": "string",
    "policy_type": "string",
    "remediation_summary": "string",
    "resource_type_friendly_name": "string",
    "resource_type_id": "string",
    "soc2_benchmark_ids": [],
    "tactic": "string",
    "tactic_id": "string",
    "tactic_url": "string",
    "technique": "string",
    "technique_id": "string",
    "technique_url": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_scope": "string",
      "alert_logic": "string",
      "api_command": "string",
      "asset_type_id": 0,
      "attack_tool": "string",
      "attack_tool_command": "string",
      "attack_types": [],
      "cis_benchmark_ids": [],
      "cisa_benchmark_ids": [],
      "cli_command": "string",
      "cloud_asset_type": "string",
      "cloud_document": "string",
      "cloud_platform": 0,
      "cloud_platform_type": "string",
      "cloud_service": 0,
      "cloud_service_friendly": "string",
      "cloud_service_id": 0,
      "cloud_service_subtype": "string",
      "cloud_service_type": "string",
      "compliance": {},
      "confidence": "string",
      "controls": [],
      "default_severity": "string",
      "deprecated": false,
      "description": "string",
      "event_type": "string",
      "fql_policy": "string",
      "hipaa_benchmark_ids": [],
      "hitrust_benchmark_ids": [],
      "internal_only": false,
      "is_enabled": false,
      "is_remediable": false,
      "iso_benchmark_ids": [],
      "mitre_attack_cloud_matrix": "string",
      "mitre_attack_cloud_subtype": "string",
      "nist_benchmark_ids": [],
      "pci_benchmark_ids": [],
      "policy_confidence_score": 0,
      "policy_fail_query": "string",
      "policy_pass_query": "string",
      "policy_remediation": "string",
      "policy_severity": 0,
      "policy_severity_score": 0,
      "policy_statement": "string",
      "policy_type": "string",
      "remediation_summary": "string",
      "resource_type_friendly_name": "string",
      "resource_type_id": "string",
      "soc2_benchmark_ids": [],
      "tactic": "string",
      "tactic_id": "string",
      "tactic_url": "string",
      "technique": "string",
      "technique_id": "string",
      "technique_url": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_scope": "string",
      "alert_logic": "string",
      "api_command": "string",
      "asset_type_id": 0,
      "attack_tool": "string",
      "attack_tool_command": "string",
      "attack_types": [],
      "cis_benchmark_ids": [],
      "cisa_benchmark_ids": [],
      "cli_command": "string",
      "cloud_asset_type": "string",
      "cloud_document": "string",
      "cloud_platform": 0,
      "cloud_platform_type": "string",
      "cloud_service": 0,
      "cloud_service_friendly": "string",
      "cloud_service_id": 0,
      "cloud_service_subtype": "string",
      "cloud_service_type": "string",
      "compliance": {},
      "confidence": "string",
      "controls": [],
      "default_severity": "string",
      "deprecated": false,
      "description": "string",
      "event_type": "string",
      "fql_policy": "string",
      "hipaa_benchmark_ids": [],
      "hitrust_benchmark_ids": [],
      "internal_only": false,
      "is_enabled": false,
      "is_remediable": false,
      "iso_benchmark_ids": [],
      "mitre_attack_cloud_matrix": "string",
      "mitre_attack_cloud_subtype": "string",
      "nist_benchmark_ids": [],
      "pci_benchmark_ids": [],
      "policy_confidence_score": 0,
      "policy_fail_query": "string",
      "policy_pass_query": "string",
      "policy_remediation": "string",
      "policy_severity": 0,
      "policy_severity_score": 0,
      "policy_statement": "string",
      "policy_type": "string",
      "remediation_summary": "string",
      "resource_type_friendly_name": "string",
      "resource_type_id": "string",
      "soc2_benchmark_ids": [],
      "tactic": "string",
      "tactic_id": "string",
      "tactic_url": "string",
      "technique": "string",
      "technique_id": "string",
      "technique_url": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_scope": "string",
      "alert_logic": "string",
      "api_command": "string",
      "asset_type_id": 0,
      "attack_tool": "string",
      "attack_tool_command": "string",
      "attack_types": [],
      "cis_benchmark_ids": [],
      "cisa_benchmark_ids": [],
      "cli_command": "string",
      "cloud_asset_type": "string",
      "cloud_document": "string",
      "cloud_platform": 0,
      "cloud_platform_type": "string",
      "cloud_service": 0,
      "cloud_service_friendly": "string",
      "cloud_service_id": 0,
      "cloud_service_subtype": "string",
      "cloud_service_type": "string",
      "compliance": {},
      "confidence": "string",
      "controls": [],
      "default_severity": "string",
      "deprecated": false,
      "description": "string",
      "event_type": "string",
      "fql_policy": "string",
      "hipaa_benchmark_ids": [],
      "hitrust_benchmark_ids": [],
      "internal_only": false,
      "is_enabled": false,
      "is_remediable": false,
      "iso_benchmark_ids": [],
      "mitre_attack_cloud_matrix": "string",
      "mitre_attack_cloud_subtype": "string",
      "nist_benchmark_ids": [],
      "pci_benchmark_ids": [],
      "policy_confidence_score": 0,
      "policy_fail_query": "string",
      "policy_pass_query": "string",
      "policy_remediation": "string",
      "policy_severity": 0,
      "policy_severity_score": 0,
      "policy_statement": "string",
      "policy_type": "string",
      "remediation_summary": "string",
      "resource_type_friendly_name": "string",
      "resource_type_id": "string",
      "soc2_benchmark_ids": [],
      "tactic": "string",
      "tactic_id": "string",
      "tactic_url": "string",
      "technique": "string",
      "technique_id": "string",
      "technique_url": "string"
    }
  ]
}

GetCSPMPolicy

Given a policy ID, returns detailed policy information.

Method GET

Route /settings/entities/policy-details/v1

Scope CSPM registration: READ

PEP 8 get_policy

Parameters

ids query · integer

Policy ID

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_policy(ids=id_list)
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetCSPMPolicy(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetCSPMPolicy",
                          ids=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CspmRegistration.GetCSPMPolicy(
    &cspm_registration.GetCSPMPolicyParams{
      Ids: integer,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.getCSPMPolicy(integer);  // ids

console.log(response);

use rusty_falcon::apis::cspm_registration_api::get_cspm_policy;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_cspm_policy(
        &falcon.cfg,  // configuration
        integer,  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

response = api.get_cspm_policy(integer)

puts response

Responses

[
  {
    "CreatedAt": "string",
    "DeletedAt": "string",
    "ID": 0,
    "UpdatedAt": "string",
    "account_scope": "string",
    "alert_logic": "string",
    "api_command": "string",
    "asset_type_id": 0,
    "attack_tool": "string",
    "attack_tool_command": "string",
    "attack_types": [],
    "cis_benchmark_ids": [],
    "cisa_benchmark_ids": [],
    "cli_command": "string",
    "cloud_asset_type": "string",
    "cloud_document": "string",
    "cloud_platform": 0,
    "cloud_platform_type": "string",
    "cloud_service": 0,
    "cloud_service_friendly": "string",
    "cloud_service_id": 0,
    "cloud_service_subtype": "string",
    "cloud_service_type": "string",
    "compliance": {},
    "confidence": "string",
    "controls": [],
    "default_severity": "string",
    "deprecated": false,
    "description": "string",
    "event_type": "string",
    "fql_policy": "string",
    "hipaa_benchmark_ids": [],
    "hitrust_benchmark_ids": [],
    "internal_only": false,
    "is_enabled": false,
    "is_remediable": false,
    "iso_benchmark_ids": [],
    "mitre_attack_cloud_matrix": "string",
    "mitre_attack_cloud_subtype": "string",
    "nist_benchmark_ids": [],
    "pci_benchmark_ids": [],
    "policy_confidence_score": 0,
    "policy_fail_query": "string",
    "policy_pass_query": "string",
    "policy_remediation": "string",
    "policy_severity": 0,
    "policy_severity_score": 0,
    "policy_statement": "string",
    "policy_type": "string",
    "remediation_summary": "string",
    "resource_type_friendly_name": "string",
    "resource_type_id": "string",
    "soc2_benchmark_ids": [],
    "tactic": "string",
    "tactic_id": "string",
    "tactic_url": "string",
    "technique": "string",
    "technique_id": "string",
    "technique_url": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_scope": "string",
      "alert_logic": "string",
      "api_command": "string",
      "asset_type_id": 0,
      "attack_tool": "string",
      "attack_tool_command": "string",
      "attack_types": [],
      "cis_benchmark_ids": [],
      "cisa_benchmark_ids": [],
      "cli_command": "string",
      "cloud_asset_type": "string",
      "cloud_document": "string",
      "cloud_platform": 0,
      "cloud_platform_type": "string",
      "cloud_service": 0,
      "cloud_service_friendly": "string",
      "cloud_service_id": 0,
      "cloud_service_subtype": "string",
      "cloud_service_type": "string",
      "compliance": {},
      "confidence": "string",
      "controls": [],
      "default_severity": "string",
      "deprecated": false,
      "description": "string",
      "event_type": "string",
      "fql_policy": "string",
      "hipaa_benchmark_ids": [],
      "hitrust_benchmark_ids": [],
      "internal_only": false,
      "is_enabled": false,
      "is_remediable": false,
      "iso_benchmark_ids": [],
      "mitre_attack_cloud_matrix": "string",
      "mitre_attack_cloud_subtype": "string",
      "nist_benchmark_ids": [],
      "pci_benchmark_ids": [],
      "policy_confidence_score": 0,
      "policy_fail_query": "string",
      "policy_pass_query": "string",
      "policy_remediation": "string",
      "policy_severity": 0,
      "policy_severity_score": 0,
      "policy_statement": "string",
      "policy_type": "string",
      "remediation_summary": "string",
      "resource_type_friendly_name": "string",
      "resource_type_id": "string",
      "soc2_benchmark_ids": [],
      "tactic": "string",
      "tactic_id": "string",
      "tactic_url": "string",
      "technique": "string",
      "technique_id": "string",
      "technique_url": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_scope": "string",
      "alert_logic": "string",
      "api_command": "string",
      "asset_type_id": 0,
      "attack_tool": "string",
      "attack_tool_command": "string",
      "attack_types": [],
      "cis_benchmark_ids": [],
      "cisa_benchmark_ids": [],
      "cli_command": "string",
      "cloud_asset_type": "string",
      "cloud_document": "string",
      "cloud_platform": 0,
      "cloud_platform_type": "string",
      "cloud_service": 0,
      "cloud_service_friendly": "string",
      "cloud_service_id": 0,
      "cloud_service_subtype": "string",
      "cloud_service_type": "string",
      "compliance": {},
      "confidence": "string",
      "controls": [],
      "default_severity": "string",
      "deprecated": false,
      "description": "string",
      "event_type": "string",
      "fql_policy": "string",
      "hipaa_benchmark_ids": [],
      "hitrust_benchmark_ids": [],
      "internal_only": false,
      "is_enabled": false,
      "is_remediable": false,
      "iso_benchmark_ids": [],
      "mitre_attack_cloud_matrix": "string",
      "mitre_attack_cloud_subtype": "string",
      "nist_benchmark_ids": [],
      "pci_benchmark_ids": [],
      "policy_confidence_score": 0,
      "policy_fail_query": "string",
      "policy_pass_query": "string",
      "policy_remediation": "string",
      "policy_severity": 0,
      "policy_severity_score": 0,
      "policy_statement": "string",
      "policy_type": "string",
      "remediation_summary": "string",
      "resource_type_friendly_name": "string",
      "resource_type_id": "string",
      "soc2_benchmark_ids": [],
      "tactic": "string",
      "tactic_id": "string",
      "tactic_url": "string",
      "technique": "string",
      "technique_id": "string",
      "technique_url": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_scope": "string",
      "alert_logic": "string",
      "api_command": "string",
      "asset_type_id": 0,
      "attack_tool": "string",
      "attack_tool_command": "string",
      "attack_types": [],
      "cis_benchmark_ids": [],
      "cisa_benchmark_ids": [],
      "cli_command": "string",
      "cloud_asset_type": "string",
      "cloud_document": "string",
      "cloud_platform": 0,
      "cloud_platform_type": "string",
      "cloud_service": 0,
      "cloud_service_friendly": "string",
      "cloud_service_id": 0,
      "cloud_service_subtype": "string",
      "cloud_service_type": "string",
      "compliance": {},
      "confidence": "string",
      "controls": [],
      "default_severity": "string",
      "deprecated": false,
      "description": "string",
      "event_type": "string",
      "fql_policy": "string",
      "hipaa_benchmark_ids": [],
      "hitrust_benchmark_ids": [],
      "internal_only": false,
      "is_enabled": false,
      "is_remediable": false,
      "iso_benchmark_ids": [],
      "mitre_attack_cloud_matrix": "string",
      "mitre_attack_cloud_subtype": "string",
      "nist_benchmark_ids": [],
      "pci_benchmark_ids": [],
      "policy_confidence_score": 0,
      "policy_fail_query": "string",
      "policy_pass_query": "string",
      "policy_remediation": "string",
      "policy_severity": 0,
      "policy_severity_score": 0,
      "policy_statement": "string",
      "policy_type": "string",
      "remediation_summary": "string",
      "resource_type_friendly_name": "string",
      "resource_type_id": "string",
      "soc2_benchmark_ids": [],
      "tactic": "string",
      "tactic_id": "string",
      "tactic_url": "string",
      "technique": "string",
      "technique_id": "string",
      "technique_url": "string"
    }
  ]
}

GetCSPMPolicySettings

Returns information about current policy settings.

Method GET

Route /settings/entities/policy/v1

Scope CSPM registration: READ

PEP 8 get_policy_settings

Parameters

service query · string

Service type to filter policy settings by.

Available values (54)

`ACM`	`ACR`	`Any`
`App Engine`	`AppService`	`BigQuery`
`Cloud Load Balancing`	`Cloud Logging`	`Cloud SQL`
`Cloud Storage`	`CloudFormation`	`CloudTrail`
`CloudWatch Logs`	`Cloudfront`	`Compute Engine`
`Config`	`Disk`	`DynamoDB`
`EBS`	`EC2`	`ECR`
`EFS`	`EKS`	`ELB`
`EMR`	`Elasticache`	`GuardDuty`
`IAM`	`Identity`	`KMS`
`KeyVault`	`Kinesis`	`Kubernetes`
`Lambda`	`LoadBalancer`	`Monitor`
`NLB/ALB`	`NetworkSecurityGroup`	`PostgreSQL`
`RDS`	`Redshift`	`S3`
`SES`	`SNS`	`SQLDatabase`
`SQLServer`	`SQS`	`SSM`
`Serverless Application Repository`	`StorageAccount`	`Subscriptions`
`VPC`	`VirtualMachine`	`VirtualNetwork`

policy-id query · string

Policy ID

cloud-platform query · string

Cloud Platform (e.g.: aws|azure|gcp)

Available values (3)

aws azure gcp

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

policy_id body · string

Policy ID.

cloud_platform body · string

Cloud platform. Allowed values:

Available values (3)

azure aws gcp

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.get_policy_settings(policy_id="string",
                                      cloud_platform="string",
                                      service="string")
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.GetCSPMPolicySettings(policy_id="string",
                                        cloud_platform="string",
                                        service="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetCSPMPolicySettings",
                          service="string",
                          policy_id="string",
                          cloud_platform="string")
print(response)

Get-FalconCloudPolicy

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  service := "string"

  response, err := client.CspmRegistration.GetCSPMPolicySettings(
    &cspm_registration.GetCSPMPolicySettingsParams{
      Service: &service,
      PolicyID: "string",
      CloudPlatform: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.getCSPMPolicySettings(
  "string",  // service
  "string",  // policyId
  "string"  // cloudPlatform
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::get_cspm_policy_settings;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_cspm_policy_settings(
        &falcon.cfg,  // configuration
        Some("string"),  // service
        Some("string"),  // policy_id
        Some("string"),  // cloud_platform
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

response = api.get_cspm_policy_settings(service: 'string',
                                        policy_id: 'string',
                                        cloud_platform: 'string')

puts response

Responses

[
  {
    "account_scope": "string",
    "attack_types": [],
    "cid": "string",
    "cis_benchmark": [],
    "cisa_benchmark": [],
    "cloud_asset_type": "string",
    "cloud_asset_type_id": 0,
    "cloud_provider": "string",
    "cloud_service": "string",
    "cloud_service_friendly": "string",
    "cloud_service_id": 0,
    "cloud_service_subtype": "string",
    "created_at": "string",
    "default_severity": "string",
    "fql_policy": "string",
    "hipaa_benchmark": [],
    "hitrust_benchmark": [],
    "is_global": false,
    "is_remediable": false,
    "iso_benchmark": [],
    "name": "string",
    "nist_benchmark": [],
    "pci_benchmark": [],
    "policy_id": 0,
    "policy_settings": [],
    "policy_timestamp": "string",
    "policy_type": "string",
    "remediation_summary": "string",
    "soc2_benchmark": [],
    "updated_at": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "account_scope": "string",
      "attack_types": [],
      "cid": "string",
      "cis_benchmark": [],
      "cisa_benchmark": [],
      "cloud_asset_type": "string",
      "cloud_asset_type_id": 0,
      "cloud_provider": "string",
      "cloud_service": "string",
      "cloud_service_friendly": "string",
      "cloud_service_id": 0,
      "cloud_service_subtype": "string",
      "created_at": "string",
      "default_severity": "string",
      "fql_policy": "string",
      "hipaa_benchmark": [],
      "hitrust_benchmark": [],
      "is_global": false,
      "is_remediable": false,
      "iso_benchmark": [],
      "name": "string",
      "nist_benchmark": [],
      "pci_benchmark": [],
      "policy_id": 0,
      "policy_settings": [],
      "policy_timestamp": "string",
      "policy_type": "string",
      "remediation_summary": "string",
      "soc2_benchmark": [],
      "updated_at": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "account_scope": "string",
      "attack_types": [],
      "cid": "string",
      "cis_benchmark": [],
      "cisa_benchmark": [],
      "cloud_asset_type": "string",
      "cloud_asset_type_id": 0,
      "cloud_provider": "string",
      "cloud_service": "string",
      "cloud_service_friendly": "string",
      "cloud_service_id": 0,
      "cloud_service_subtype": "string",
      "created_at": "string",
      "default_severity": "string",
      "fql_policy": "string",
      "hipaa_benchmark": [],
      "hitrust_benchmark": [],
      "is_global": false,
      "is_remediable": false,
      "iso_benchmark": [],
      "name": "string",
      "nist_benchmark": [],
      "pci_benchmark": [],
      "policy_id": 0,
      "policy_settings": [],
      "policy_timestamp": "string",
      "policy_type": "string",
      "remediation_summary": "string",
      "soc2_benchmark": [],
      "updated_at": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "account_scope": "string",
      "attack_types": [],
      "cid": "string",
      "cis_benchmark": [],
      "cisa_benchmark": [],
      "cloud_asset_type": "string",
      "cloud_asset_type_id": 0,
      "cloud_provider": "string",
      "cloud_service": "string",
      "cloud_service_friendly": "string",
      "cloud_service_id": 0,
      "cloud_service_subtype": "string",
      "created_at": "string",
      "default_severity": "string",
      "fql_policy": "string",
      "hipaa_benchmark": [],
      "hitrust_benchmark": [],
      "is_global": false,
      "is_remediable": false,
      "iso_benchmark": [],
      "name": "string",
      "nist_benchmark": [],
      "pci_benchmark": [],
      "policy_id": 0,
      "policy_settings": [],
      "policy_timestamp": "string",
      "policy_type": "string",
      "remediation_summary": "string",
      "soc2_benchmark": [],
      "updated_at": "string"
    }
  ]
}

GetCSPMScanSchedule

Returns scan schedule configuration for one or more cloud platforms.

Method GET

Route /settings/scan-schedule/v1

Scope CSPM registration: READ

PEP 8 get_scan_schedule

Parameters

cloud-platform query · string or list of strings

Cloud Platform

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

cloud_platform body · string

Cloud Platform. Allowed Values: azure, aws, gcp

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.get_scan_schedule(cloud_platform="string")
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.GetCSPMScanSchedule(cloud_platform="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetCSPMScanSchedule",
                          cloud_platform=id_list)
print(response)

Get-FalconCloudSchedule -CloudPlatform @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CspmRegistration.GetCSPMScanSchedule(
    &cspm_registration.GetCSPMScanScheduleParams{
      CloudPlatform: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.getCSPMScanSchedule(["ID1", "ID2", "ID3"]);  // cloudPlatform

console.log(response);

use rusty_falcon::apis::cspm_registration_api::get_cspm_scan_schedule;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_cspm_scan_schedule(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // cloud_platform
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

response = api.get_cspm_scan_schedule(cloud_platform: ['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "cloud_platform": "string",
    "last_scan_completed_at": "string",
    "next_scan_timestamp": "string",
    "scan_interval": "string",
    "scan_schedule": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cloud_platform": "string",
      "last_scan_completed_at": "string",
      "next_scan_timestamp": "string",
      "scan_interval": "string",
      "scan_schedule": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cloud_platform": "string",
      "last_scan_completed_at": "string",
      "next_scan_timestamp": "string",
      "scan_interval": "string",
      "scan_schedule": "string"
    }
  ]
}

GetIOAEvents

For CSPM IOA events, gets list of IOA events.

Method GET

Route /ioa/entities/events/v1

PEP 8 get_ioa_events

Parameters

policy_id query · string

Policy ID

cloud_provider query · string

Cloud Provider (e.g.: aws|azure|gcp)

account_id query · string

Cloud account ID (e.g.: AWS accountID, Azure subscriptionID)

aws_account_id query · string

AWS accountID

azure_subscription_id query · string

Azure subscription ID

azure_tenant_id query · string

Azure tenant ID

user_ids query · string or list of strings

user IDs

state query · string

state

offset query · integer

Starting index of overall result set from which to return events.

limit query · integer

The maximum records to return. [1-500]

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_ioa_events(policy_id="string",
                                 cloud_provider="string",
                                 account_id="string",
                                 aws_account_id="string",
                                 azure_subscription_id="string",
                                 azure_tenant_id="string",
                                 user_ids=id_list,
                                 state="string",
                                 limit=integer,
                                 offset=integer)
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetIOAEvents(policy_id="string",
                               cloud_provider="string",
                               account_id="string",
                               aws_account_id="string",
                               azure_subscription_id="string",
                               azure_tenant_id="string",
                               user_ids=id_list,
                               state="string",
                               limit=integer,
                               offset=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetIOAEvents",
                          policy_id="string",
                          cloud_provider="string",
                          account_id="string",
                          aws_account_id="string",
                          azure_subscription_id="string",
                          azure_tenant_id="string",
                          user_ids=id_list,
                          state="string",
                          offset=integer,
                          limit=integer)
print(response)

GetIOAUsers

For CSPM IOA users, gets list of IOA users.

Method GET

Route /ioa/entities/users/v1

PEP 8 get_ioa_users

Parameters

policy_id query · string

Policy ID

state query · string

state

cloud_provider query · string

Cloud Provider (e.g.: aws|azure|gcp)

account_id query · string

Cloud account ID (e.g.: AWS accountID, Azure subscriptionID)

aws_account_id query · string

AWS accountID

azure_subscription_id query · string

Azure subscription ID

azure_tenant_id query · string

Azure tenant ID

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.get_ioa_users(policy_id="string",
                                cloud_provider="string",
                                account_id="string",
                                aws_account_id="string",
                                azure_subscription_id="string",
                                azure_tenant_id="string",
                                state="string")
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.GetIOAUsers(policy_id="string",
                              cloud_provider="string",
                              account_id="string",
                              aws_account_id="string",
                              azure_subscription_id="string",
                              azure_tenant_id="string",
                              state="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetIOAUsers",
                          policy_id="string",
                          state="string",
                          cloud_provider="string",
                          account_id="string",
                          aws_account_id="string",
                          azure_subscription_id="string",
                          azure_tenant_id="string")
print(response)

PatchCSPMAwsAccount

Patches a existing account in our system for a customer.

Method PATCH

Route /cloud-connect-cspm-aws/entities/account/v1

Scope CSPM registration: WRITE

PEP 8 update_aws_account

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

account_id body · string

AWS Account ID.

behavior_assessment_enabled body · boolean

Indicate if behavior assessment should be enabled.

cloudtrail_region body · string

AWS Cloudtrail Region.

iam_role_arn body · string

IAM role ARN to use.

remediation_region body · string

AWS region to remediation.

remediation_tou_accepted body · string

Timestamp formatted.

cloudtrail_region body · string

AWS Cloudtrail Region.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.update_aws_account(account_id="string",
                                     behavior_assessment_enabled=boolean,
                                     cloudtrail_region="string",
                                     iam_role_arn="string",
                                     remediation_region="string",
                                     remediation_tou_accepted="string",
                                     cloudtrail_region="string")
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.PatchCSPMAwsAccount(account_id="string",
                                      behavior_assessment_enabled=boolean,
                                      cloudtrail_region="string",
                                      iam_role_arn="string",
                                      remediation_region="string",
                                      remediation_tou_accepted="string",
                                      cloudtrail_region="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "account_id": "string",
            "behavior_assessment_enabled": boolean,
            "cloudtrail_region": "string",
            "deployment_method": "string",
            "dspm_enabled": boolean,
            "dspm_role": "string",
            "environment": "string",
            "falcon_client_id": "string",
            "iam_role_arn": "string",
            "remediation_region": "string",
            "remediation_tou_accepted": "string",
            "root_stack_id": "string",
            "sensor_management_enabled": boolean,
            "target_ous": ["string"],
            "vulnerability_scanning_enabled": boolean,
            "vulnerability_scanning_role": "string"
        }
    ]
}

response = falcon.command("PatchCSPMAwsAccount", body=body_payload)
print(response)

Edit-FalconCloudAwsAccount -AccountId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  account_id := "string"
  behavior_assessment_enabled := boolean
  cloudtrail_region := "string"
  deployment_method := "string"
  dspm_enabled := boolean
  dspm_role := "string"
  environment := "string"
  falcon_client_id := "string"
  iam_role_arn := "string"
  remediation_region := "string"
  remediation_tou_accepted := "string"
  root_stack_id := "string"
  sensor_management_enabled := boolean
  vulnerability_scanning_enabled := boolean
  vulnerability_scanning_role := "string"

  response, err := client.CspmRegistration.PatchCSPMAwsAccount(
    &cspm_registration.PatchCSPMAwsAccountParams{
      Body: &models.RegistrationAWSAccountPatchRequest{
        Resources: []interface{}{
          {
          AccountID: &account_id,
          BehaviorAssessmentEnabled: &behavior_assessment_enabled,
          CloudtrailRegion: &cloudtrail_region,
          DeploymentMethod: &deployment_method,
          DspmEnabled: &dspm_enabled,
          DspmRole: &dspm_role,
          Environment: &environment,
          FalconClientID: &falcon_client_id,
          IamRoleArn: &iam_role_arn,
          RemediationRegion: &remediation_region,
          RemediationTouAccepted: &remediation_tou_accepted,
          RootStackID: &root_stack_id,
          SensorManagementEnabled: &sensor_management_enabled,
          TargetOus: []string{"string"},
          VulnerabilityScanningEnabled: &vulnerability_scanning_enabled,
          VulnerabilityScanningRole: &vulnerability_scanning_role,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.patchCSPMAwsAccount(
  {
    resources: [{
        accountId: "string",
        behaviorAssessmentEnabled: boolean,
        cloudtrailRegion: "string",
        deploymentMethod: "string",
        dspmEnabled: boolean,
        dspmRole: "string",
        environment: "string",
        falconClientId: "string",
        iamRoleArn: "string",
        remediationRegion: "string",
        remediationTouAccepted: "string",
        rootStackId: "string",
        sensorManagementEnabled: boolean,
        targetOus: [],
        vulnerabilityScanningEnabled: boolean,
        vulnerabilityScanningRole: "string"
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::patch_cspm_aws_account;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RegistrationAwsAccountPatchRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RegistrationAwsAccountPatchRequest {
        resources: vec![AWSAccountPatch {
            account_id: Some("string".to_string()),
            behavior_assessment_enabled: Some(boolean),
            dspm_enabled: Some(boolean),
            iam_role_arn: Some("string".to_string()),
            sensor_management_enabled: Some(boolean),
            vulnerability_scanning_enabled: Some(boolean),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = patch_cspm_aws_account(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

body = Falcon::RegistrationAWSAccountPatchRequest.new(
  resources: [{
      account_id: 'string',
      behavior_assessment_enabled: boolean,
      cloudtrail_region: 'string',
      deployment_method: 'string',
      dspm_enabled: boolean,
      dspm_role: 'string',
      environment: 'string',
      falcon_client_id: 'string',
      iam_role_arn: 'string',
      remediation_region: 'string',
      remediation_tou_accepted: 'string',
      root_stack_id: 'string',
      sensor_management_enabled: boolean,
      target_ous: [],
      vulnerability_scanning_enabled: boolean,
      vulnerability_scanning_role: 'string'
    }]
)

response = api.patch_cspm_aws_account(body)

puts response

Responses

[
  {
    "CreatedAt": "string",
    "DeletedAt": "string",
    "ID": 0,
    "UpdatedAt": "string",
    "account_id": "string",
    "account_name": "string",
    "account_type": "string",
    "active_regions": [],
    "aws_cloudtrail_bucket_name": "string",
    "aws_cloudtrail_region": "string",
    "aws_eventbus_arn": "string",
    "aws_permissions_status": [],
    "behavior_assessment_enabled": false,
    "cid": "string",
    "cloud_registration_enabled": false,
    "cloud_scopes": [],
    "cloudformation_root_stack_arn": "string",
    "cloudformation_update_url": "string",
    "cloudformation_url": "string",
    "conditions": [],
    "cspm_enabled": false,
    "d4c": {},
    "d4c_migrated": false,
    "dspm_enabled": false,
    "dspm_host_account_id": "string",
    "dspm_role_arn": "string",
    "environment": "string",
    "eventbus_name": "string",
    "external_id": "string",
    "falcon_client_id": "string",
    "features": [],
    "iam_role_arn": "string",
    "intermediate_role_arn": "string",
    "inventory_filter": [],
    "is_cloud_registration": false,
    "is_cspm_lite": false,
    "is_custom_rolename": false,
    "is_delegated_admin": false,
    "is_master": false,
    "ngsiem_enabled": false,
    "organization_id": "string",
    "remediation_cloudformation_url": "string",
    "remediation_region": "string",
    "remediation_tou_accepted": "string",
    "resource_name_prefix": "string",
    "resource_name_suffix": "string",
    "root_account_id": "string",
    "root_iam_role": false,
    "s3_url": "string",
    "secondary_role_arn": "string",
    "sensor_management_enabled": false,
    "settings": {},
    "status": "string",
    "target_ous": [],
    "template_source_region": "string",
    "use_existing_cloudtrail": false,
    "valid": false,
    "vulnerability_scanning_enabled": false,
    "vulnerability_scanning_host_account_id": "string",
    "vulnerability_scanning_role_arn": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_id": "string",
      "account_name": "string",
      "account_type": "string",
      "active_regions": [],
      "aws_cloudtrail_bucket_name": "string",
      "aws_cloudtrail_region": "string",
      "aws_eventbus_arn": "string",
      "aws_permissions_status": [],
      "behavior_assessment_enabled": false,
      "cid": "string",
      "cloud_registration_enabled": false,
      "cloud_scopes": [],
      "cloudformation_root_stack_arn": "string",
      "cloudformation_update_url": "string",
      "cloudformation_url": "string",
      "conditions": [],
      "cspm_enabled": false,
      "d4c": {},
      "d4c_migrated": false,
      "dspm_enabled": false,
      "dspm_host_account_id": "string",
      "dspm_role_arn": "string",
      "environment": "string",
      "eventbus_name": "string",
      "external_id": "string",
      "falcon_client_id": "string",
      "features": [],
      "iam_role_arn": "string",
      "intermediate_role_arn": "string",
      "inventory_filter": [],
      "is_cloud_registration": false,
      "is_cspm_lite": false,
      "is_custom_rolename": false,
      "is_delegated_admin": false,
      "is_master": false,
      "ngsiem_enabled": false,
      "organization_id": "string",
      "remediation_cloudformation_url": "string",
      "remediation_region": "string",
      "remediation_tou_accepted": "string",
      "resource_name_prefix": "string",
      "resource_name_suffix": "string",
      "root_account_id": "string",
      "root_iam_role": false,
      "s3_url": "string",
      "secondary_role_arn": "string",
      "sensor_management_enabled": false,
      "settings": {},
      "status": "string",
      "target_ous": [],
      "template_source_region": "string",
      "use_existing_cloudtrail": false,
      "valid": false,
      "vulnerability_scanning_enabled": false,
      "vulnerability_scanning_host_account_id": "string",
      "vulnerability_scanning_role_arn": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

UpdateCSPMAzureAccount

Patches a existing account in our system for a customer.

Method PATCH

Route /cloud-connect-cspm-azure/entities/account/v1

Scope CSPM registration: WRITE

PEP 8 update_azure_account

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

account_type body · string

Azure account type.

client_id body · string

Azure Client ID.

default_subscription body · boolean

Indicate if this is the default subscription.

subscription_id body · string

Azure Subscription ID.

tenant_id body · string

Azure Tenant ID.

years_valid body · integer

Number of years this account is valid.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.update_azure_account(account_type="string",
                                       client_id="string",
                                       default_subscription=boolean,
                                       subscription_id="string",
                                       tenant_id="string",
                                       years_valid=integer)
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.UpdateCSPMAzureAccount(account_type="string",
                                         client_id="string",
                                         default_subscription=boolean,
                                         subscription_id="string",
                                         tenant_id="string",
                                         years_valid=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "environment": "string",
            "subscription_id": "string"
        }
    ]
}

response = falcon.command("UpdateCSPMAzureAccount", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  environment := "string"
  subscription_id := "string"

  response, err := client.CspmRegistration.UpdateCSPMAzureAccount(
    &cspm_registration.UpdateCSPMAzureAccountParams{
      Body: &models.RegistrationAzureAccountPatchRequest{
        Resources: []interface{}{
          {
          Environment: &environment,
          SubscriptionID: &subscription_id,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.updateCSPMAzureAccount(
  {
    resources: [{
        environment: "string",
        subscriptionId: "string"
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::update_cspm_azure_account;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RegistrationAzureAccountPatchRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RegistrationAzureAccountPatchRequest {
        resources: vec![AzureAccountPatch {
            subscription_id: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = update_cspm_azure_account(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

body = Falcon::RegistrationAzureAccountPatchRequest.new(
  resources: [{
      environment: 'string',
      subscription_id: 'string'
    }]
)

response = api.update_cspm_azure_account(body)

puts response

Responses

[
  {
    "CreatedAt": "string",
    "DeletedAt": "string",
    "ID": 0,
    "UpdatedAt": "string",
    "account_type": "string",
    "azure_permissions_status": [],
    "cid": "string",
    "client_id": "string",
    "cloud_scopes": [],
    "conditions": [],
    "credentials_end_date": "string",
    "credentials_type": "string",
    "default_subscription_id": "string",
    "environment": "string",
    "ioa_status": "string",
    "iom_status": "string",
    "is_cspm_lite": false,
    "object_id": "string",
    "parent_management_group_id": "string",
    "parent_management_group_name": "string",
    "primary_domain": "string",
    "public_certificate": "string",
    "public_certificate_raw": "string",
    "role_assignments": [],
    "show_modal": false,
    "status": "string",
    "subscription_id": "string",
    "subscription_name": "string",
    "tenant_id": "string",
    "tenant_name": "string",
    "years_valid": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_type": "string",
      "azure_permissions_status": [],
      "cid": "string",
      "client_id": "string",
      "cloud_scopes": [],
      "conditions": [],
      "credentials_end_date": "string",
      "credentials_type": "string",
      "default_subscription_id": "string",
      "environment": "string",
      "ioa_status": "string",
      "iom_status": "string",
      "is_cspm_lite": false,
      "object_id": "string",
      "parent_management_group_id": "string",
      "parent_management_group_name": "string",
      "primary_domain": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "role_assignments": [],
      "show_modal": false,
      "status": "string",
      "subscription_id": "string",
      "subscription_name": "string",
      "tenant_id": "string",
      "tenant_name": "string",
      "years_valid": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_type": "string",
      "azure_permissions_status": [],
      "cid": "string",
      "client_id": "string",
      "cloud_scopes": [],
      "conditions": [],
      "credentials_end_date": "string",
      "credentials_type": "string",
      "default_subscription_id": "string",
      "environment": "string",
      "ioa_status": "string",
      "iom_status": "string",
      "is_cspm_lite": false,
      "object_id": "string",
      "parent_management_group_id": "string",
      "parent_management_group_name": "string",
      "primary_domain": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "role_assignments": [],
      "show_modal": false,
      "status": "string",
      "subscription_id": "string",
      "subscription_name": "string",
      "tenant_id": "string",
      "tenant_name": "string",
      "years_valid": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_type": "string",
      "azure_permissions_status": [],
      "cid": "string",
      "client_id": "string",
      "cloud_scopes": [],
      "conditions": [],
      "credentials_end_date": "string",
      "credentials_type": "string",
      "default_subscription_id": "string",
      "environment": "string",
      "ioa_status": "string",
      "iom_status": "string",
      "is_cspm_lite": false,
      "object_id": "string",
      "parent_management_group_id": "string",
      "parent_management_group_name": "string",
      "primary_domain": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "role_assignments": [],
      "show_modal": false,
      "status": "string",
      "subscription_id": "string",
      "subscription_name": "string",
      "tenant_id": "string",
      "tenant_name": "string",
      "years_valid": 0
    }
  ]
}

UpdateCSPMAzureAccountClientID

Update an Azure service account in our system by with the user-created client_id created with the public key we’ve provided

Method PATCH

Route /cloud-connect-cspm-azure/entities/client-id/v1

Scope CSPM registration: WRITE

PEP 8 update_azure_account_client_id

Parameters

id query · string

ClientID to use for the Service Principal associated with the customer’s Azure account

tenant-id query · string

Tenant ID to update client ID for. Required if multiple tenants are registered.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

tenant_id body · string

Azure Tenant ID to update client ID for. Required if multiple tenants are registered.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.update_azure_account_client_id(id="string",
                                                 tenant_id="string")
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.UpdateCSPMAzureAccountClientID(id="string",
                                                 tenant_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("UpdateCSPMAzureAccountClientID",
                          id="string",
                          tenant_id="string")
print(response)

Edit-FalconCloudAzureAccount -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CspmRegistration.UpdateCSPMAzureAccountClientID(
    &cspm_registration.UpdateCSPMAzureAccountClientIDParams{
      ID: "string",
      TenantID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.updateCSPMAzureAccountClientID(
  "string",  // id
  "string"  // tenantId
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::update_cspm_azure_account_client_id;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = update_cspm_azure_account_client_id(
        &falcon.cfg,  // configuration
        "string",  // id
        Some("string"),  // tenant_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

response = api.update_cspm_azure_account_client_id('string')

puts response

Responses

[
  {
    "account_type": "string",
    "behavior_assessment_override": false,
    "cid": "string",
    "client_id": "string",
    "cloud_registration_enabled": false,
    "conditions": [],
    "cspm_enabled": false,
    "default_subscription_id": "string",
    "encrypted_private_key": "string",
    "is_shared_client": false,
    "object_id": "string",
    "public_certificate": "string",
    "resource_permissions": [],
    "tenant_id": "string",
    "x5t": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "account_type": "string",
      "behavior_assessment_override": false,
      "cid": "string",
      "client_id": "string",
      "cloud_registration_enabled": false,
      "conditions": [],
      "cspm_enabled": false,
      "default_subscription_id": "string",
      "encrypted_private_key": "string",
      "is_shared_client": false,
      "object_id": "string",
      "public_certificate": "string",
      "resource_permissions": [],
      "tenant_id": "string",
      "x5t": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "account_type": "string",
      "behavior_assessment_override": false,
      "cid": "string",
      "client_id": "string",
      "cloud_registration_enabled": false,
      "conditions": [],
      "cspm_enabled": false,
      "default_subscription_id": "string",
      "encrypted_private_key": "string",
      "is_shared_client": false,
      "object_id": "string",
      "public_certificate": "string",
      "resource_permissions": [],
      "tenant_id": "string",
      "x5t": "string"
    }
  ]
}

UpdateCSPMAzureTenantDefaultSubscriptionID

Update an Azure default subscription_id in our system for given tenant_id

Method PATCH

Route /cloud-connect-cspm-azure/entities/default-subscription-id/v1

Scope CSPM registration: WRITE

PEP 8 update_azure_tenant_default_subscription_id

Parameters

tenant-id query · string

Tenant ID to update client ID for. Required if multiple tenants are registered.

subscription_id query · string

Default Subscription ID to patch for all subscriptions belonged to a tenant.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

tenant_id body · string

Azure Tenant ID to update client ID for. Required if multiple tenants are registered.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.update_azure_tenant_default_subscription_id(subscription_id="string",
                                                              tenant_id="string")
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.UpdateCSPMAzureTenantDefaultSubscriptionID(subscription_id="string",
                                                             tenant_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("UpdateCSPMAzureTenantDefaultSubscriptionID",
                          tenant_id="string",
                          subscription_id="string")
print(response)

Edit-FalconCloudAzureAccount -SubscriptionId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CspmRegistration.UpdateCSPMAzureTenantDefaultSubscriptionID(
    &cspm_registration.UpdateCSPMAzureTenantDefaultSubscriptionIDParams{
      TenantID: "string",
      SubscriptionID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.updateCSPMAzureTenantDefaultSubscriptionID(
  "string",  // subscriptionId
  "string"  // tenantId
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::update_cspm_azure_tenant_default_subscription_id;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = update_cspm_azure_tenant_default_subscription_id(
        &falcon.cfg,  // configuration
        "string",  // subscription_id
        Some("string"),  // tenant_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

response = api.update_cspm_azure_tenant_default_subscription_id('string')

puts response

Responses

{
  "default_subscription_id": "string",
  "subscription_ids": [],
  "tenant_id": "string"
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {
    "default_subscription_id": "string",
    "subscription_ids": [],
    "tenant_id": "string"
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {
    "default_subscription_id": "string",
    "subscription_ids": [],
    "tenant_id": "string"
  }
}

UpdateCSPMGCPAccount

Patches a existing account in our system for a customer.

Method PATCH

Route /cloud-connect-cspm-gcp/entities/account/v1

Scope CSPM registration: WRITE

PEP 8 update_gcp_account

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

environment body · string

GCP environment.

parent_id body · string

GCP parent ID.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.update_gcp_account(environment="string", parent_id="string")
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.UpdateCSPMGCPAccount(environment="string", parent_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "environment": "string",
            "parent_id": "string",
            "service_account": {
                "client_email": "string",
                "client_id": "string",
                "private_key": "string",
                "private_key_id": "string",
                "project_id": "string",
                "service_account_conditions": ["string"],
                "service_account_id": integer
            }
        }
    ]
}

response = falcon.command("UpdateCSPMGCPAccount", body=body_payload)
print(response)

Edit-FalconCloudGcpAccount

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  environment := "string"
  parent_id := "string"

  response, err := client.CspmRegistration.UpdateCSPMGCPAccount(
    &cspm_registration.UpdateCSPMGCPAccountParams{
      Body: &models.RegistrationGCPAccountPatchRequestV1{
        Resources: []interface{}{
          {
          Environment: &environment,
          ParentID: &parent_id,
          ServiceAccount: &struct{}{},
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.updateCSPMGCPAccount(
  {
    resources: [{
        environment: "string",
        parentId: "string",
        serviceAccount: {
          clientEmail: "string",
          clientId: "string",
          privateKey: "string",
          privateKeyId: "string",
          projectId: "string",
          serviceAccountConditions: [],
          serviceAccountId: integer
        }
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::update_cspmgcp_account;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RegistrationGcpAccountPatchRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RegistrationGcpAccountPatchRequestV1 {
        resources: vec![GCPAccountPatchV1 {
            parent_id: Some("string".to_string()),
            service_account: Default::default(),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = update_cspmgcp_account(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

body = Falcon::RegistrationGCPAccountPatchRequestV1.new(
  resources: [{
      environment: 'string',
      parent_id: 'string',
      service_account: {
        client_email: 'string',
        client_id: 'string',
        private_key: 'string',
        private_key_id: 'string',
        project_id: 'string',
        service_account_conditions: [],
        service_account_id: integer
      }
    }]
)

response = api.update_cspm_gcp_account(body)

puts response

Responses

[
  {
    "CreatedAt": "string",
    "DeletedAt": "string",
    "ID": 0,
    "UpdatedAt": "string",
    "cid": "string",
    "cloud_registration_enabled": false,
    "cloud_scopes": [],
    "conditions": [],
    "cspm_enabled": false,
    "display_name": "string",
    "environment": "string",
    "folder_id": "string",
    "folder_name": "string",
    "gcp_permissions_status": [],
    "organization_id": "string",
    "organization_name": "string",
    "parent_id": "string",
    "parent_type": "string",
    "project_id": "string",
    "service_account_client_email": "string",
    "service_account_client_id": "string",
    "service_account_conditions": [],
    "service_account_id": 0,
    "service_account_private_key_id": "string",
    "service_account_project_id": "string",
    "status": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "cid": "string",
      "cloud_registration_enabled": false,
      "cloud_scopes": [],
      "conditions": [],
      "cspm_enabled": false,
      "display_name": "string",
      "environment": "string",
      "folder_id": "string",
      "folder_name": "string",
      "gcp_permissions_status": [],
      "organization_id": "string",
      "organization_name": "string",
      "parent_id": "string",
      "parent_type": "string",
      "project_id": "string",
      "service_account_client_email": "string",
      "service_account_client_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0,
      "service_account_private_key_id": "string",
      "service_account_project_id": "string",
      "status": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "cid": "string",
      "cloud_registration_enabled": false,
      "cloud_scopes": [],
      "conditions": [],
      "cspm_enabled": false,
      "display_name": "string",
      "environment": "string",
      "folder_id": "string",
      "folder_name": "string",
      "gcp_permissions_status": [],
      "organization_id": "string",
      "organization_name": "string",
      "parent_id": "string",
      "parent_type": "string",
      "project_id": "string",
      "service_account_client_email": "string",
      "service_account_client_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0,
      "service_account_private_key_id": "string",
      "service_account_project_id": "string",
      "status": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "cid": "string",
      "cloud_registration_enabled": false,
      "cloud_scopes": [],
      "conditions": [],
      "cspm_enabled": false,
      "display_name": "string",
      "environment": "string",
      "folder_id": "string",
      "folder_name": "string",
      "gcp_permissions_status": [],
      "organization_id": "string",
      "organization_name": "string",
      "parent_id": "string",
      "parent_type": "string",
      "project_id": "string",
      "service_account_client_email": "string",
      "service_account_client_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0,
      "service_account_private_key_id": "string",
      "service_account_project_id": "string",
      "status": "string"
    }
  ]
}

UpdateCSPMGCPServiceAccountsExt

Patches the service account key for external clients.

Method PATCH

Route /cloud-connect-cspm-gcp/entities/service-accounts/v1

Scope CSPM registration: WRITE

PEP 8 update_gcp_service_account

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

List of GCP service accounts to validate. Overrides other keywords except for body.

client_email body · string

Client email associated with the service account.

client_id body · string

GCP Client ID.

private_key body · string

GCP private key.

private_key_id body · string

GCP private key ID.

project_id body · string

GCP project ID.

service_account_conditions body · list of dictionaries

GCP service account conditions.

service_account_id body · integer

GCP service account ID.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

service_account_conditions = [
    {
        "feature": "string",
        "is_visible": "boolean",
        "last_transition": "UTC date string",
        "message": "string",
        "reason": "string",
        "status": "string",
        "type": "string"
    }
]

response = falcon.update_gcp_service_account(client_email="string",
                                             client_id="string",
                                             private_key="string",
                                             private_key_id="string",
                                             project_id="string",
                                             resources="string",
                                             service_account_conditions=service_account_conditions,
                                             service_account_id=integer)
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

service_account_conditions = [
    {
        "feature": "string",
        "is_visible": "boolean",
        "last_transition": "UTC date string",
        "message": "string",
        "reason": "string",
        "status": "string",
        "type": "string"
    }
]

response = falcon.UpdateCSPMGCPServiceAccountsExt(client_email="string",
                                                  client_id="string",
                                                  private_key="string",
                                                  private_key_id="string",
                                                  project_id="string",
                                                  resources="string",
                                                  service_account_conditions=service_account_conditions,
                                                  service_account_id=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "client_email": "string",
            "client_id": "string",
            "private_key": "string",
            "private_key_id": "string",
            "project_id": "string",
            "service_account_conditions": [
                {
                    "feature": "string",
                    "is_visible": boolean,
                    "last_transition": "string",
                    "message": "string",
                    "reason": "string",
                    "status": "string",
                    "type": "string"
                }
            ],
            "service_account_id": integer
        }
    ]
}

response = falcon.command("UpdateCSPMGCPServiceAccountsExt", body=body_payload)
print(response)

Edit-FalconCloudGcpServiceAccount -ServiceAccountId integer `
  -ServiceAccountCondition @{} `
  -ProjectId "string" `
  -ClientId "string" `
  -ClientEmail "string" `
  -PrivateKeyId "string" `
  -PrivateKey "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  client_email := "string"
  client_id := "string"
  private_key := "string"
  private_key_id := "string"
  project_id := "string"
  feature := "string"
  is_visible := boolean
  last_transition := "string"
  message := "string"
  reason := "string"
  status := "string"
  typeVar := "string"
  service_account_id := integer

  response, err := client.CspmRegistration.UpdateCSPMGCPServiceAccountsExt(
    &cspm_registration.UpdateCSPMGCPServiceAccountsExtParams{
      Body: &models.RegistrationGCPServiceAccountPatchRequestV1{
        Resources: []interface{}{
          {
          ClientEmail: &client_email,
          ClientID: &client_id,
          PrivateKey: &private_key,
          PrivateKeyID: &private_key_id,
          ProjectID: &project_id,
          ServiceAccountConditions: []interface{}{
            {
            Feature: &feature,
            IsVisible: &is_visible,
            LastTransition: &last_transition,
            Message: &message,
            Reason: &reason,
            Status: &status,
            Type: &typeVar,
            },
          },
          ServiceAccountID: &service_account_id,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.updateCSPMGCPServiceAccountsExt(
  {
    resources: [{
        clientEmail: "string",
        clientId: "string",
        privateKey: "string",
        privateKeyId: "string",
        projectId: "string",
        serviceAccountConditions: [{
            feature: "string",
            isVisible: boolean,
            lastTransition: "string",
            message: "string",
            reason: "string",
            status: "string",
            type: "string"
          }],
        serviceAccountId: integer
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::update_cspmgcp_service_accounts_ext;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RegistrationGcpServiceAccountPatchRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RegistrationGcpServiceAccountPatchRequestV1 {
        resources: vec![],
        ..Default::default()
    };

    let response = update_cspmgcp_service_accounts_ext(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

body = Falcon::RegistrationGCPServiceAccountPatchRequestV1.new(
  resources: [{
      client_email: 'string',
      client_id: 'string',
      private_key: 'string',
      private_key_id: 'string',
      project_id: 'string',
      service_account_conditions: [{
          feature: 'string',
          is_visible: boolean,
          last_transition: 'string',
          message: 'string',
          reason: 'string',
          status: 'string',
          type: 'string'
        }],
      service_account_id: integer
    }]
)

response = api.update_cspm_gcp_service_accounts_ext(body)

puts response

Responses

[
  {
    "client_email": "string",
    "client_id": "string",
    "project_id": "string",
    "service_account_conditions": [],
    "service_account_id": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_email": "string",
      "client_id": "string",
      "project_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_email": "string",
      "client_id": "string",
      "project_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0
    }
  ]
}

UpdateCSPMPolicySettings

Updates a policy setting - can be used to override policy severity or to disable a policy entirely.

Method PATCH

Route /settings/entities/policy/v1

Scope CSPM registration: WRITE

PEP 8 update_policy_settings

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

account_id body · string

Account ID to update.

account_ids body · string or list of strings

Account IDs to update.

enabled body · boolean

Enabled / Disable flag.

policy_id body · integer

Policy ID to be updated.

region body · string or list of strings

List of regions.

severity body · string

Severity value to set for policy.

tag_excluded body · boolean

Exclude tags flag.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_policy_settings(account_id="string",
                                         account_ids=id_list,
                                         enabled=boolean,
                                         policy_id=integer,
                                         region=id_list,
                                         severity="string",
                                         tag_excluded=boolean)
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.UpdateCSPMPolicySettings(account_id="string",
                                           account_ids=id_list,
                                           enabled=boolean,
                                           policy_id=integer,
                                           region=id_list,
                                           severity="string",
                                           tag_excluded=boolean)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "resources": [
        {
            "account_id": "string",
            "account_ids": ["string"],
            "enabled": boolean,
            "policy_id": integer,
            "regions": ["string"],
            "severity": "string",
            "tag_excluded": boolean
        }
    ]
}

response = falcon.command("UpdateCSPMPolicySettings", body=body_payload)
print(response)

Edit-FalconCloudPolicy -Severity "string" `
  -Enabled $boolean `
  -Id integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  account_id := "string"
  enabled := boolean
  policy_id := integer
  severity := "string"
  tag_excluded := boolean

  response, err := client.CspmRegistration.UpdateCSPMPolicySettings(
    &cspm_registration.UpdateCSPMPolicySettingsParams{
      Body: &models.RegistrationPolicyRequestExtV1{
        Resources: []interface{}{
          {
          AccountID: &account_id,
          AccountIds: []string{"string"},
          Enabled: &enabled,
          PolicyID: &policy_id,
          Regions: []string{"string"},
          Severity: &severity,
          TagExcluded: &tag_excluded,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.updateCSPMPolicySettings(
  {
    resources: [{
        accountId: "string",
        accountIds: [],
        enabled: boolean,
        policyId: integer,
        regions: [],
        severity: "string",
        tagExcluded: boolean
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::update_cspm_policy_settings;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RegistrationPolicyRequestExtV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RegistrationPolicyRequestExtV1 {
        resources: vec![PolicyExtV1 {
            account_id: Some("string".to_string()),
            account_ids: vec!["string".to_string()],
            enabled: Some(boolean),
            policy_id: Some(integer),
            regions: vec!["string".to_string()],
            severity: Some("string".to_string()),
            tag_excluded: Some(boolean),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = update_cspm_policy_settings(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

body = Falcon::RegistrationPolicyRequestExtV1.new(
  resources: [{
      account_id: 'string',
      account_ids: [],
      enabled: boolean,
      policy_id: integer,
      regions: [],
      severity: 'string',
      tag_excluded: boolean
    }]
)

response = api.update_cspm_policy_settings(body)

puts response

Responses

[
  {
    "account_scope": "string",
    "attack_types": [],
    "cid": "string",
    "cis_benchmark": [],
    "cisa_benchmark": [],
    "cloud_asset_type": "string",
    "cloud_asset_type_id": 0,
    "cloud_provider": "string",
    "cloud_service": "string",
    "cloud_service_friendly": "string",
    "cloud_service_id": 0,
    "cloud_service_subtype": "string",
    "created_at": "string",
    "default_severity": "string",
    "fql_policy": "string",
    "hipaa_benchmark": [],
    "hitrust_benchmark": [],
    "is_global": false,
    "is_remediable": false,
    "iso_benchmark": [],
    "name": "string",
    "nist_benchmark": [],
    "pci_benchmark": [],
    "policy_id": 0,
    "policy_settings": [],
    "policy_timestamp": "string",
    "policy_type": "string",
    "remediation_summary": "string",
    "soc2_benchmark": [],
    "updated_at": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "account_scope": "string",
      "attack_types": [],
      "cid": "string",
      "cis_benchmark": [],
      "cisa_benchmark": [],
      "cloud_asset_type": "string",
      "cloud_asset_type_id": 0,
      "cloud_provider": "string",
      "cloud_service": "string",
      "cloud_service_friendly": "string",
      "cloud_service_id": 0,
      "cloud_service_subtype": "string",
      "created_at": "string",
      "default_severity": "string",
      "fql_policy": "string",
      "hipaa_benchmark": [],
      "hitrust_benchmark": [],
      "is_global": false,
      "is_remediable": false,
      "iso_benchmark": [],
      "name": "string",
      "nist_benchmark": [],
      "pci_benchmark": [],
      "policy_id": 0,
      "policy_settings": [],
      "policy_timestamp": "string",
      "policy_type": "string",
      "remediation_summary": "string",
      "soc2_benchmark": [],
      "updated_at": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "account_scope": "string",
      "attack_types": [],
      "cid": "string",
      "cis_benchmark": [],
      "cisa_benchmark": [],
      "cloud_asset_type": "string",
      "cloud_asset_type_id": 0,
      "cloud_provider": "string",
      "cloud_service": "string",
      "cloud_service_friendly": "string",
      "cloud_service_id": 0,
      "cloud_service_subtype": "string",
      "created_at": "string",
      "default_severity": "string",
      "fql_policy": "string",
      "hipaa_benchmark": [],
      "hitrust_benchmark": [],
      "is_global": false,
      "is_remediable": false,
      "iso_benchmark": [],
      "name": "string",
      "nist_benchmark": [],
      "pci_benchmark": [],
      "policy_id": 0,
      "policy_settings": [],
      "policy_timestamp": "string",
      "policy_type": "string",
      "remediation_summary": "string",
      "soc2_benchmark": [],
      "updated_at": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "account_scope": "string",
      "attack_types": [],
      "cid": "string",
      "cis_benchmark": [],
      "cisa_benchmark": [],
      "cloud_asset_type": "string",
      "cloud_asset_type_id": 0,
      "cloud_provider": "string",
      "cloud_service": "string",
      "cloud_service_friendly": "string",
      "cloud_service_id": 0,
      "cloud_service_subtype": "string",
      "created_at": "string",
      "default_severity": "string",
      "fql_policy": "string",
      "hipaa_benchmark": [],
      "hitrust_benchmark": [],
      "is_global": false,
      "is_remediable": false,
      "iso_benchmark": [],
      "name": "string",
      "nist_benchmark": [],
      "pci_benchmark": [],
      "policy_id": 0,
      "policy_settings": [],
      "policy_timestamp": "string",
      "policy_type": "string",
      "remediation_summary": "string",
      "soc2_benchmark": [],
      "updated_at": "string"
    }
  ]
}

UpdateCSPMScanSchedule

Updates scan schedule configuration for one or more cloud platforms.

Method POST

Route /settings/scan-schedule/v1

Scope CSPM registration: WRITE

PEP 8 update_scan_schedule

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

cloud_platform body · string

Cloud platform.

next_scan_timestamp body · string

Time to schedule scan. UTC date formatted.

scan_interval body · string

Scan interval.

scan_schedule body · string

Scan schedule type.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.update_scan_schedule(cloud_platform="string",
                                       next_scan_timestamp="string",
                                       scan_interval="string",
                                       scan_schedule="string")
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.UpdateCSPMScanSchedule(cloud_platform="string",
                                         next_scan_timestamp="string",
                                         scan_interval="string",
                                         scan_schedule="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "cloud_platform": "string",
            "last_scan_completed_at": "string",
            "next_scan_timestamp": "string",
            "scan_interval": "string",
            "scan_schedule": "string"
        }
    ]
}

response = falcon.command("UpdateCSPMScanSchedule", body=body_payload)
print(response)

Edit-FalconCloudSchedule -ScanSchedule "string" -CloudPlatform "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cloud_platform := "string"
  last_scan_completed_at := "string"
  next_scan_timestamp := "string"
  scan_interval := "string"
  scan_schedule := "string"

  response, err := client.CspmRegistration.UpdateCSPMScanSchedule(
    &cspm_registration.UpdateCSPMScanScheduleParams{
      Body: &models.RegistrationScanScheduleUpdateRequestV1{
        Resources: []interface{}{
          {
          CloudPlatform: &cloud_platform,
          LastScanCompletedAt: &last_scan_completed_at,
          NextScanTimestamp: &next_scan_timestamp,
          ScanInterval: &scan_interval,
          ScanSchedule: &scan_schedule,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.updateCSPMScanSchedule(
  {
    resources: [{
        cloudPlatform: "string",
        lastScanCompletedAt: "string",
        nextScanTimestamp: "string",
        scanInterval: "string",
        scanSchedule: "string"
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::update_cspm_scan_schedule;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RegistrationScanScheduleUpdateRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RegistrationScanScheduleUpdateRequestV1 {
        resources: vec![ScanScheduleDataV1 {
            cloud_platform: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = update_cspm_scan_schedule(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

body = Falcon::RegistrationScanScheduleUpdateRequestV1.new(
  resources: [{
      cloud_platform: 'string',
      last_scan_completed_at: 'string',
      next_scan_timestamp: 'string',
      scan_interval: 'string',
      scan_schedule: 'string'
    }]
)

response = api.update_cspm_scan_schedule(body)

puts response

Responses

[
  {
    "cloud_platform": "string",
    "last_scan_completed_at": "string",
    "next_scan_timestamp": "string",
    "scan_interval": "string",
    "scan_schedule": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cloud_platform": "string",
      "last_scan_completed_at": "string",
      "next_scan_timestamp": "string",
      "scan_interval": "string",
      "scan_schedule": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cloud_platform": "string",
      "last_scan_completed_at": "string",
      "next_scan_timestamp": "string",
      "scan_interval": "string",
      "scan_schedule": "string"
    }
  ]
}

ValidateCSPMGCPServiceAccountExt

Validates credentials for a service account

Method POST

Route /cloud-connect-cspm-gcp/entities/service-accounts/validate/v1

Scope CSPM registration: WRITE

PEP 8 validate_gcp_service_account

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

List of GCP service accounts to validate. Overrides other keywords except for body.

client_email body · string

Client email associated with the service account.

client_id body · string

GCP Client ID.

private_key body · string

GCP private key.

private_key_id body · string

GCP private key ID.

project_id body · string

GCP project ID.

service_account_conditions body · list of dictionaries

GCP service account conditions.

service_account_id body · integer

GCP service account ID.

Code Examples

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

service_account_conditions = [
    {
        "last_transition": "2024-03-19T22:48:28.987Z",
        "message": "string",
        "reason": "string",
        "status": "string",
        "type": "string"
    }
]

response = falcon.validate_gcp_service_account(client_email="string",
                                               client_id="string",
                                               private_key="string",
                                               private_key_id="string",
                                               project_id="string",
                                               resources="string",
                                               service_account_conditions=service_account_conditions,
                                               service_account_id=integer)
print(response)

from falconpy import CSPMRegistration

falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

service_account_conditions = [
    {
        "last_transition": "2024-03-19T22:48:28.987Z",
        "message": "string",
        "reason": "string",
        "status": "string",
        "type": "string"
    }
]

response = falcon.ValidateCSPMGCPServiceAccountExt(client_email="string",
                                                   client_id="string",
                                                   private_key="string",
                                                   private_key_id="string",
                                                   project_id="string",
                                                   resources="string",
                                                   service_account_conditions=service_account_conditions,
                                                   service_account_id=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "client_email": "string",
            "client_id": "string",
            "private_key": "string",
            "private_key_id": "string",
            "project_id": "string",
            "service_account_conditions": [
                {
                    "feature": "string",
                    "is_visible": boolean,
                    "last_transition": "string",
                    "message": "string",
                    "reason": "string",
                    "status": "string",
                    "type": "string"
                }
            ],
            "service_account_id": integer
        }
    ]
}

response = falcon.command("ValidateCSPMGCPServiceAccountExt", body=body_payload)
print(response)

Test-FalconCloudGcpServiceAccount -ServiceAccountId integer `
  -ServiceAccountCondition @{} `
  -ProjectId "string" `
  -ClientId "string" `
  -ClientEmail "string" `
  -PrivateKeyId "string" `
  -PrivateKey "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/cspm_registration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  client_email := "string"
  client_id := "string"
  private_key := "string"
  private_key_id := "string"
  project_id := "string"
  feature := "string"
  is_visible := boolean
  last_transition := "string"
  message := "string"
  reason := "string"
  status := "string"
  typeVar := "string"
  service_account_id := integer

  response, err := client.CspmRegistration.ValidateCSPMGCPServiceAccountExt(
    &cspm_registration.ValidateCSPMGCPServiceAccountExtParams{
      Body: &models.RegistrationGCPServiceAccountValidationRequestV1{
        Resources: []interface{}{
          {
          ClientEmail: &client_email,
          ClientID: &client_id,
          PrivateKey: &private_key,
          PrivateKeyID: &private_key_id,
          ProjectID: &project_id,
          ServiceAccountConditions: []interface{}{
            {
            Feature: &feature,
            IsVisible: &is_visible,
            LastTransition: &last_transition,
            Message: &message,
            Reason: &reason,
            Status: &status,
            Type: &typeVar,
            },
          },
          ServiceAccountID: &service_account_id,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cspmRegistration.validateCSPMGCPServiceAccountExt(
  {
    resources: [{
        clientEmail: "string",
        clientId: "string",
        privateKey: "string",
        privateKeyId: "string",
        projectId: "string",
        serviceAccountConditions: [{
            feature: "string",
            isVisible: boolean,
            lastTransition: "string",
            message: "string",
            reason: "string",
            status: "string",
            type: "string"
          }],
        serviceAccountId: integer
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::cspm_registration_api::validate_cspmgcp_service_account_ext;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RegistrationGcpServiceAccountValidationRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RegistrationGcpServiceAccountValidationRequestV1 {
        resources: vec![],
        ..Default::default()
    };

    let response = validate_cspmgcp_service_account_ext(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CspmRegistration.new

body = Falcon::RegistrationGCPServiceAccountValidationRequestV1.new(
  resources: [{
      client_email: 'string',
      client_id: 'string',
      private_key: 'string',
      private_key_id: 'string',
      project_id: 'string',
      service_account_conditions: [{
          feature: 'string',
          is_visible: boolean,
          last_transition: 'string',
          message: 'string',
          reason: 'string',
          status: 'string',
          type: 'string'
        }],
      service_account_id: integer
    }]
)

response = api.validate_cspm_gcp_service_account_ext(body)

puts response

Responses

[
  {
    "client_email": "string",
    "client_id": "string",
    "project_id": "string",
    "service_account_conditions": [],
    "service_account_id": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_email": "string",
      "client_id": "string",
      "project_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_email": "string",
      "client_id": "string",
      "project_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_email": "string",
      "client_id": "string",
      "project_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_email": "string",
      "client_id": "string",
      "project_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0
    }
  ]
}

CSPM Registration

Table of Contents

AzureRefreshCertificate

Parameters

ConnectCSPMGCPAccount

Parameters

CreateCSPMAwsAccount

Parameters

CreateCSPMAzureAccount

Parameters

CreateCSPMAzureManagementGroup

Parameters

CreateCSPMGCPAccount

Parameters

DeleteCSPMAwsAccount

Parameters

DeleteCSPMAzureAccount

Parameters

DeleteCSPMAzureManagementGroup

Parameters

DeleteCSPMGCPAccount

Parameters

DiscoverCloudAzureDownloadCertificate

Parameters

GetBehaviorDetections

Parameters

getCloudEventIDs

Parameters

GetConfigurationDetectionEntities

Parameters

GetConfigurationDetectionIDsV2

Parameters

GetConfigurationDetections

Parameters

GetCSPMAwsAccount

Parameters

GetCSPMAwsAccountScriptsAttachment

Parameters

GetCSPMAwsConsoleSetupURLs

Parameters

GetCSPMAzureAccount

Parameters

GetCSPMAzureManagementGroup

Parameters

GetCSPMAzureUserScriptsAttachment

Parameters

GetCSPMGCPAccount

Parameters

GetCSPMGCPServiceAccountsExt

Parameters

GetCSPMGCPUserScriptsAttachment

Parameters

GetCSPMGCPValidateAccountsExt

Parameters

GetCSPMPoliciesDetails

Parameters

GetCSPMPolicy

Parameters

GetCSPMPolicySettings

Parameters

GetCSPMScanSchedule

Parameters

GetIOAEvents

Parameters

GetIOAUsers

Parameters

PatchCSPMAwsAccount

Parameters

UpdateCSPMAzureAccount

Parameters

UpdateCSPMAzureAccountClientID

Parameters

UpdateCSPMAzureTenantDefaultSubscriptionID

Parameters

UpdateCSPMGCPAccount

Parameters

UpdateCSPMGCPServiceAccountsExt

Parameters

UpdateCSPMPolicySettings

Parameters