Custom IOA

The Custom IOA service collection provides operations for managing custom Indicator of Attack (IOA) rules and rule groups. Create, update, delete, and query rule groups, rules, and rule types. Validate field values and retrieve platform and pattern severity information.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

This service collection has code examples posted to the repository.

Operation	Description
create-rule `create_rule`	Create a rule within a rule group.
create-rule-groupMixin0 `create_rule_group`	Create a rule group for a platform with a name and an optional description.
delete-rule-groupsMixin0 `delete_rule_groups`	Delete rule groups by ID.
delete-rules `delete_rules`	Delete rules from a rule group by ID.
get-patterns `get_patterns`	Get pattern severities by ID.
get-platformsMixin0 `get_platforms`	Get platforms by ID.
get-rule-groupsMixin0 `get_rule_groups`	Get rule groups by ID.
get-rule-types `get_rule_types`	Get rule types by ID.
get-rules-get `get_rules_get`	Get rules by ID and optionally with cid and/or version in the following format: `[cid:]ID[:version]`.
get-rulesMixin0 `get_rules`	Get rules by ID and optionally with cid and/or version in the following format: `[cid:]ID[:version]`.
query-patterns `query_patterns`	Get all pattern severity IDs.
query-platformsMixin0 `query_platforms`	Get all platform IDs.
query-rule-groups-full `query_rule_groups_full`	Find all rule groups matching the query with optional filter.
query-rule-groupsMixin0 `query_rule_groups`	Finds all rule group IDs matching the query with optional filter.
query-rule-types `query_rule_types`	Get all rule type IDs.
query-rulesMixin0 `query_rules`	Finds all rule IDs matching the query with optional filter.
update-rule-groupMixin0 `update_rule_group`	Update a rule group.
update-rules `update_rules`	Update rules within a rule group.
update-rules-v2 `update_rules_v2`	Update name, description, enabled or field_values for individual rules within a rule group.
validate `validate`	Validates field values and checks for matches if a test string is provided.

create-rule

Create a rule within a rule group.

Method POST

Route /ioarules/entities/rules/v1

Scope Custom IOA rules: WRITE

PEP 8 create_rule

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

comment body · string

Comment related to this update.

description body · string

Rule description.

disposition_id body · integer

Disposition ID.

field_values body · array

Rule values represented as an object.

name body · string

Name of the rule.

pattern_severity body · string

Severity.

rulegroup_id body · string

ID of the rule group.

ruletype_id body · string

ID of the rule type.

Code Examples

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

field_values = [
    {
        "final_value": "string",
        "label": "string",
        "name": "string",
        "type": "string",
        "value": "string",
        "values": [
            {
                "label": "string",
                "value": "string"
            }
        ]
    }
]

response = falcon.create_rule(comment="string",
                              description="string",
                              disposition_id=integer,
                              field_values=field_values,
                              name="string",
                              pattern_severity="string",
                              rulegroup_id="string",
                              ruletype_id="string")
print(response)

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

field_values = [
    {
        "final_value": "string",
        "label": "string",
        "name": "string",
        "type": "string",
        "value": "string",
        "values": [
            {
                "label": "string",
                "value": "string"
            }
        ]
    }
]

response = falcon.create_rule(comment="string",
                              description="string",
                              disposition_id=integer,
                              field_values=field_values,
                              name="string",
                              pattern_severity="string",
                              rulegroup_id="string",
                              ruletype_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "comment": "string",
    "description": "string",
    "disposition_id": integer,
    "field_values": [
        {
            "final_value": "string",
            "label": "string",
            "name": "string",
            "type": "string",
            "value": "string",
            "values": [
                {
                    "label": "string",
                    "value": "string"
                }
            ]
        }
    ],
    "name": "string",
    "pattern_severity": "string",
    "rulegroup_id": "string",
    "ruletype_id": "string"
}

response = falcon.command("create_rule", body=body_payload)
print(response)

New-FalconIoaRule -Name "string" `
  -PatternSeverity "string" `
  -RuletypeId "string" `
  -DispositionId integer `
  -Description "string" `
  -RulegroupId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/custom_ioa"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  description := "string"
  disposition_id := integer
  final_value := "string"
  label := "string"
  name := "string"
  typeVar := "string"
  value := "string"
  pattern_severity := "string"
  rulegroup_id := "string"
  ruletype_id := "string"

  response, err := client.CustomIoa.CreateRule(
    &custom_ioa.CreateRuleParams{
      Body: &models.APIRuleCreateV1{
        Comment: &comment,
        Description: &description,
        DispositionID: &disposition_id,
        FieldValues: []interface{}{
          {
          FinalValue: &final_value,
          Label: &label,
          Name: &name,
          Type: &typeVar,
          Value: &value,
          Values: []interface{}{
            {
            Label: &label,
            Value: &value,
            },
          },
          },
        },
        Name: &name,
        PatternSeverity: &pattern_severity,
        RulegroupID: &rulegroup_id,
        RuletypeID: &ruletype_id,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.customIoa.createRule(
  {
    comment: "string",
    description: "string",
    dispositionId: integer,
    fieldValues: [{
        finalValue: "string",
        label: "string",
        name: "string",
        type: "string",
        value: "string",
        values: [{
            label: "string",
            value: "string"
          }]
      }],
    name: "string",
    patternSeverity: "string",
    rulegroupId: "string",
    ruletypeId: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::custom_ioa_api::create_rule;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApiRuleCreateV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ApiRuleCreateV1 {
        comment: Some("string".to_string()),
        description: Some("string".to_string()),
        disposition_id: Some(integer),
        field_values: vec![FieldValue {
            name: Some("string".to_string()),
            type: Some("string".to_string()),
            value: Some("string".to_string()),
            values: vec![ValueItem {
                label: Some("string".to_string()),
                value: Some("string".to_string()),
                ..Default::default()
            }],
            ..Default::default()
        }],
        name: Some("string".to_string()),
        pattern_severity: Some("string".to_string()),
        rulegroup_id: Some("string".to_string()),
        ruletype_id: Some("string".to_string()),
        ..Default::default()
    };

    let response = create_rule(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CustomIoa.new

body = Falcon::ApiRuleCreateV1.new(
  comment: 'string',
  description: 'string',
  disposition_id: integer,
  field_values: [{
      final_value: 'string',
      label: 'string',
      name: 'string',
      type: 'string',
      value: 'string',
      values: [{
          label: 'string',
          value: 'string'
        }]
    }],
  name: 'string',
  pattern_severity: 'string',
  rulegroup_id: 'string',
  ruletype_id: 'string'
)

response = api.create_rule(body)

puts response

Responses

[
  {
    "action_label": "string",
    "comment": "string",
    "committed_on": "string",
    "created_by": "string",
    "created_on": "string",
    "customer_id": "string",
    "deleted": false,
    "description": "string",
    "disposition_id": 0,
    "enabled": false,
    "field_values": [],
    "instance_id": "string",
    "instance_version": 0,
    "magic_cookie": 0,
    "modified_by": "string",
    "modified_on": "string",
    "name": "string",
    "pattern_id": "string",
    "pattern_severity": "string",
    "rulegroup_id": "string",
    "ruletype_id": "string",
    "ruletype_name": "string",
    "version_ids": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

create-rule-groupMixin0

Create a rule group for a platform with a name and an optional description.

Method POST

Route /ioarules/entities/rule-groups/v1

Scope Custom IOA rules: WRITE

PEP 8 create_rule_group

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

comment body · string

Comment for the rule group.

description body · string

Rule group description.

name body · string

Name of the rule group.

platform body · string

Platform this rule group applies to. Allowed values:

Available values (3)

windows mac linux

Code Examples

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.create_rule_group(comment="string",
                                    description="string",
                                    name="string",
                                    platform="string")
print(response)

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.create_rule_groupMixin0(comment="string",
                                          description="string",
                                          name="string",
                                          platform="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "comment": "string",
    "description": "string",
    "name": "string",
    "platform": "string"
}

response = falcon.command("create_rule_groupMixin0", body=body_payload)
print(response)

New-FalconIoaGroup -Name "string" -Platform "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/custom_ioa"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  description := "string"
  name := "string"
  platform := "string"

  response, err := client.CustomIoa.CreateRuleGroupMixin0(
    &custom_ioa.CreateRuleGroupMixin0Params{
      Body: &models.APIRuleGroupCreateRequestV1{
        Comment: &comment,
        Description: &description,
        Name: &name,
        Platform: &platform,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.customIoa.createRuleGroupMixin0(
  {
    comment: "string",
    description: "string",
    name: "string",
    platform: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::custom_ioa_api::create_rule_group_mixin0;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApiRuleGroupCreateRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ApiRuleGroupCreateRequestV1 {
        comment: Some("string".to_string()),
        description: Some("string".to_string()),
        name: Some("string".to_string()),
        platform: Some("string".to_string()),
        ..Default::default()
    };

    let response = create_rule_group_mixin0(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CustomIoa.new

body = Falcon::ApiRuleGroupCreateRequestV1.new(
  comment: 'string',
  description: 'string',
  name: 'string',
  platform: 'string'
)

response = api.create_rule_group_mixin0(body)

puts response

Responses

[
  {
    "comment": "string",
    "committed_on": "string",
    "created_by": "string",
    "created_on": "string",
    "customer_id": "string",
    "deleted": false,
    "description": "string",
    "enabled": false,
    "id": "string",
    "modified_by": "string",
    "modified_on": "string",
    "name": "string",
    "platform": "string",
    "rule_ids": [],
    "rules": [],
    "version": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

delete-rule-groupsMixin0

Delete rule groups by ID.

Method DELETE

Route /ioarules/entities/rule-groups/v1

Scope Custom IOA rules: WRITE

PEP 8 delete_rule_groups

Parameters

comment query · string

Explains why the entity is being deleted

ids query · string or list of strings

The IDs of the entities

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_rule_groups(comment="string", ids=id_list)
print(response)

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_rule_groupsMixin0(comment="string", ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("delete_rule_groupsMixin0",
                          comment="string",
                          ids=id_list)
print(response)

Remove-FalconIoaGroup -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/custom_ioa"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"

  response, err := client.CustomIoa.DeleteRuleGroupsMixin0(
    &custom_ioa.DeleteRuleGroupsMixin0Params{
      Comment: &comment,
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.customIoa.deleteRuleGroupsMixin0(
  ["ID1", "ID2", "ID3"],  // ids
  "string"  // comment
);

console.log(response);

use rusty_falcon::apis::custom_ioa_api::delete_rule_groups_mixin0;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_rule_groups_mixin0(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
        Some("string"),  // comment
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CustomIoa.new

response = api.delete_rule_groups_mixin0(['ID1', 'ID2', 'ID3'])

puts response

Responses

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

delete-rules

Delete rules from a rule group by ID.

Method DELETE

Route /ioarules/entities/rules/v1

Scope Custom IOA rules: WRITE

PEP 8 delete_rules

Parameters

rule_group_id query · string

The parent rule group

comment query · string

Explains why the entity is being deleted

ids query · string or list of strings

The IDs of the entities

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_rules(comment="string",
                               ids=id_list,
                               rule_group_id="string")
print(response)

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_rules(comment="string",
                               ids=id_list,
                               rule_group_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("delete_rules",
                          rule_group_id="string",
                          comment="string",
                          ids=id_list)
print(response)

Remove-FalconIoaRule -RuleGroupId "string" -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/custom_ioa"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"

  response, err := client.CustomIoa.DeleteRules(
    &custom_ioa.DeleteRulesParams{
      RuleGroupID: "string",
      Comment: &comment,
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.customIoa.deleteRules(
  "string",  // ruleGroupId
  ["ID1", "ID2", "ID3"],  // ids
  "string"  // comment
);

console.log(response);

use rusty_falcon::apis::filevantage_api::delete_rules;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_rules(
        &falcon.cfg,  // configuration
        "string",  // rule_group_id
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CustomIoa.new

response = api.delete_rules('string', ['ID1', 'ID2', 'ID3'])

puts response

Responses

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

get-patterns

Get pattern severities by ID.

Method GET

Route /ioarules/entities/pattern-severities/v1

Scope Custom IOA rules: READ

PEP 8 get_patterns

Parameters

ids query · string or list of strings

The IDs of the entities

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_patterns(ids=id_list)
print(response)

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_patterns(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_patterns",
                          ids=id_list)
print(response)

Get-FalconIoaSeverity -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/custom_ioa"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CustomIoa.GetPatterns(
    &custom_ioa.GetPatternsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.customIoa.getPatterns(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::custom_ioa_api::get_patterns;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_patterns(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CustomIoa.new

response = api.get_patterns(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "name": "string",
    "severity": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

get-platformsMixin0

Get platforms by ID.

Method GET

Route /ioarules/entities/platforms/v1

Scope Custom IOA rules: READ

PEP 8 get_platforms

Parameters

ids query · string or list of strings

The IDs of the entities

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_platforms(ids=id_list)
print(response)

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_platformsMixin0(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_platformsMixin0",
                          ids=id_list)
print(response)

Get-FalconIoaPlatform -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/custom_ioa"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CustomIoa.GetPlatformsMixin0(
    &custom_ioa.GetPlatformsMixin0Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.customIoa.getPlatformsMixin0(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::custom_ioa_api::get_platforms_mixin0;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_platforms_mixin0(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CustomIoa.new

response = api.get_platforms_mixin0(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "id": "string",
    "label": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

get-rule-groupsMixin0

Get rule groups by ID.

Method GET

Route /ioarules/entities/rule-groups/v1

Scope Custom IOA rules: READ

PEP 8 get_rule_groups

Parameters

ids query · string or list of strings

The IDs of the entities

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rule_groups(ids=id_list)
print(response)

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rule_groupsMixin0(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_rule_groupsMixin0",
                          ids=id_list)
print(response)

Get-FalconIoaGroup -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/custom_ioa"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CustomIoa.GetRuleGroupsMixin0(
    &custom_ioa.GetRuleGroupsMixin0Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.customIoa.getRuleGroupsMixin0(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::custom_ioa_api::get_rule_groups_mixin0;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_rule_groups_mixin0(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CustomIoa.new

response = api.get_rule_groups_mixin0(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "comment": "string",
    "committed_on": "string",
    "created_by": "string",
    "created_on": "string",
    "customer_id": "string",
    "deleted": false,
    "description": "string",
    "enabled": false,
    "id": "string",
    "modified_by": "string",
    "modified_on": "string",
    "name": "string",
    "platform": "string",
    "rule_ids": [],
    "rules": [],
    "version": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

get-rule-types

Get rule types by ID.

Method GET

Route /ioarules/entities/rule-types/v1

Scope Custom IOA rules: READ

PEP 8 get_rule_types

Parameters

ids query · string or list of strings

The IDs of the entities

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rule_types(ids=id_list)
print(response)

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rule_types(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_rule_types",
                          ids=id_list)
print(response)

Get-FalconIoaType -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/custom_ioa"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CustomIoa.GetRuleTypes(
    &custom_ioa.GetRuleTypesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.customIoa.getRuleTypes(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::custom_ioa_api::get_rule_types;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_rule_types(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CustomIoa.new

response = api.get_rule_types(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "channel": 0,
    "disposition_map": [],
    "fields": [],
    "id": "string",
    "long_desc": "string",
    "name": "string",
    "platform": "string",
    "released": false
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

get-rules-get

Get rules by ID and optionally with cid and/or version in the following format: [cid:]ID[:version].

Method POST

Route /ioarules/entities/rules/GET/v1

Scope Custom IOA rules: READ

PEP 8 get_rules_get

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

ids body · array

Rule IDs to retrieve.

Code Examples

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rules_get(ids=id_list)
print(response)

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rules_get(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "ids": ["string"]
}

response = falcon.command("get_rules_get", body=body_payload)
print(response)

Get-FalconIoaRule -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/custom_ioa"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CustomIoa.GetRulesGet(
    &custom_ioa.GetRulesGetParams{
      Body: &models.APIRulesGetRequestV1{
        Ids: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.customIoa.getRulesGet(
  {
    ids: []
}  // body
);

console.log(response);

use rusty_falcon::apis::custom_ioa_api::get_rules_get;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApiRulesGetRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ApiRulesGetRequestV1 {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = get_rules_get(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CustomIoa.new

body = Falcon::ApiRulesGetRequestV1.new(
  ids: []
)

response = api.get_rules_get(body)

puts response

Responses

[
  {
    "action_label": "string",
    "comment": "string",
    "committed_on": "string",
    "created_by": "string",
    "created_on": "string",
    "customer_id": "string",
    "deleted": false,
    "description": "string",
    "disposition_id": 0,
    "enabled": false,
    "field_values": [],
    "instance_id": "string",
    "instance_version": 0,
    "magic_cookie": 0,
    "modified_by": "string",
    "modified_on": "string",
    "name": "string",
    "pattern_id": "string",
    "pattern_severity": "string",
    "rulegroup_id": "string",
    "ruletype_id": "string",
    "ruletype_name": "string",
    "version_ids": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

get-rulesMixin0

Get rules by ID and optionally with cid and/or version in the following format: [cid:]ID[:version].

Method GET

Route /ioarules/entities/rules/v1

Scope Custom IOA rules: READ

PEP 8 get_rules

Parameters

ids query · string or list of strings

The IDs of the entities

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rules(ids=id_list)
print(response)

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rulesMixin0(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_rulesMixin0",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/custom_ioa"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.CustomIoa.GetRulesMixin0(
    &custom_ioa.GetRulesMixin0Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.customIoa.getRulesMixin0(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::custom_ioa_api::get_rules_mixin0;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_rules_mixin0(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CustomIoa.new

response = api.get_rules_mixin0(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "action_label": "string",
    "comment": "string",
    "committed_on": "string",
    "created_by": "string",
    "created_on": "string",
    "customer_id": "string",
    "deleted": false,
    "description": "string",
    "disposition_id": 0,
    "enabled": false,
    "field_values": [],
    "instance_id": "string",
    "instance_version": 0,
    "magic_cookie": 0,
    "modified_by": "string",
    "modified_on": "string",
    "name": "string",
    "pattern_id": "string",
    "pattern_severity": "string",
    "rulegroup_id": "string",
    "ruletype_id": "string",
    "ruletype_name": "string",
    "version_ids": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

query-patterns

Get all pattern severity IDs.

Method GET

Route /ioarules/queries/pattern-severities/v1

Scope Custom IOA rules: READ

PEP 8 query_patterns

Parameters

offset query · string

Starting index of overall result set from which to return IDs

limit query · integer

Number of IDs to return

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.query_patterns(limit=integer, offset="string")
print(response)

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.query_patterns(limit=integer, offset="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("query_patterns",
                          offset="string",
                          limit=integer)
print(response)

Get-FalconIoaSeverity -Limit integer -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/custom_ioa"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := "string"
  limit := int64(0)

  response, err := client.CustomIoa.QueryPatterns(
    &custom_ioa.QueryPatternsParams{
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.customIoa.queryPatterns(
  "string",  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::custom_ioa_api::query_patterns;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_patterns(
        &falcon.cfg,  // configuration
        Some("string"),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CustomIoa.new

response = api.query_patterns(offset: 'string', limit: integer)

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

query-platformsMixin0

Get all platform IDs.

Method GET

Route /ioarules/queries/platforms/v1

Scope Custom IOA rules: READ

PEP 8 query_platforms

Parameters

offset query · string

Starting index of overall result set from which to return IDs

limit query · integer

Number of IDs to return

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.query_platforms(limit=integer, offset="string")
print(response)

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.query_platformsMixin0(limit=integer, offset="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("query_platformsMixin0",
                          offset="string",
                          limit=integer)
print(response)

Get-FalconIoaPlatform -Limit integer -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/custom_ioa"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := "string"
  limit := int64(0)

  response, err := client.CustomIoa.QueryPlatformsMixin0(
    &custom_ioa.QueryPlatformsMixin0Params{
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.customIoa.queryPlatformsMixin0(
  "string",  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::custom_ioa_api::query_platforms_mixin0;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_platforms_mixin0(
        &falcon.cfg,  // configuration
        Some("string"),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CustomIoa.new

response = api.query_platforms_mixin0(offset: 'string', limit: integer)

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

query-rule-groups-full

Find all rule groups matching the query with optional filter.

Method GET

Route /ioarules/queries/rule-groups-full/v1

Scope Custom IOA rules: READ

PEP 8 query_rule_groups_full

Parameters

sort query · string

The property to sort by. (Ex: modified_on.desc) Available sort fields:

Available values (6)

`created_by`	`created_on`	`enabled`
`modified_by`	`modified_on`	`name`

filter query · string

FQL Syntax formatted string used to limit the results. Available filters:Filter range criteria: You may use any common date format, such as 2010-05-15T14:55:21.892315096Z for date format fields.

Available values (12)

`enabled`	`platform`	`name`
`description`	`rules.action_label`	`rules.name`
`rules.description`	`rules.pattern_severity`	`rules.ruletype_name`
`rules.enabled`	`created_on`	`modified_on`

q query · string

Match query criteria, which includes all the filter string fields

offset query · string

Starting index of overall result set from which to return IDs

limit query · integer

Number of IDs to return

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.query_rule_groups_full(filter="string",
                                         limit=integer,
                                         offset="string",
                                         q="string",
                                         sort="string")
print(response)

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.query_rule_groups_full(filter="string",
                                         limit=integer,
                                         offset="string",
                                         q="string",
                                         sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("query_rule_groups_full",
                          sort="string",
                          filter="string",
                          q="string",
                          offset="string",
                          limit=integer)
print(response)

Get-FalconIoaGroup -Filter "string" `
  -Query "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/custom_ioa"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  sort := "string"
  filter := "string"
  q := "string"
  offset := "string"
  limit := int64(0)

  response, err := client.CustomIoa.QueryRuleGroupsFull(
    &custom_ioa.QueryRuleGroupsFullParams{
      Sort: &sort,
      Filter: &filter,
      Q: &q,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.customIoa.queryRuleGroupsFull(
  "string",  // sort
  "string",  // filter
  "string",  // q
  "string",  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::custom_ioa_api::query_rule_groups_full;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_rule_groups_full(
        &falcon.cfg,  // configuration
        Some("string"),  // sort
        Some("string"),  // filter
        Some("string"),  // q
        Some("string"),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CustomIoa.new

response = api.query_rule_groups_full(sort: 'string',
                                      filter: 'string',
                                      q: 'string',
                                      offset: 'string',
                                      limit: integer)

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

query-rule-groupsMixin0

Finds all rule group IDs matching the query with optional filter.

Method GET

Route /ioarules/queries/rule-groups/v1

Scope Custom IOA rules: READ

PEP 8 query_rule_groups

Parameters

sort query · string

The property to sort by. (Ex: modified_on.desc) Available sort fields:

Available values (6)

`created_by`	`created_on`	`enabled`
`modified_by`	`modified_on`	`name`

filter query · string

FQL Syntax formatted string used to limit the results. Available filters:Filter range criteria: You may use any common date format, such as 2010-05-15T14:55:21.892315096Z for date format fields.

Available values (12)

`enabled`	`platform`	`name`
`description`	`rules.action_label`	`rules.name`
`rules.description`	`rules.pattern_severity`	`rules.ruletype_name`
`rules.enabled`	`created_on`	`modified_on`

q query · string

Match query criteria, which includes all the filter string fields

offset query · string

Starting index of overall result set from which to return IDs

limit query · integer

Number of IDs to return

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.query_rule_groups(filter="string",
                                    limit=integer,
                                    offset="string",
                                    q="string",
                                    sort="string")
print(response)

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.query_rule_groupsMixin0(filter="string",
                                          limit=integer,
                                          offset="string",
                                          q="string",
                                          sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("query_rule_groupsMixin0",
                          sort="string",
                          filter="string",
                          q="string",
                          offset="string",
                          limit=integer)
print(response)

Get-FalconIoaGroup -Filter "string" `
  -Query "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/custom_ioa"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  sort := "string"
  filter := "string"
  q := "string"
  offset := "string"
  limit := int64(0)

  response, err := client.CustomIoa.QueryRuleGroupsMixin0(
    &custom_ioa.QueryRuleGroupsMixin0Params{
      Sort: &sort,
      Filter: &filter,
      Q: &q,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.customIoa.queryRuleGroupsMixin0(
  "string",  // sort
  "string",  // filter
  "string",  // q
  "string",  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::custom_ioa_api::query_rule_groups_mixin0;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_rule_groups_mixin0(
        &falcon.cfg,  // configuration
        Some("string"),  // sort
        Some("string"),  // filter
        Some("string"),  // q
        Some("string"),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CustomIoa.new

response = api.query_rule_groups_mixin0(sort: 'string',
                                        filter: 'string',
                                        q: 'string',
                                        offset: 'string',
                                        limit: integer)

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

query-rule-types

Get all rule type IDs.

Method GET

Route /ioarules/queries/rule-types/v1

Scope Custom IOA rules: READ

PEP 8 query_rule_types

Parameters

offset query · string

Starting index of overall result set from which to return IDs

limit query · integer

Number of IDs to return

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.query_rule_types(limit=integer, offset="string")
print(response)

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.query_rule_types(limit=integer, offset="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("query_rule_types",
                          offset="string",
                          limit=integer)
print(response)

Get-FalconIoaType -Limit integer -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/custom_ioa"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := "string"
  limit := int64(0)

  response, err := client.CustomIoa.QueryRuleTypes(
    &custom_ioa.QueryRuleTypesParams{
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.customIoa.queryRuleTypes(
  "string",  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::custom_ioa_api::query_rule_types;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_rule_types(
        &falcon.cfg,  // configuration
        Some("string"),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CustomIoa.new

response = api.query_rule_types(offset: 'string', limit: integer)

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

query-rulesMixin0

Finds all rule IDs matching the query with optional filter.

Method GET

Route /ioarules/queries/rules/v1

Scope Custom IOA rules: READ

PEP 8 query_rules

Parameters

sort query · string

The property to sort by. (Ex: rules.created_on.desc) Available sort fields:

Available values (10)

`rules.created_by`	`rules.created_on`	`rules.current_version.action_label`
`rules.current_version.description`	`rules.current_version.modified_by`	`rules.current_version.modified_on`
`rules.current_version.name`	`rules.current_version.pattern_severity`	`rules.enabled`
`rules.ruletype_name`

filter query · string

FQL Syntax formatted string used to limit the results. Available filters:Filter range criteria: You may use any common date format, such as 2010-05-15T14:55:21.892315096Z for date format fields.

Available values (12)

`enabled`	`platform`	`name`
`description`	`rules.action_label`	`rules.name`
`rules.description`	`rules.pattern_severity`	`rules.ruletype_name`
`rules.enabled`	`created_on`	`modified_on`

q query · string

Match query criteria, which includes all the filter string fields

offset query · string

Starting index of overall result set from which to return IDs

limit query · integer

Number of IDs to return

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.query_rules(filter="string",
                              limit=integer,
                              offset="string",
                              q="string",
                              sort="string")
print(response)

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.query_rulesMixin0(filter="string",
                                    limit=integer,
                                    offset="string",
                                    q="string",
                                    sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("query_rulesMixin0",
                          sort="string",
                          filter="string",
                          q="string",
                          offset="string",
                          limit=integer)
print(response)

Get-FalconIoaRule -Filter "string" `
  -Query "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/custom_ioa"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  sort := "string"
  filter := "string"
  q := "string"
  offset := "string"
  limit := int64(0)

  response, err := client.CustomIoa.QueryRulesMixin0(
    &custom_ioa.QueryRulesMixin0Params{
      Sort: &sort,
      Filter: &filter,
      Q: &q,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.customIoa.queryRulesMixin0(
  "string",  // sort
  "string",  // filter
  "string",  // q
  "string",  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::custom_ioa_api::query_rules_mixin0;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_rules_mixin0(
        &falcon.cfg,  // configuration
        Some("string"),  // sort
        Some("string"),  // filter
        Some("string"),  // q
        Some("string"),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CustomIoa.new

response = api.query_rules_mixin0(sort: 'string',
                                  filter: 'string',
                                  q: 'string',
                                  offset: 'string',
                                  limit: integer)

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

update-rule-groupMixin0

Update a rule group.

Method PATCH

Route /ioarules/entities/rule-groups/v1

Scope Custom IOA rules: WRITE

PEP 8 update_rule_group

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

comment body · string

Comment for the rule group.

description body · string

Rule group description.

enabled body · boolean

Flag indicating if the group is enabled.

id body · string

ID of the rule group.

name body · string

Name of the rule group.

rulegroup_version body · integer

Rule group version to modify.

Code Examples

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.update_rule_group(comment="string",
                                    description="string",
                                    enabled=boolean,
                                    id="string",
                                    name="string",
                                    rulegroup_version=integer)
print(response)

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.update_rule_groupMixin0(comment="string",
                                          description="string",
                                          enabled=boolean,
                                          id="string",
                                          name="string",
                                          rulegroup_version=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "comment": "string",
    "description": "string",
    "enabled": boolean,
    "id": "string",
    "name": "string",
    "rulegroup_version": integer
}

response = falcon.command("update_rule_groupMixin0", body=body_payload)
print(response)

Edit-FalconIoaGroup -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/custom_ioa"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  description := "string"
  enabled := boolean
  id := "string"
  name := "string"
  rulegroup_version := integer

  response, err := client.CustomIoa.UpdateRuleGroupMixin0(
    &custom_ioa.UpdateRuleGroupMixin0Params{
      Body: &models.APIRuleGroupModifyRequestV1{
        Comment: &comment,
        Description: &description,
        Enabled: &enabled,
        ID: &id,
        Name: &name,
        RulegroupVersion: &rulegroup_version,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.customIoa.updateRuleGroupMixin0(
  {
    comment: "string",
    description: "string",
    enabled: boolean,
    id: "string",
    name: "string",
    rulegroupVersion: integer
}  // body
);

console.log(response);

use rusty_falcon::apis::custom_ioa_api::update_rule_group_mixin0;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApiRuleGroupModifyRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ApiRuleGroupModifyRequestV1 {
        comment: Some("string".to_string()),
        description: Some("string".to_string()),
        enabled: Some(boolean),
        id: Some("string".to_string()),
        name: Some("string".to_string()),
        rulegroup_version: Some(integer),
        ..Default::default()
    };

    let response = update_rule_group_mixin0(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CustomIoa.new

body = Falcon::ApiRuleGroupModifyRequestV1.new(
  comment: 'string',
  description: 'string',
  enabled: boolean,
  id: 'string',
  name: 'string',
  rulegroup_version: integer
)

response = api.update_rule_group_mixin0(body)

puts response

Responses

[
  {
    "comment": "string",
    "committed_on": "string",
    "created_by": "string",
    "created_on": "string",
    "customer_id": "string",
    "deleted": false,
    "description": "string",
    "enabled": false,
    "id": "string",
    "modified_by": "string",
    "modified_on": "string",
    "name": "string",
    "platform": "string",
    "rule_ids": [],
    "rules": [],
    "version": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

update-rules

Update rules within a rule group.

Method PATCH

Route /ioarules/entities/rules/v1

Scope Custom IOA rules: WRITE

PEP 8 update_rules

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

comment body · string

Comment related to this update.

rule_updates body · array

JSON dictionary representing the rule updates to be performed. Only one rule update can be done in this manner.

rulegroup_id body · string

ID of the rule group.

rulegroup_version body · integer

Version of the rule group.

Code Examples

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

rule_updates = [
    {
        "description": "string",
        "disposition_id": 0,
        "enabled": True,
        "field_values": [
            {
                "final_value": "string",
                "label": "string",
                "name": "string",
                "type": "string",
                "value": "string",
                "values": [
                    {
                        "label": "string",
                        "value": "string"
                    }
                ]
            }
        ],
        "instance_id": "string",
        "name": "string",
        "pattern_severity": "string",
        "rulegroup_version": 0
    }
]

response = falcon.update_rules(comment="string",
                               rulegroup_id="string",
                               rule_updates=rule_updates,
                               rulegroup_version=integer)
print(response)

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

rule_updates = [
    {
        "description": "string",
        "disposition_id": 0,
        "enabled": True,
        "field_values": [
            {
                "final_value": "string",
                "label": "string",
                "name": "string",
                "type": "string",
                "value": "string",
                "values": [
                    {
                        "label": "string",
                        "value": "string"
                    }
                ]
            }
        ],
        "instance_id": "string",
        "name": "string",
        "pattern_severity": "string",
        "rulegroup_version": 0
    }
]

response = falcon.update_rules(comment="string",
                               rulegroup_id="string",
                               rule_updates=rule_updates,
                               rulegroup_version=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "comment": "string",
    "rule_updates": [
        {
            "description": "string",
            "disposition_id": integer,
            "enabled": boolean,
            "field_values": [
                {
                    "final_value": "string",
                    "label": "string",
                    "name": "string",
                    "type": "string",
                    "value": "string",
                    "values": ["string"]
                }
            ],
            "instance_id": "string",
            "name": "string",
            "pattern_severity": "string",
            "rulegroup_version": integer
        }
    ],
    "rulegroup_id": "string",
    "rulegroup_version": integer
}

response = falcon.command("update_rules", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/custom_ioa"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  description := "string"
  disposition_id := integer
  enabled := boolean
  final_value := "string"
  label := "string"
  name := "string"
  typeVar := "string"
  value := "string"
  instance_id := "string"
  pattern_severity := "string"
  rulegroup_version := integer
  rulegroup_id := "string"

  response, err := client.CustomIoa.UpdateRules(
    &custom_ioa.UpdateRulesParams{
      Body: &models.APIRuleUpdatesRequestV1{
        Comment: &comment,
        RuleUpdates: []interface{}{
          {
          Description: &description,
          DispositionID: &disposition_id,
          Enabled: &enabled,
          FieldValues: []interface{}{
            {
            FinalValue: &final_value,
            Label: &label,
            Name: &name,
            Type: &typeVar,
            Value: &value,
            Values: []interface{}{},
            },
          },
          InstanceID: &instance_id,
          Name: &name,
          PatternSeverity: &pattern_severity,
          RulegroupVersion: &rulegroup_version,
          },
        },
        RulegroupID: &rulegroup_id,
        RulegroupVersion: &rulegroup_version,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.customIoa.updateRules(
  {
    comment: "string",
    ruleUpdates: [{
        description: "string",
        dispositionId: integer,
        enabled: boolean,
        fieldValues: [{
            finalValue: "string",
            label: "string",
            name: "string",
            type: "string",
            value: "string",
            values: []
          }],
        instanceId: "string",
        name: "string",
        patternSeverity: "string",
        rulegroupVersion: integer
      }],
    rulegroupId: "string",
    rulegroupVersion: integer
}  // body
);

console.log(response);

use rusty_falcon::apis::filevantage_api::update_rules;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RulegroupsRule;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RulegroupsRule {
        comment: Some("string".to_string()),
        rule_updates: vec![RuleUpdateV1 {
            description: Some("string".to_string()),
            disposition_id: Some(integer),
            enabled: Some(boolean),
            field_values: vec![FieldValue {
                name: Some("string".to_string()),
                type: Some("string".to_string()),
                value: Some("string".to_string()),
                values: vec![],
                ..Default::default()
            }],
            instance_id: Some("string".to_string()),
            name: Some("string".to_string()),
            pattern_severity: Some("string".to_string()),
            rulegroup_version: Some(integer),
            ..Default::default()
        }],
        rulegroup_id: Some("string".to_string()),
        rulegroup_version: Some(integer),
        ..Default::default()
    };

    let response = update_rules(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CustomIoa.new

body = Falcon::ApiRuleUpdatesRequestV1.new(
  comment: 'string',
  rule_updates: [{
      description: 'string',
      disposition_id: integer,
      enabled: boolean,
      field_values: [{
          final_value: 'string',
          label: 'string',
          name: 'string',
          type: 'string',
          value: 'string',
          values: []
        }],
      instance_id: 'string',
      name: 'string',
      pattern_severity: 'string',
      rulegroup_version: integer
    }],
  rulegroup_id: 'string',
  rulegroup_version: integer
)

response = api.update_rules(body)

puts response

Responses

[
  {
    "action_label": "string",
    "comment": "string",
    "committed_on": "string",
    "created_by": "string",
    "created_on": "string",
    "customer_id": "string",
    "deleted": false,
    "description": "string",
    "disposition_id": 0,
    "enabled": false,
    "field_values": [],
    "instance_id": "string",
    "instance_version": 0,
    "magic_cookie": 0,
    "modified_by": "string",
    "modified_on": "string",
    "name": "string",
    "pattern_id": "string",
    "pattern_severity": "string",
    "rulegroup_id": "string",
    "ruletype_id": "string",
    "ruletype_name": "string",
    "version_ids": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

update-rules-v2

Update name, description, enabled or field_values for individual rules within a rule group.

Method PATCH

Route /ioarules/entities/rules/v2

Scope Custom IOA rules: WRITE

PEP 8 update_rules_v2

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

comment body · string

Comment related to this update.

rule_updates body · array

JSON dictionary representing the rule updates to be performed. Only one rule update can be done in this manner.

rulegroup_id body · string

ID of the rule group.

rulegroup_version body · integer

Version of the rule group.

Code Examples

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

rule_updates = [
    {
        "description": "string",
        "disposition_id": 0,
        "enabled": True,
        "field_values": [
            {
                "final_value": "string",
                "label": "string",
                "name": "string",
                "type": "string",
                "value": "string",
                "values": [
                    {
                        "label": "string",
                        "value": "string"
                    }
                ]
            }
        ],
        "instance_id": "string",
        "name": "string",
        "pattern_severity": "string",
        "rulegroup_version": 0
    }
]

response = falcon.update_rules_v2(comment="string",
                                  rulegroup_id="string",
                                  rule_updates=rule_updates,
                                  rulegroup_version=integer)
print(response)

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

rule_updates = [
    {
        "description": "string",
        "disposition_id": 0,
        "enabled": True,
        "field_values": [
            {
                "final_value": "string",
                "label": "string",
                "name": "string",
                "type": "string",
                "value": "string",
                "values": [
                    {
                        "label": "string",
                        "value": "string"
                    }
                ]
            }
        ],
        "instance_id": "string",
        "name": "string",
        "pattern_severity": "string",
        "rulegroup_version": 0
    }
]

response = falcon.update_rules_v2(comment="string",
                                  rulegroup_id="string",
                                  rule_updates=rule_updates,
                                  rulegroup_version=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "comment": "string",
    "rule_updates": [
        {
            "description": "string",
            "disposition_id": integer,
            "enabled": boolean,
            "field_values": [
                {
                    "final_value": "string",
                    "label": "string",
                    "name": "string",
                    "type": "string",
                    "value": "string",
                    "values": ["string"]
                }
            ],
            "instance_id": "string",
            "name": "string",
            "pattern_severity": "string",
            "rulegroup_version": integer
        }
    ],
    "rulegroup_id": "string",
    "rulegroup_version": integer
}

response = falcon.command("update_rules_v2", body=body_payload)
print(response)

Edit-FalconIoaRule -Comment "string" -RulegroupId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/custom_ioa"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  description := "string"
  disposition_id := integer
  enabled := boolean
  final_value := "string"
  label := "string"
  name := "string"
  typeVar := "string"
  value := "string"
  instance_id := "string"
  pattern_severity := "string"
  rulegroup_version := integer
  rulegroup_id := "string"

  response, err := client.CustomIoa.UpdateRulesV2(
    &custom_ioa.UpdateRulesV2Params{
      Body: &models.APIRuleUpdatesRequestV2{
        Comment: &comment,
        RuleUpdates: []interface{}{
          {
          Description: &description,
          DispositionID: &disposition_id,
          Enabled: &enabled,
          FieldValues: []interface{}{
            {
            FinalValue: &final_value,
            Label: &label,
            Name: &name,
            Type: &typeVar,
            Value: &value,
            Values: []interface{}{},
            },
          },
          InstanceID: &instance_id,
          Name: &name,
          PatternSeverity: &pattern_severity,
          RulegroupVersion: &rulegroup_version,
          },
        },
        RulegroupID: &rulegroup_id,
        RulegroupVersion: &rulegroup_version,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.customIoa.updateRulesV2(
  {
    comment: "string",
    ruleUpdates: [{
        description: "string",
        dispositionId: integer,
        enabled: boolean,
        fieldValues: [{
            finalValue: "string",
            label: "string",
            name: "string",
            type: "string",
            value: "string",
            values: []
          }],
        instanceId: "string",
        name: "string",
        patternSeverity: "string",
        rulegroupVersion: integer
      }],
    rulegroupId: "string",
    rulegroupVersion: integer
}  // body
);

console.log(response);

use rusty_falcon::apis::custom_ioa_api::update_rules_v2;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApiRuleUpdatesRequestV2;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ApiRuleUpdatesRequestV2 {
        comment: Some("string".to_string()),
        rule_updates: vec![RuleUpdateV2 {
            description: Some("string".to_string()),
            disposition_id: Some(integer),
            enabled: Some(boolean),
            field_values: vec![FieldValue {
                name: Some("string".to_string()),
                type: Some("string".to_string()),
                value: Some("string".to_string()),
                values: vec![],
                ..Default::default()
            }],
            instance_id: Some("string".to_string()),
            name: Some("string".to_string()),
            pattern_severity: Some("string".to_string()),
            rulegroup_version: Some(integer),
            ..Default::default()
        }],
        rulegroup_id: Some("string".to_string()),
        rulegroup_version: Some(integer),
        ..Default::default()
    };

    let response = update_rules_v2(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CustomIoa.new

body = Falcon::ApiRuleUpdatesRequestV2.new(
  comment: 'string',
  rule_updates: [{
      description: 'string',
      disposition_id: integer,
      enabled: boolean,
      field_values: [{
          final_value: 'string',
          label: 'string',
          name: 'string',
          type: 'string',
          value: 'string',
          values: []
        }],
      instance_id: 'string',
      name: 'string',
      pattern_severity: 'string',
      rulegroup_version: integer
    }],
  rulegroup_id: 'string',
  rulegroup_version: integer
)

response = api.update_rules_v2(body)

puts response

Responses

[
  {
    "action_label": "string",
    "comment": "string",
    "committed_on": "string",
    "created_by": "string",
    "created_on": "string",
    "customer_id": "string",
    "deleted": false,
    "description": "string",
    "disposition_id": 0,
    "enabled": false,
    "field_values": [],
    "instance_id": "string",
    "instance_version": 0,
    "magic_cookie": 0,
    "modified_by": "string",
    "modified_on": "string",
    "name": "string",
    "pattern_id": "string",
    "pattern_severity": "string",
    "rulegroup_id": "string",
    "ruletype_id": "string",
    "ruletype_name": "string",
    "version_ids": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

validate

Validates field values and checks for matches if a test string is provided.

Method POST

Route /ioarules/entities/rules/validate/v1

Scope Custom IOA rules: WRITE

PEP 8 validate

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

fields body · array

List of fields to validate.

Code Examples

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

fields = [
    {
        "name": "string",
        "test_data": "string",
        "type": "string",
        "values": [
            {
                "label": "string",
                "value": "string"
            }
        ]
    }
]

response = falcon.validate(fields=fields)
print(response)

from falconpy import CustomIOA

falcon = CustomIOA(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

fields = [
    {
        "name": "string",
        "test_data": "string",
        "type": "string",
        "values": [
            {
                "label": "string",
                "value": "string"
            }
        ]
    }
]

response = falcon.validate(fields=fields)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "fields": [
        {
            "name": "string",
            "test_data": "string",
            "type": "string",
            "values": [
                {
                    "label": "string",
                    "value": "string"
                }
            ]
        }
    ]
}

response = falcon.command("validate", body=body_payload)
print(response)

Test-FalconIoaRule

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/custom_ioa"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"
  test_data := "string"
  typeVar := "string"
  label := "string"
  value := "string"

  response, err := client.CustomIoa.Validate(
    &custom_ioa.ValidateParams{
      Body: &models.APIValidationRequestV1{
        Fields: []interface{}{
          {
          Name: &name,
          TestData: &test_data,
          Type: &typeVar,
          Values: []interface{}{
            {
            Label: &label,
            Value: &value,
            },
          },
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.customIoa.validate(
  {
    fields: [{
        name: "string",
        testData: "string",
        type: "string",
        values: [{
            label: "string",
            value: "string"
          }]
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::custom_ioa_api::validate;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApiValidationRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ApiValidationRequestV1 {
        fields: vec![ValidationRequestFieldV1 {
            name: Some("string".to_string()),
            test_data: Some("string".to_string()),
            type: Some("string".to_string()),
            values: vec![ValueItem {
                label: Some("string".to_string()),
                value: Some("string".to_string()),
                ..Default::default()
            }],
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = validate(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::CustomIoa.new

body = Falcon::ApiValidationRequestV1.new(
  fields: [{
      name: 'string',
      test_data: 'string',
      type: 'string',
      values: [{
          label: 'string',
          value: 'string'
        }]
    }]
)

response = api.validate(body)

puts response

Responses

[
  {
    "bytes": "string",
    "error": "string",
    "matches_test": false,
    "name": "string",
    "test_data": "string",
    "valid": false,
    "value": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

Custom IOA

Table of Contents

create-rule

Parameters

create-rule-groupMixin0

Parameters

delete-rule-groupsMixin0

Parameters

delete-rules

Parameters

get-patterns

Parameters

get-platformsMixin0

Parameters

get-rule-groupsMixin0

Parameters

get-rule-types

Parameters

get-rules-get

Parameters

get-rulesMixin0

Parameters

query-patterns

Parameters

query-platformsMixin0

Parameters

query-rule-groups-full

Parameters

query-rule-groupsMixin0

Parameters

query-rule-types

Parameters

query-rulesMixin0

Parameters

update-rule-groupMixin0

Parameters

update-rules

Parameters

update-rules-v2

Parameters

validate

Parameters