D4C Registration

The D4C Registration service collection provides operations for registering AWS, Azure, and GCP cloud accounts. This service collection has been superseded by the CSPM Registration service collection and is now deprecated. Developers should move code over to use the new operations available within the updated collection.

Language	Last Update
Python	v1.6.5
PowerShell
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

deprecated

This service collection has been superseded by the CSPMRegistration service collection and is now deprecated. Developers should move code over to use the new operations available within the updated collection.

---

---

Table of Contents

Operation	Description
ConnectD4CGCPAccount connect_gcp_account	Creates a new GCP account with newly-uploaded service account or connects with existing service account with only the following fields: parent_id, parent_type and service_account_id
CreateD4CAwsAccount create_aws_account	Creates a new account in our system for a customer and generates a script for them to run in their AWS cloud environment to grant us access.
CreateD4CGCPAccount create_gcp_account	Creates a new account in our system for a customer and generates a new service account for them to add access to in their GCP environment to grant us access.
CreateDiscoverCloudAzureAccount create_azure_account	Creates a new account in our system for a customer and generates a script for them to run in their cloud environment to grant us access.
DeleteD4CAwsAccount delete_aws_account	Deletes an existing AWS account or organization in our system.
DeleteD4CGCPAccount delete_gcp_account	Deletes a GCP account from the system.
GetD4CAwsAccount get_aws_account	Returns information about the current status of an AWS account.
GetD4CAWSAccountScriptsAttachment get_aws_account_scripts	Return a script for customer to run in their cloud environment to grant us access to their AWS environment as a downloadable attachment.
GetD4CAwsConsoleSetupURLs get_aws_console_setup	Return a URL for customer to visit in their cloud environment to grant us access to their AWS environment.
GetD4CCGPAccount get_gcp_account	Returns information about the current status of an GCP account.
GetD4CGCPServiceAccountsExt get_gcp_service_account	Returns the service account id and client email for external clients.
GetD4CGCPUserScripts get_gcp_user_scripts	Return a script for customer to run in their cloud environment to grant us access to their GCP environment
GetD4CGCPUserScriptsAttachment get_gcp_user_scripts_attachment_v2	Return a script for customer to run in their cloud environment to grant us access to their GCP environment as a downloadable attachment
GetDiscoverCloudAzureAccount get_azure_account	Return information about Azure account registration
GetDiscoverCloudAzureTenantIDs get_azure_tenant_ids	Return available tenant ids for discover for cloud
GetDiscoverCloudAzureUserScripts get_azure_user_scripts	Return a script for customer to run in their cloud environment to grant us access to their Azure environment
GetDiscoverCloudAzureUserScriptsAttachment get_azure_user_scripts_attachment	Return a script for customer to run in their cloud environment to grant us access to their Azure environment as a downloadable attachment
GetHorizonD4CScripts get_aws_horizon_scripts	Returns static install scripts for Horizon.
UpdateD4CGCPServiceAccountsExt update_gcp_service_account	Patches the service account key for external clients.
UpdateDiscoverCloudAzureAccountClientID update_azure_account_client_id	Update an Azure service account in our system by with the user-created client_id created with the public key we’ve provided

---

ConnectD4CGCPAccount

Creates a new GCP account with newly-uploaded service account or connects with existing service account with only the following fields: parent_id, parent_type and service_account_id

Method POST

Route /cloud-connect-gcp/entities/account/v2

Scope D4C registration: WRITE

PEP 8 connect_gcp_account

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

client_email body · string

GCP account email.

client_id body · string

GCP account client ID.

parent_id body · string

GCP parent ID.

parent_type body · string

GCP parent type.

private_key body · string

GCP private key.

private_key_id body · string

GCP private key ID.

project_id body · string

GCP project ID.

service_account_id body · integer

GCP service account ID.

Code Examples

Python

PEP 8

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.connect_gcp_account(client_email="string",
                                      client_id="string",
                                      parent_id="string",
                                      parent_type="string",
                                      private_key="string",
                                      private_key_id="string",
                                      project_id="string",
                                      service_account_id=integer)
print(response)

Operation ID

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.ConnectD4CGCPAccount(client_email="string",
                                       client_id="string",
                                       parent_id="string",
                                       parent_type="string",
                                       private_key="string",
                                       private_key_id="string",
                                       project_id="string",
                                       service_account_id=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "client_email": "string",
            "client_id": "string",
            "parent_id": "string",
            "parent_type": "string",
            "private_key": "string",
            "private_key_id": "string",
            "project_id": "string",
            "service_account_conditions": [
                {
                    "feature": "string",
                    "is_visible": boolean,
                    "last_transition": "string",
                    "message": "string",
                    "reason": "string",
                    "status": "string",
                    "type": "string"
                }
            ],
            "service_account_id": integer
        }
    ]
}

response = falcon.command("ConnectD4CGCPAccount", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/d4c_registration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  client_email := "string"
  client_id := "string"
  parent_id := "string"
  parent_type := "string"
  private_key := "string"
  private_key_id := "string"
  project_id := "string"
  feature := "string"
  is_visible := boolean
  last_transition := "string"
  message := "string"
  reason := "string"
  status := "string"
  typeVar := "string"
  service_account_id := integer

  response, err := client.D4cRegistration.ConnectD4CGCPAccount(
    &d4c_registration.ConnectD4CGCPAccountParams{
      Body: &models.RegistrationGCPAccountExtRequestV2{
        Resources: []interface{}{
          {
          ClientEmail: &client_email,
          ClientID: &client_id,
          ParentID: &parent_id,
          ParentType: &parent_type,
          PrivateKey: &private_key,
          PrivateKeyID: &private_key_id,
          ProjectID: &project_id,
          ServiceAccountConditions: []interface{}{
            {
            Feature: &feature,
            IsVisible: &is_visible,
            LastTransition: &last_transition,
            Message: &message,
            Reason: &reason,
            Status: &status,
            Type: &typeVar,
            },
          },
          ServiceAccountID: &service_account_id,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.d4cRegistration.connectD4CGCPAccount(
  {
    resources: [{
        clientEmail: "string",
        clientId: "string",
        parentId: "string",
        parentType: "string",
        privateKey: "string",
        privateKeyId: "string",
        projectId: "string",
        serviceAccountConditions: [{
            feature: "string",
            isVisible: boolean,
            lastTransition: "string",
            message: "string",
            reason: "string",
            status: "string",
            type: "string"
          }],
        serviceAccountId: integer
      }]
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::d4c_registration_api::connect_d4_cgcp_account;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RegistrationGcpAccountExtRequestV2;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RegistrationGcpAccountExtRequestV2 {
        resources: vec![GCPAccountReqObjV2 {
            parent_id: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = connect_d4_cgcp_account(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::D4cRegistration.new

body = Falcon::RegistrationGCPAccountExtRequestV2.new(
  resources: [{
      client_email: 'string',
      client_id: 'string',
      parent_id: 'string',
      parent_type: 'string',
      private_key: 'string',
      private_key_id: 'string',
      project_id: 'string',
      service_account_conditions: [{
          feature: 'string',
          is_visible: boolean,
          last_transition: 'string',
          message: 'string',
          reason: 'string',
          status: 'string',
          type: 'string'
        }],
      service_account_id: integer
    }]
)

response = api.connect_d4_cgcp_account(body)

puts response

Responses

201 Created

[
  {
    "client_email": "string",
    "client_id": "string",
    "parent_id": "string",
    "parent_type": "string",
    "project_id": "string",
    "service_account_conditions": [],
    "service_account_id": 0
  }
]

207 Multi-Status

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_email": "string",
      "client_id": "string",
      "parent_id": "string",
      "parent_type": "string",
      "project_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0
    }
  ]
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_email": "string",
      "client_id": "string",
      "parent_id": "string",
      "parent_type": "string",
      "project_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

409 Conflict

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_email": "string",
      "client_id": "string",
      "parent_id": "string",
      "parent_type": "string",
      "project_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_email": "string",
      "client_id": "string",
      "parent_id": "string",
      "parent_type": "string",
      "project_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0
    }
  ]
}

---

---

CreateD4CAwsAccount

Creates a new account in our system for a customer and generates a script for them to run in their AWS cloud environment to grant us access.

Method POST

Route /cloud-connect-aws/entities/account/v2

Scope D4C registration: WRITE

PEP 8 create_aws_account

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

account_id body · string

AWS account ID.

account_type body · string

AWS account type.

cloudtrail_region body · string

AWS region for CloudTrail log access.

iam_role_arn body · string

AWS IAM role ARN.

is_master body · boolean

Flag indicating if this is the master account.

organization_id body · string

AWS organization ID.

Code Examples

Python

PEP 8

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.create_aws_account(account_id="string",
                                     account_type="string",
                                     cloudtrail_region="string",
                                     iam_role_arn="string",
                                     is_master=boolean,
                                     organization_id="string")
print(response)

Operation ID

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.CreateD4CAwsAccount(account_id="string",
                                      account_type="string",
                                      cloudtrail_region="string",
                                      iam_role_arn="string",
                                      is_master=boolean,
                                      organization_id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "account_id": "string",
            "account_type": "string",
            "cloudtrail_region": "string",
            "iam_role_arn": "string",
            "is_master": boolean,
            "organization_id": "string"
        }
    ]
}

response = falcon.command("CreateD4CAwsAccount", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/d4c_registration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  account_id := "string"
  account_type := "string"
  cloudtrail_region := "string"
  iam_role_arn := "string"
  is_master := boolean
  organization_id := "string"

  response, err := client.D4cRegistration.CreateD4CAwsAccount(
    &d4c_registration.CreateD4CAwsAccountParams{
      Body: &models.RegistrationAWSAccountCreateRequestD4CExtV2{
        Resources: []interface{}{
          {
          AccountID: &account_id,
          AccountType: &account_type,
          CloudtrailRegion: &cloudtrail_region,
          IamRoleArn: &iam_role_arn,
          IsMaster: &is_master,
          OrganizationID: &organization_id,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.d4cRegistration.createD4CAwsAccount(
  {
    resources: [{
        accountId: "string",
        accountType: "string",
        cloudtrailRegion: "string",
        iamRoleArn: "string",
        isMaster: boolean,
        organizationId: "string"
      }]
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::d4c_registration_api::create_d4_c_aws_account;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RegistrationAwsAccountCreateRequestD4CExtV2;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RegistrationAwsAccountCreateRequestD4CExtV2 {
        resources: vec![AWSAccountD4CExtV2 {
            account_id: Some("string".to_string()),
            cloudtrail_region: Some("string".to_string()),
            iam_role_arn: Some("string".to_string()),
            organization_id: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = create_d4_c_aws_account(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::D4cRegistration.new

body = Falcon::RegistrationAWSAccountCreateRequestD4CExtV2.new(
  resources: [{
      account_id: 'string',
      account_type: 'string',
      cloudtrail_region: 'string',
      iam_role_arn: 'string',
      is_master: boolean,
      organization_id: 'string'
    }]
)

response = api.create_d4_c_aws_account(body)

puts response

Responses

201 Created

[
  {
    "CreatedAt": "string",
    "DeletedAt": "string",
    "ID": 0,
    "UpdatedAt": "string",
    "account_id": "string",
    "account_name": "string",
    "account_type": "string",
    "active_regions": [],
    "aws_cloudtrail_bucket_name": "string",
    "aws_cloudtrail_region": "string",
    "aws_eventbus_arn": "string",
    "aws_permissions_status": [],
    "behavior_assessment_enabled": false,
    "cid": "string",
    "cloud_registration_enabled": false,
    "cloud_scopes": [],
    "cloudformation_root_stack_arn": "string",
    "cloudformation_update_url": "string",
    "cloudformation_url": "string",
    "conditions": [],
    "cspm_enabled": false,
    "d4c": {},
    "d4c_migrated": false,
    "dspm_enabled": false,
    "dspm_host_account_id": "string",
    "dspm_role_arn": "string",
    "environment": "string",
    "eventbus_name": "string",
    "external_id": "string",
    "falcon_client_id": "string",
    "features": [],
    "iam_role_arn": "string",
    "intermediate_role_arn": "string",
    "inventory_filter": [],
    "is_cloud_registration": false,
    "is_cspm_lite": false,
    "is_custom_rolename": false,
    "is_delegated_admin": false,
    "is_master": false,
    "ngsiem_enabled": false,
    "organization_id": "string",
    "remediation_cloudformation_url": "string",
    "remediation_region": "string",
    "remediation_tou_accepted": "string",
    "resource_name_prefix": "string",
    "resource_name_suffix": "string",
    "root_account_id": "string",
    "root_iam_role": false,
    "s3_url": "string",
    "secondary_role_arn": "string",
    "sensor_management_enabled": false,
    "settings": {},
    "status": "string",
    "target_ous": [],
    "template_source_region": "string",
    "use_existing_cloudtrail": false,
    "valid": false,
    "vulnerability_scanning_enabled": false,
    "vulnerability_scanning_host_account_id": "string",
    "vulnerability_scanning_role_arn": "string"
  }
]

207 Multi-Status

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_id": "string",
      "account_name": "string",
      "account_type": "string",
      "active_regions": [],
      "aws_cloudtrail_bucket_name": "string",
      "aws_cloudtrail_region": "string",
      "aws_eventbus_arn": "string",
      "aws_permissions_status": [],
      "behavior_assessment_enabled": false,
      "cid": "string",
      "cloud_registration_enabled": false,
      "cloud_scopes": [],
      "cloudformation_root_stack_arn": "string",
      "cloudformation_update_url": "string",
      "cloudformation_url": "string",
      "conditions": [],
      "cspm_enabled": false,
      "d4c": {},
      "d4c_migrated": false,
      "dspm_enabled": false,
      "dspm_host_account_id": "string",
      "dspm_role_arn": "string",
      "environment": "string",
      "eventbus_name": "string",
      "external_id": "string",
      "falcon_client_id": "string",
      "features": [],
      "iam_role_arn": "string",
      "intermediate_role_arn": "string",
      "inventory_filter": [],
      "is_cloud_registration": false,
      "is_cspm_lite": false,
      "is_custom_rolename": false,
      "is_delegated_admin": false,
      "is_master": false,
      "ngsiem_enabled": false,
      "organization_id": "string",
      "remediation_cloudformation_url": "string",
      "remediation_region": "string",
      "remediation_tou_accepted": "string",
      "resource_name_prefix": "string",
      "resource_name_suffix": "string",
      "root_account_id": "string",
      "root_iam_role": false,
      "s3_url": "string",
      "secondary_role_arn": "string",
      "sensor_management_enabled": false,
      "settings": {},
      "status": "string",
      "target_ous": [],
      "template_source_region": "string",
      "use_existing_cloudtrail": false,
      "valid": false,
      "vulnerability_scanning_enabled": false,
      "vulnerability_scanning_host_account_id": "string",
      "vulnerability_scanning_role_arn": "string"
    }
  ]
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

CreateD4CGCPAccount

Creates a new account in our system for a customer and generates a new service account for them to add access to in their GCP environment to grant us access.

Method POST

Route /cloud-connect-gcp/entities/account/v1

Scope D4C registration: WRITE

PEP 8 create_gcp_account

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

parent_id body · string

GCP parent ID.

parent_type body · string

GCP parent type.

Code Examples

Python

PEP 8

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.create_gcp_account(parent_id="string", parent_type="string")
print(response)

Operation ID

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.CreateD4CGCPAccount(parent_id="string", parent_type="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "parent_id": "string",
            "parent_type": "string"
        }
    ]
}

response = falcon.command("CreateD4CGCPAccount", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/d4c_registration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  parent_id := "string"
  parent_type := "string"

  response, err := client.D4cRegistration.CreateD4CGcpAccount(
    &d4c_registration.CreateD4CGcpAccountParams{
      Body: &models.RegistrationGCPAccountCreateRequestExtV1{
        Resources: []interface{}{
          {
          ParentID: &parent_id,
          ParentType: &parent_type,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.d4cRegistration.createD4CGcpAccount(
  {
    resources: [{
        parentId: "string",
        parentType: "string"
      }]
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::d4c_registration_api::create_d4_cgcp_account;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RegistrationGcpAccountCreateRequestExtV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RegistrationGcpAccountCreateRequestExtV1 {
        resources: vec![GCPAccountExtV1 {
            parent_id: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = create_d4_cgcp_account(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::D4cRegistration.new

body = Falcon::RegistrationGCPAccountCreateRequestExtV1.new(
  resources: [{
      parent_id: 'string',
      parent_type: 'string'
    }]
)

response = api.create_d4_c_gcp_account(body)

puts response

Responses

201 Created

[
  {
    "CreatedAt": "string",
    "DeletedAt": "string",
    "ID": 0,
    "UpdatedAt": "string",
    "cid": "string",
    "cloud_registration_enabled": false,
    "cloud_scopes": [],
    "conditions": [],
    "cspm_enabled": false,
    "display_name": "string",
    "environment": "string",
    "folder_id": "string",
    "folder_name": "string",
    "gcp_permissions_status": [],
    "organization_id": "string",
    "organization_name": "string",
    "parent_id": "string",
    "parent_type": "string",
    "project_id": "string",
    "service_account_client_email": "string",
    "service_account_client_id": "string",
    "service_account_conditions": [],
    "service_account_id": 0,
    "service_account_private_key_id": "string",
    "service_account_project_id": "string",
    "status": "string"
  }
]

207 Multi-Status

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "cid": "string",
      "cloud_registration_enabled": false,
      "cloud_scopes": [],
      "conditions": [],
      "cspm_enabled": false,
      "display_name": "string",
      "environment": "string",
      "folder_id": "string",
      "folder_name": "string",
      "gcp_permissions_status": [],
      "organization_id": "string",
      "organization_name": "string",
      "parent_id": "string",
      "parent_type": "string",
      "project_id": "string",
      "service_account_client_email": "string",
      "service_account_client_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0,
      "service_account_private_key_id": "string",
      "service_account_project_id": "string",
      "status": "string"
    }
  ]
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "cid": "string",
      "cloud_registration_enabled": false,
      "cloud_scopes": [],
      "conditions": [],
      "cspm_enabled": false,
      "display_name": "string",
      "environment": "string",
      "folder_id": "string",
      "folder_name": "string",
      "gcp_permissions_status": [],
      "organization_id": "string",
      "organization_name": "string",
      "parent_id": "string",
      "parent_type": "string",
      "project_id": "string",
      "service_account_client_email": "string",
      "service_account_client_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0,
      "service_account_private_key_id": "string",
      "service_account_project_id": "string",
      "status": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "cid": "string",
      "cloud_registration_enabled": false,
      "cloud_scopes": [],
      "conditions": [],
      "cspm_enabled": false,
      "display_name": "string",
      "environment": "string",
      "folder_id": "string",
      "folder_name": "string",
      "gcp_permissions_status": [],
      "organization_id": "string",
      "organization_name": "string",
      "parent_id": "string",
      "parent_type": "string",
      "project_id": "string",
      "service_account_client_email": "string",
      "service_account_client_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0,
      "service_account_private_key_id": "string",
      "service_account_project_id": "string",
      "status": "string"
    }
  ]
}

---

---

CreateDiscoverCloudAzureAccount

Creates a new account in our system for a customer and generates a script for them to run in their cloud environment to grant us access.

Method POST

Route /cloud-connect-azure/entities/account/v1

Scope D4C registration: WRITE

PEP 8 create_azure_account

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

account_type body · string

Azure Account type.

client_id body · string

Azure Client ID.

default_subscription body · boolean

Is this the default subscription?

subscription_id body · string

Azure subscription ID.

tenant_id body · string

Azure tenant ID.

years_valid body · integer

Years valid.

Code Examples

Python

PEP 8

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.create_azure_account(account_type="string",
                                       client_id="string",
                                       default_subscription=boolean,
                                       subscription_id="string",
                                       tenant_id="string",
                                       years_valid=integer)
print(response)

Operation ID

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.CreateDiscoverCloudAzureAccount(account_type="string",
                                                  client_id="string",
                                                  default_subscription=boolean,
                                                  subscription_id="string",
                                                  tenant_id="string",
                                                  years_valid=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "account_type": "string",
            "client_id": "string",
            "default_subscription": boolean,
            "subscription_id": "string",
            "tenant_id": "string",
            "years_valid": integer
        }
    ]
}

response = falcon.command("CreateDiscoverCloudAzureAccount", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/d4c_registration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  account_type := "string"
  client_id := "string"
  default_subscription := boolean
  subscription_id := "string"
  tenant_id := "string"
  years_valid := integer

  response, err := client.D4cRegistration.CreateDiscoverCloudAzureAccount(
    &d4c_registration.CreateDiscoverCloudAzureAccountParams{
      Body: &models.RegistrationAzureAccountCreateRequestExternalV1{
        Resources: []interface{}{
          {
          AccountType: &account_type,
          ClientID: &client_id,
          DefaultSubscription: &default_subscription,
          SubscriptionID: &subscription_id,
          TenantID: &tenant_id,
          YearsValid: &years_valid,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.d4cRegistration.createDiscoverCloudAzureAccount(
  {
    resources: [{
        accountType: "string",
        clientId: "string",
        defaultSubscription: boolean,
        subscriptionId: "string",
        tenantId: "string",
        yearsValid: integer
      }]
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::d4c_registration_api::create_discover_cloud_azure_account;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RegistrationAzureAccountCreateRequestExternalV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RegistrationAzureAccountCreateRequestExternalV1 {
        resources: vec![],
        ..Default::default()
    };

    let response = create_discover_cloud_azure_account(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::D4cRegistration.new

body = Falcon::RegistrationAzureAccountCreateRequestExternalV1.new(
  resources: [{
      account_type: 'string',
      client_id: 'string',
      default_subscription: boolean,
      subscription_id: 'string',
      tenant_id: 'string',
      years_valid: integer
    }]
)

response = api.create_discover_cloud_azure_account(body)

puts response

Responses

201 Created

[
  {
    "CreatedAt": "string",
    "DeletedAt": "string",
    "ID": 0,
    "UpdatedAt": "string",
    "account_type": "string",
    "azure_permissions_status": [],
    "cid": "string",
    "client_id": "string",
    "cloud_scopes": [],
    "conditions": [],
    "credentials_end_date": "string",
    "credentials_type": "string",
    "default_subscription_id": "string",
    "environment": "string",
    "ioa_status": "string",
    "iom_status": "string",
    "is_cspm_lite": false,
    "object_id": "string",
    "parent_management_group_id": "string",
    "parent_management_group_name": "string",
    "primary_domain": "string",
    "public_certificate": "string",
    "public_certificate_raw": "string",
    "role_assignments": [],
    "show_modal": false,
    "status": "string",
    "subscription_id": "string",
    "subscription_name": "string",
    "tenant_id": "string",
    "tenant_name": "string",
    "years_valid": 0
  }
]

207 Multi-Status

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_type": "string",
      "azure_permissions_status": [],
      "cid": "string",
      "client_id": "string",
      "cloud_scopes": [],
      "conditions": [],
      "credentials_end_date": "string",
      "credentials_type": "string",
      "default_subscription_id": "string",
      "environment": "string",
      "ioa_status": "string",
      "iom_status": "string",
      "is_cspm_lite": false,
      "object_id": "string",
      "parent_management_group_id": "string",
      "parent_management_group_name": "string",
      "primary_domain": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "role_assignments": [],
      "show_modal": false,
      "status": "string",
      "subscription_id": "string",
      "subscription_name": "string",
      "tenant_id": "string",
      "tenant_name": "string",
      "years_valid": 0
    }
  ]
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_type": "string",
      "azure_permissions_status": [],
      "cid": "string",
      "client_id": "string",
      "cloud_scopes": [],
      "conditions": [],
      "credentials_end_date": "string",
      "credentials_type": "string",
      "default_subscription_id": "string",
      "environment": "string",
      "ioa_status": "string",
      "iom_status": "string",
      "is_cspm_lite": false,
      "object_id": "string",
      "parent_management_group_id": "string",
      "parent_management_group_name": "string",
      "primary_domain": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "role_assignments": [],
      "show_modal": false,
      "status": "string",
      "subscription_id": "string",
      "subscription_name": "string",
      "tenant_id": "string",
      "tenant_name": "string",
      "years_valid": 0
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

409 Conflict

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_type": "string",
      "azure_permissions_status": [],
      "cid": "string",
      "client_id": "string",
      "cloud_scopes": [],
      "conditions": [],
      "credentials_end_date": "string",
      "credentials_type": "string",
      "default_subscription_id": "string",
      "environment": "string",
      "ioa_status": "string",
      "iom_status": "string",
      "is_cspm_lite": false,
      "object_id": "string",
      "parent_management_group_id": "string",
      "parent_management_group_name": "string",
      "primary_domain": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "role_assignments": [],
      "show_modal": false,
      "status": "string",
      "subscription_id": "string",
      "subscription_name": "string",
      "tenant_id": "string",
      "tenant_name": "string",
      "years_valid": 0
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_type": "string",
      "azure_permissions_status": [],
      "cid": "string",
      "client_id": "string",
      "cloud_scopes": [],
      "conditions": [],
      "credentials_end_date": "string",
      "credentials_type": "string",
      "default_subscription_id": "string",
      "environment": "string",
      "ioa_status": "string",
      "iom_status": "string",
      "is_cspm_lite": false,
      "object_id": "string",
      "parent_management_group_id": "string",
      "parent_management_group_name": "string",
      "primary_domain": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "role_assignments": [],
      "show_modal": false,
      "status": "string",
      "subscription_id": "string",
      "subscription_name": "string",
      "tenant_id": "string",
      "tenant_name": "string",
      "years_valid": 0
    }
  ]
}

---

---

DeleteD4CAwsAccount

Deletes an existing AWS account or organization in our system.

Method DELETE

Route /cloud-connect-aws/entities/account/v2

Scope D4C registration: WRITE

PEP 8 delete_aws_account

Parameters

ids query · string or list of strings

AWS account IDs to remove

organization-ids query · string or list of strings

AWS organization IDs to remove

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

organization_ids body · string or list of strings

List of AWS Organization IDs to retrieve.

Code Examples

Python

PEP 8

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_aws_account(ids=id_list, organization_ids=id_list)
print(response)

Operation ID

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteD4CAwsAccount(ids=id_list, organization_ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteD4CAwsAccount",
                          ids=id_list,
                          organization_ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/d4c_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.D4cRegistration.DeleteD4CAwsAccount(
    &d4c_registration.DeleteD4CAwsAccountParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      OrganizationIds: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.d4cRegistration.deleteD4CAwsAccount(
  ["ID1", "ID2", "ID3"],  // ids
  ["ID1", "ID2", "ID3"]  // organizationIds
);

console.log(response);

Rust

use rusty_falcon::apis::d4c_registration_api::delete_d4_c_aws_account;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_d4_c_aws_account(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
        Some(vec!["string".to_string()]),  // organization_ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::D4cRegistration.new

response = api.delete_d4_c_aws_account(ids: ['ID1', 'ID2', 'ID3'],
                                       organization_ids: ['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

207 Multi-Status

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

DeleteD4CGCPAccount

Deletes a GCP account from the system.

Method DELETE

Route /cloud-connect-gcp/entities/account/v1

Scope D4C registration: WRITE

PEP 8 delete_gcp_account

Parameters

ids query · string or list of strings

Hierarchical Resource IDs of accounts

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_gcp_account(ids=id_list)
print(response)

Operation ID

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteD4CGCPAccount(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteD4CGCPAccount",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/d4c_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.D4cRegistration.DeleteD4CGCPAccount(
    &d4c_registration.DeleteD4CGCPAccountParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.d4cRegistration.deleteD4CGCPAccount(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::d4c_registration_api::delete_d4_cgcp_account;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_d4_cgcp_account(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::D4cRegistration.new

response = api.delete_d4_cgcp_account(ids: ['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

207 Multi-Status

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

GetD4CAwsAccount

Returns information about the current status of an AWS account.

Method GET

Route /cloud-connect-aws/entities/account/v2

Scope D4C registration: READ

PEP 8 get_aws_account

Parameters

scan-type query · string

Type of scan, dry or full, to perform on selected accounts

ids query · string or list of strings

AWS account IDs

organization-ids query · string or list of strings

AWS organization IDs

status query · string

Account status to filter results by.

limit query · integer

The maximum records to return. Defaults to 100.

offset query · integer

The offset to start retrieving records from

migrated query · string

Only return migrated d4c accounts

Available values (2)

true

false

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

organization_ids body · string or list of strings

List of AWS Organization IDs to retrieve.

scan_type body · string

Type of scan, dry or full, to perform on selected accounts.

Code Examples

Python

PEP 8

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_aws_account(ids=id_list,
                                  limit=integer,
                                  migrated="string",
                                  offset=integer,
                                  organization_ids=id_list,
                                  scan_type="string",
                                  status="string")
print(response)

Operation ID

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetD4CAwsAccount(ids=id_list,
                                   limit=integer,
                                   migrated="string",
                                   offset=integer,
                                   organization_ids=id_list,
                                   scan_type="string",
                                   status="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetD4CAwsAccount",
                          scan_type="string",
                          ids=id_list,
                          organization_ids=id_list,
                          status="string",
                          limit=integer,
                          offset=integer,
                          migrated="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/d4c_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  status := "string"
  limit := int64(0)
  offset := int64(0)
  migrated := "string"

  response, err := client.D4cRegistration.GetD4CAwsAccount(
    &d4c_registration.GetD4CAwsAccountParams{
      ScanType: "string",
      Ids: []string{"ID1", "ID2", "ID3"},
      OrganizationIds: []string{"ID1", "ID2", "ID3"},
      Status: &status,
      Limit: &limit,
      Offset: &offset,
      Migrated: &migrated,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.d4cRegistration.getD4CAwsAccount(
  "string",  // scanType
  ["ID1", "ID2", "ID3"],  // ids
  ["ID1", "ID2", "ID3"],  // organizationIds
  "string",  // status
  integer,  // limit
  integer,  // offset
  "string"  // migrated
);

console.log(response);

Rust

use rusty_falcon::apis::d4c_registration_api::get_d4_c_aws_account;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_d4_c_aws_account(
        &falcon.cfg,  // configuration
        Some("string"),  // scan_type
        Some(vec!["string".to_string()]),  // ids
        Some(vec!["string".to_string()]),  // organization_ids
        Some("string"),  // status
        Some(integer),  // limit
        Some(integer),  // offset
        Some("string"),  // migrated
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::D4cRegistration.new

response = api.get_d4_c_aws_account(scan_type: 'string',
                                    ids: ['ID1', 'ID2', 'ID3'],
                                    organization_ids: ['ID1', 'ID2', 'ID3'],
                                    status: 'string',
                                    limit: integer,
                                    offset: integer,
                                    migrated: 'string')

puts response

Responses

200 OK

[
  {
    "CreatedAt": "string",
    "DeletedAt": "string",
    "ID": 0,
    "UpdatedAt": "string",
    "account_id": "string",
    "account_name": "string",
    "account_type": "string",
    "active_regions": [],
    "aws_cloudtrail_bucket_name": "string",
    "aws_cloudtrail_region": "string",
    "aws_eventbus_arn": "string",
    "aws_permissions_status": [],
    "behavior_assessment_enabled": false,
    "cid": "string",
    "cloud_registration_enabled": false,
    "cloud_scopes": [],
    "cloudformation_root_stack_arn": "string",
    "cloudformation_update_url": "string",
    "cloudformation_url": "string",
    "conditions": [],
    "cspm_enabled": false,
    "d4c": {},
    "d4c_migrated": false,
    "dspm_enabled": false,
    "dspm_host_account_id": "string",
    "dspm_role_arn": "string",
    "environment": "string",
    "eventbus_name": "string",
    "external_id": "string",
    "falcon_client_id": "string",
    "features": [],
    "iam_role_arn": "string",
    "intermediate_role_arn": "string",
    "inventory_filter": [],
    "is_cloud_registration": false,
    "is_cspm_lite": false,
    "is_custom_rolename": false,
    "is_delegated_admin": false,
    "is_master": false,
    "ngsiem_enabled": false,
    "organization_id": "string",
    "remediation_cloudformation_url": "string",
    "remediation_region": "string",
    "remediation_tou_accepted": "string",
    "resource_name_prefix": "string",
    "resource_name_suffix": "string",
    "root_account_id": "string",
    "root_iam_role": false,
    "s3_url": "string",
    "secondary_role_arn": "string",
    "sensor_management_enabled": false,
    "settings": {},
    "status": "string",
    "target_ous": [],
    "template_source_region": "string",
    "use_existing_cloudtrail": false,
    "valid": false,
    "vulnerability_scanning_enabled": false,
    "vulnerability_scanning_host_account_id": "string",
    "vulnerability_scanning_role_arn": "string"
  }
]

207 Multi-Status

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_id": "string",
      "account_name": "string",
      "account_type": "string",
      "active_regions": [],
      "aws_cloudtrail_bucket_name": "string",
      "aws_cloudtrail_region": "string",
      "aws_eventbus_arn": "string",
      "aws_permissions_status": [],
      "behavior_assessment_enabled": false,
      "cid": "string",
      "cloud_registration_enabled": false,
      "cloud_scopes": [],
      "cloudformation_root_stack_arn": "string",
      "cloudformation_update_url": "string",
      "cloudformation_url": "string",
      "conditions": [],
      "cspm_enabled": false,
      "d4c": {},
      "d4c_migrated": false,
      "dspm_enabled": false,
      "dspm_host_account_id": "string",
      "dspm_role_arn": "string",
      "environment": "string",
      "eventbus_name": "string",
      "external_id": "string",
      "falcon_client_id": "string",
      "features": [],
      "iam_role_arn": "string",
      "intermediate_role_arn": "string",
      "inventory_filter": [],
      "is_cloud_registration": false,
      "is_cspm_lite": false,
      "is_custom_rolename": false,
      "is_delegated_admin": false,
      "is_master": false,
      "ngsiem_enabled": false,
      "organization_id": "string",
      "remediation_cloudformation_url": "string",
      "remediation_region": "string",
      "remediation_tou_accepted": "string",
      "resource_name_prefix": "string",
      "resource_name_suffix": "string",
      "root_account_id": "string",
      "root_iam_role": false,
      "s3_url": "string",
      "secondary_role_arn": "string",
      "sensor_management_enabled": false,
      "settings": {},
      "status": "string",
      "target_ous": [],
      "template_source_region": "string",
      "use_existing_cloudtrail": false,
      "valid": false,
      "vulnerability_scanning_enabled": false,
      "vulnerability_scanning_host_account_id": "string",
      "vulnerability_scanning_role_arn": "string"
    }
  ]
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

GetD4CAWSAccountScriptsAttachment

Return a script for customer to run in their cloud environment to grant us access to their AWS environment as a downloadable attachment.

Method GET

Route /cloud-connect-aws/entities/user-scripts-download/v1

Scope D4C registration: READ

PEP 8 get_aws_account_scripts

Parameters

ids query · string or list of strings

AWS account IDs

template query · string

Template to be rendered

Available values (1)

aws-bash

accounts query · string or list of strings

The list of accounts to register

behavior_assessment_enabled query · string

Available values:

Available values (2)

true

false

sensor_management_enabled query · string

Available values:

Available values (2)

true

false

dspm_enabled query · string

Available values:

Available values (2)

true

false

dspm_regions query · string or list of strings

DSPM Regions.

dspm_host_account_id query · string

DSPM Host Account ID.

dspm_host_integration_role_name query · string

DSPM Host Integration Role Name.

dspm_host_scanner_role_name query · string

DSPM Host Scanner Role Name.

dspm_role query · string

DSPM Role.

vulnerability_scanning_enabled query · string

Enabled. Available values:

Available values (2)

true

false

vulnerability_scanning_regions query · string or list of strings

Regions.

vulnerability_scanning_host_account_id query · string

Account ID.

vulnerability_scanning_host_integration_role_name query · string

Host Integration Role Name.

vulnerability_scanning_host_scanner_role_name query · string

Host Scanner Role Name.

vulnerability_scanning_role query · string

Role.

use_existing_cloudtrail query · string

Use Existing CloudTrail. Available values:

Available values (2)

true

false

organization_id query · string

The AWS organization ID to be registered

organizational_unit_ids query · string or list of strings

The AWS Organizational Unit IDs to be registered

aws_profile query · string

The AWS profile to be used during registration

aws_region query · string

The AWS region to be used during registration

iam_role_arn query · string

The custom IAM role to be used during registration

falcon_client_id query · string

The Falcon client ID used during registration

idp_enabled query · string

Set to true to enable Identity Protection feature

tags query · string

Base64 encoded JSON string to be used as AWS tags

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.get_aws_account_scripts(ids=id_list,
                                              template="string",
                                              accounts=id_list,
                                              behavior_assessment_enabled="string",
                                              sensor_management_enabled="string",
                                              dspm_enabled="string",
                                              dspm_regions=id_list,
                                              dspm_host_account_id="string",
                                              dspm_host_integration_role_name="string",
                                              dspm_host_scanner_role_name="string",
                                              dspm_role="string",
                                              vulnerability_scanning_enabled="string",
                                              vulnerability_scanning_regions=id_list,
                                              vulnerability_scanning_host_account_id="string",
                                              vulnerability_scanning_host_integration_role_name="string",
                                              vulnerability_scanning_host_scanner_role_name="string",
                                              vulnerability_scanning_role="string",
                                              use_existing_cloudtrail="string",
                                              organization_id="string",
                                              organizational_unit_ids=id_list,
                                              aws_profile="string",
                                              aws_region="string",
                                              iam_role_arn="string",
                                              falcon_client_id="string",
                                              idp_enabled="string",
                                              tags="string",
                                              stream=boolean)
    save_file.write(response)

Operation ID

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.GetD4CAWSAccountScriptsAttachment(ids=id_list,
                                                        template="string",
                                                        accounts=id_list,
                                                        behavior_assessment_enabled="string",
                                                        sensor_management_enabled="string",
                                                        dspm_enabled="string",
                                                        dspm_regions=id_list,
                                                        dspm_host_account_id="string",
                                                        dspm_host_integration_role_name="string",
                                                        dspm_host_scanner_role_name="string",
                                                        dspm_role="string",
                                                        vulnerability_scanning_enabled="string",
                                                        vulnerability_scanning_regions=id_list,
                                                        vulnerability_scanning_host_account_id="string",
                                                        vulnerability_scanning_host_integration_role_name="string",
                                                        vulnerability_scanning_host_scanner_role_name="string",
                                                        vulnerability_scanning_role="string",
                                                        use_existing_cloudtrail="string",
                                                        organization_id="string",
                                                        organizational_unit_ids=id_list,
                                                        aws_profile="string",
                                                        aws_region="string",
                                                        iam_role_arn="string",
                                                        falcon_client_id="string",
                                                        idp_enabled="string",
                                                        tags="string",
                                                        stream=boolean)
    save_file.write(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.command("GetD4CAWSAccountScriptsAttachment",
                              ids=id_list,
                              template="string",
                              accounts=id_list,
                              behavior_assessment_enabled="string",
                              sensor_management_enabled="string",
                              dspm_enabled="string",
                              dspm_regions=id_list,
                              dspm_host_account_id="string",
                              dspm_host_integration_role_name="string",
                              dspm_host_scanner_role_name="string",
                              dspm_role="string",
                              vulnerability_scanning_enabled="string",
                              vulnerability_scanning_regions=id_list,
                              vulnerability_scanning_host_account_id="string",
                              vulnerability_scanning_host_integration_role_name="string",
                              vulnerability_scanning_host_scanner_role_name="string",
                              vulnerability_scanning_role="string",
                              use_existing_cloudtrail="string",
                              organization_id="string",
                              organizational_unit_ids=id_list,
                              aws_profile="string",
                              aws_region="string",
                              iam_role_arn="string",
                              falcon_client_id="string",
                              idp_enabled="string",
                              tags="string")
    save_file.write(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/d4c_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  template := "string"
  behaviorAssessmentEnabled := "string"
  sensorManagementEnabled := "string"
  dspmEnabled := "string"
  dspmHostAccountID := "string"
  dspmHostIntegrationRoleName := "string"
  dspmHostScannerRoleName := "string"
  dspmRole := "string"
  vulnerabilityScanningEnabled := "string"
  vulnerabilityScanningHostAccountID := "string"
  vulnerabilityScanningHostIntegrationRoleName := "string"
  vulnerabilityScanningHostScannerRoleName := "string"
  vulnerabilityScanningRole := "string"
  useExistingCloudtrail := "string"
  organizationID := "string"
  awsProfile := "string"
  awsRegion := "string"
  iamRoleArn := "string"
  falconClientID := "string"
  idpEnabled := "string"
  tags := "string"

  response, err := client.D4cRegistration.GetD4CAWSAccountScriptsAttachment(
    &d4c_registration.GetD4CAWSAccountScriptsAttachmentParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Template: &template,
      Accounts: []string{"ID1", "ID2", "ID3"},
      BehaviorAssessmentEnabled: &behaviorAssessmentEnabled,
      SensorManagementEnabled: &sensorManagementEnabled,
      DspmEnabled: &dspmEnabled,
      DspmRegions: []string{"ID1", "ID2", "ID3"},
      DspmHostAccountID: &dspmHostAccountID,
      DspmHostIntegrationRoleName: &dspmHostIntegrationRoleName,
      DspmHostScannerRoleName: &dspmHostScannerRoleName,
      DspmRole: &dspmRole,
      VulnerabilityScanningEnabled: &vulnerabilityScanningEnabled,
      VulnerabilityScanningRegions: []string{"ID1", "ID2", "ID3"},
      VulnerabilityScanningHostAccountID: &vulnerabilityScanningHostAccountID,
      VulnerabilityScanningHostIntegrationRoleName: &vulnerabilityScanningHostIntegrationRoleName,
      VulnerabilityScanningHostScannerRoleName: &vulnerabilityScanningHostScannerRoleName,
      VulnerabilityScanningRole: &vulnerabilityScanningRole,
      UseExistingCloudtrail: &useExistingCloudtrail,
      OrganizationID: &organizationID,
      OrganizationalUnitIds: []string{"ID1", "ID2", "ID3"},
      AwsProfile: &awsProfile,
      AwsRegion: &awsRegion,
      IamRoleArn: &iamRoleArn,
      FalconClientID: &falconClientID,
      IdpEnabled: &idpEnabled,
      Tags: &tags,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.d4cRegistration.getD4CAWSAccountScriptsAttachment(
  ["ID1", "ID2", "ID3"],  // ids
  "string",  // template
  ["ID1", "ID2", "ID3"],  // accounts
  "string",  // behaviorAssessmentEnabled
  "string",  // sensorManagementEnabled
  "string",  // dspmEnabled
  ["ID1", "ID2", "ID3"],  // dspmRegions
  "string",  // dspmHostAccountId
  "string",  // dspmHostIntegrationRoleName
  "string",  // dspmHostScannerRoleName
  "string",  // dspmRole
  "string",  // vulnerabilityScanningEnabled
  ["ID1", "ID2", "ID3"],  // vulnerabilityScanningRegions
  "string",  // vulnerabilityScanningHostAccountId
  "string",  // vulnerabilityScanningHostIntegrationRoleName
  "string",  // vulnerabilityScanningHostScannerRoleName
  "string",  // vulnerabilityScanningRole
  "string",  // useExistingCloudtrail
  "string",  // organizationId
  ["ID1", "ID2", "ID3"],  // organizationalUnitIds
  "string",  // awsProfile
  "string",  // awsRegion
  "string",  // iamRoleArn
  "string",  // falconClientId
  "string",  // idpEnabled
  "string"  // tags
);

console.log(response);

Rust

use rusty_falcon::apis::d4c_registration_api::get_d4_caws_account_scripts_attachment;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_d4_caws_account_scripts_attachment(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
        Some("string"),  // template
        Some(vec!["string".to_string()]),  // accounts
        Some("string"),  // behavior_assessment_enabled
        Some("string"),  // sensor_management_enabled
        Some("string"),  // dspm_enabled
        Some(vec!["string".to_string()]),  // dspm_regions
        Some("string"),  // dspm_role
        Some("string"),  // use_existing_cloudtrail
        Some("string"),  // organization_id
        Some(vec!["string".to_string()]),  // organizational_unit_ids
        Some("string"),  // aws_profile
        Some("string"),  // aws_region
        Some("string"),  // iam_role_arn
        Some("string"),  // falcon_client_id
        Some("string"),  // idp_enabled
        Some("string"),  // tags
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::D4cRegistration.new

response = api.get_d4_caws_account_scripts_attachment(ids: ['ID1', 'ID2', 'ID3'],
                                                      template: 'string',
                                                      accounts: ['ID1', 'ID2', 'ID3'],
                                                      behavior_assessment_enabled: 'string',
                                                      sensor_management_enabled: 'string',
                                                      dspm_enabled: 'string',
                                                      dspm_regions: ['ID1', 'ID2', 'ID3'],
                                                      dspm_host_account_id: 'string',
                                                      dspm_host_integration_role_name: 'string',
                                                      dspm_host_scanner_role_name: 'string',
                                                      dspm_role: 'string',
                                                      vulnerability_scanning_enabled: 'string',
                                                      vulnerability_scanning_regions: ['ID1', 'ID2', 'ID3'],
                                                      vulnerability_scanning_host_account_id: 'string',
                                                      vulnerability_scanning_host_integration_role_name: 'string',
                                                      vulnerability_scanning_host_scanner_role_name: 'string',
                                                      vulnerability_scanning_role: 'string',
                                                      use_existing_cloudtrail: 'string',
                                                      organization_id: 'string',
                                                      organizational_unit_ids: ['ID1', 'ID2', 'ID3'],
                                                      aws_profile: 'string',
                                                      aws_region: 'string',
                                                      iam_role_arn: 'string',
                                                      falcon_client_id: 'string',
                                                      idp_enabled: 'string',
                                                      tags: 'string')

puts response

Responses

200 OK

[
  {
    "bash": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

GetD4CAwsConsoleSetupURLs

Return a URL for customer to visit in their cloud environment to grant us access to their AWS environment.

Method GET

Route /cloud-connect-aws/entities/console-setup-urls/v1

Scope D4C registration: READ

PEP 8 get_aws_console_setup

Parameters

region query · string

Region

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_aws_console_setup(region="string")
print(response)

Operation ID

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.GetD4CAwsConsoleSetupURLs(region="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetD4CAwsConsoleSetupURLs",
                          region="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/d4c_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  region := "string"

  response, err := client.D4cRegistration.GetD4CAwsConsoleSetupURLs(
    &d4c_registration.GetD4CAwsConsoleSetupURLsParams{
      Region: &region,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.d4cRegistration.getD4CAwsConsoleSetupURLs("string");  // region

console.log(response);

Rust

use rusty_falcon::apis::d4c_registration_api::get_d4_c_aws_console_setup_urls;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_d4_c_aws_console_setup_urls(
        &falcon.cfg,  // configuration
        Some("string"),  // region
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::D4cRegistration.new

response = api.get_d4_c_aws_console_setup_urls(region: 'string')

puts response

Responses

200 OK

[
  {
    "account_id": "string",
    "url": "string"
  }
]

207 Multi-Status

{
  "account_id": "string",
  "url": "string"
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

GetD4CCGPAccount

Returns information about the current status of an GCP account.

Method GET

Route /cloud-connect-gcp/entities/account/v1

Scope D4C registration: READ

PEP 8 get_gcp_account

Parameters

parent_type query · string

GCP Hierarchy Parent Type, organization/folder/project

Available values (3)

Folder

Organization

Project

ids query · string or list of strings

Hierarchical Resource IDs of accounts

scan-type query · string

Type of scan, dry or full, to perform on selected accounts

Available values (2)

dry

full

status query · string

Account status to filter results by.

Available values (2)

operational

provisioned

limit query · integer

The maximum records to return. Defaults to 100.

offset query · integer

The offset to start retrieving records from

sort query · string

asc.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

scan_type body · string

Type of scan, dry or full, to perform on selected accounts.

Code Examples

Python

PEP 8

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_gcp_account(ids=id_list,
                                  limit=integer,
                                  offset=integer,
                                  parent_type="string",
                                  scan_type="string",
                                  sort="string",
                                  status="string")
print(response)

Operation ID

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetD4CCGPAccount(ids=id_list,
                                   limit=integer,
                                   offset=integer,
                                   parent_type="string",
                                   scan_type="string",
                                   sort="string",
                                   status="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetD4CCGPAccount",
                          parent_type="string",
                          ids=id_list,
                          scan_type="string",
                          status="string",
                          limit=integer,
                          offset=integer,
                          sort="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/d4c_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  parentType := "string"
  status := "string"
  limit := int64(0)
  offset := int64(0)
  sort := "string"

  response, err := client.D4cRegistration.GetD4CGcpAccount(
    &d4c_registration.GetD4CGcpAccountParams{
      ParentType: &parentType,
      Ids: []string{"ID1", "ID2", "ID3"},
      ScanType: "string",
      Status: &status,
      Limit: &limit,
      Offset: &offset,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.d4cRegistration.getD4CGcpAccount(
  "string",  // parentType
  ["ID1", "ID2", "ID3"],  // ids
  "string",  // scanType
  "string",  // status
  integer,  // limit
  integer,  // offset
  "string"  // sort
);

console.log(response);

Rust

use rusty_falcon::apis::d4c_registration_api::get_d4_ccgp_account;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_d4_ccgp_account(
        &falcon.cfg,  // configuration
        Some("string"),  // parent_type
        Some(vec!["string".to_string()]),  // ids
        Some("string"),  // scan_type
        Some("string"),  // status
        Some(integer),  // limit
        Some(integer),  // offset
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

Examples coming soon.

Responses

200 OK

[
  {
    "CreatedAt": "string",
    "DeletedAt": "string",
    "ID": 0,
    "UpdatedAt": "string",
    "cid": "string",
    "cloud_registration_enabled": false,
    "cloud_scopes": [],
    "conditions": [],
    "cspm_enabled": false,
    "display_name": "string",
    "environment": "string",
    "folder_id": "string",
    "folder_name": "string",
    "gcp_permissions_status": [],
    "organization_id": "string",
    "organization_name": "string",
    "parent_id": "string",
    "parent_type": "string",
    "project_id": "string",
    "service_account_client_email": "string",
    "service_account_client_id": "string",
    "service_account_conditions": [],
    "service_account_id": 0,
    "service_account_private_key_id": "string",
    "service_account_project_id": "string",
    "status": "string"
  }
]

207 Multi-Status

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "cid": "string",
      "cloud_registration_enabled": false,
      "cloud_scopes": [],
      "conditions": [],
      "cspm_enabled": false,
      "display_name": "string",
      "environment": "string",
      "folder_id": "string",
      "folder_name": "string",
      "gcp_permissions_status": [],
      "organization_id": "string",
      "organization_name": "string",
      "parent_id": "string",
      "parent_type": "string",
      "project_id": "string",
      "service_account_client_email": "string",
      "service_account_client_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0,
      "service_account_private_key_id": "string",
      "service_account_project_id": "string",
      "status": "string"
    }
  ]
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "cid": "string",
      "cloud_registration_enabled": false,
      "cloud_scopes": [],
      "conditions": [],
      "cspm_enabled": false,
      "display_name": "string",
      "environment": "string",
      "folder_id": "string",
      "folder_name": "string",
      "gcp_permissions_status": [],
      "organization_id": "string",
      "organization_name": "string",
      "parent_id": "string",
      "parent_type": "string",
      "project_id": "string",
      "service_account_client_email": "string",
      "service_account_client_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0,
      "service_account_private_key_id": "string",
      "service_account_project_id": "string",
      "status": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "cid": "string",
      "cloud_registration_enabled": false,
      "cloud_scopes": [],
      "conditions": [],
      "cspm_enabled": false,
      "display_name": "string",
      "environment": "string",
      "folder_id": "string",
      "folder_name": "string",
      "gcp_permissions_status": [],
      "organization_id": "string",
      "organization_name": "string",
      "parent_id": "string",
      "parent_type": "string",
      "project_id": "string",
      "service_account_client_email": "string",
      "service_account_client_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0,
      "service_account_private_key_id": "string",
      "service_account_project_id": "string",
      "status": "string"
    }
  ]
}

---

---

GetD4CGCPServiceAccountsExt

Returns the service account id and client email for external clients.

Method GET

Route /cloud-connect-gcp/entities/service-accounts/v1

Scope D4C registration: READ

PEP 8 get_gcp_service_account

Parameters

id query · string

Service Account ID

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_gcp_service_account(id="string")
print(response)

Operation ID

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.GetD4CGCPServiceAccountsExt(id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetD4CGCPServiceAccountsExt",
                          id="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/d4c_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  iD := "string"

  response, err := client.D4cRegistration.GetD4CGCPServiceAccountsExt(
    &d4c_registration.GetD4CGCPServiceAccountsExtParams{
      ID: &iD,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.d4cRegistration.getD4CGCPServiceAccountsExt("string");  // id

console.log(response);

Rust

use rusty_falcon::apis::d4c_registration_api::get_d4_cgcp_service_accounts_ext;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_d4_cgcp_service_accounts_ext(
        &falcon.cfg,  // configuration
        Some("string"),  // id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::D4cRegistration.new

response = api.get_d4_cgcp_service_accounts_ext(id: 'string')

puts response

Responses

200 OK

[
  {
    "client_email": "string",
    "client_id": "string",
    "project_id": "string",
    "service_account_conditions": [],
    "service_account_id": 0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_email": "string",
      "client_id": "string",
      "project_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_email": "string",
      "client_id": "string",
      "project_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0
    }
  ]
}

---

---

GetD4CGCPUserScripts

Return a script for customer to run in their cloud environment to grant us access to their GCP environment

Method GET

Route /cloud-connect-gcp/entities/user-scripts/v1

Scope D4C registration: READ

PEP 8 get_gcp_user_scripts

Parameters

parent_type query · string

GCP Hierarchy Parent Type, organization/folder/project

Available values (3)

Folder

Organization

Project

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_gcp_user_scripts(parent_type="string")
print(response)

Operation ID

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.GetD4CGCPUserScripts(parent_type="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetD4CGCPUserScripts",
                          parent_type="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/d4c_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  parentType := "string"

  response, err := client.D4cRegistration.GetD4CGcpUserScripts(
    &d4c_registration.GetD4CGcpUserScriptsParams{
      ParentType: &parentType,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.d4cRegistration.getD4CGcpUserScripts("string");  // parentType

console.log(response);

Rust

use rusty_falcon::apis::d4c_registration_api::get_d4_cgcp_user_scripts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_d4_cgcp_user_scripts(
        &falcon.cfg,  // configuration
        Some("string"),  // parent_type
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::D4cRegistration.new

response = api.get_d4_c_gcp_user_scripts(parent_type: 'string')

puts response

Responses

200 OK

[
  {
    "bash": "string",
    "service_account_emails": []
  }
]

207 Multi-Status

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "bash": "string",
      "service_account_emails": []
    }
  ]
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "bash": "string",
      "service_account_emails": []
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "bash": "string",
      "service_account_emails": []
    }
  ]
}

---

---

GetD4CGCPUserScriptsAttachment

Return a script for customer to run in their cloud environment to grant us access to their GCP environment as a downloadable attachment

Method GET

Route /cloud-connect-gcp/entities/user-scripts-download/v1

Scope D4C registration: READ

PEP 8 get_gcp_user_scripts_attachment_v2

Parameters

parent_type query · string

GCP Hierarchy Parent Type, organization/folder/project

Available values (3)

Folder

Organization

Project

ids query · string or list of strings

Hierarchical Resource IDs of accounts

status query · string

Account status to filter results by.

Available values (2)

operational

provisioned

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.get_gcp_user_scripts_attachment_v2(ids=id_list,
                                                         parent_type="string",
                                                         status="string",
                                                         stream=boolean)
    save_file.write(response)

Operation ID

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.GetD4CGCPUserScriptsAttachment(ids=id_list,
                                                     parent_type="string",
                                                     status="string",
                                                     stream=boolean)
    save_file.write(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.command("GetD4CGCPUserScriptsAttachment",
                              parent_type="string",
                              ids=id_list,
                              status="string")
    save_file.write(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/d4c_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  parentType := "string"
  status := "string"

  response, err := client.D4cRegistration.GetD4CGCPUserScriptsAttachment(
    &d4c_registration.GetD4CGCPUserScriptsAttachmentParams{
      ParentType: &parentType,
      Ids: []string{"ID1", "ID2", "ID3"},
      Status: &status,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.d4cRegistration.getD4CGCPUserScriptsAttachment(
  "string",  // parentType
  ["ID1", "ID2", "ID3"],  // ids
  "string"  // status
);

console.log(response);

Rust

use rusty_falcon::apis::d4c_registration_api::get_d4_cgcp_user_scripts_attachment;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_d4_cgcp_user_scripts_attachment(
        &falcon.cfg,  // configuration
        Some("string"),  // parent_type
        Some(vec!["string".to_string()]),  // ids
        Some("string"),  // status
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::D4cRegistration.new

response = api.get_d4_cgcp_user_scripts_attachment(parent_type: 'string',
                                                   ids: ['ID1', 'ID2', 'ID3'],
                                                   status: 'string')

puts response

Responses

200 OK

[
  {
    "bash": "string",
    "service_account_emails": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "bash": "string",
      "service_account_emails": []
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "bash": "string",
      "service_account_emails": []
    }
  ]
}

---

---

GetDiscoverCloudAzureAccount

Return information about Azure account registration

Method GET

Route /cloud-connect-azure/entities/account/v1

Scope D4C registration: READ

PEP 8 get_azure_account

Parameters

ids query · string or list of strings

SubscriptionIDs of accounts to select for this status operation. If this is empty then all accounts are returned.

tenant_ids query · string or list of strings

Tenant ids to filter azure accounts

scan-type query · string

Type of scan, dry or full, to perform on selected accounts

status query · string

Account status to filter results by.

limit query · integer

The maximum records to return. Defaults to 100.

offset query · integer

The offset to start retrieving records from

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

scan_type body · string

Type of scan, dry or full, to perform on selected accounts.

Code Examples

Python

PEP 8

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_azure_account(ids=id_list,
                                    limit=integer,
                                    offset=integer,
                                    scan_type="string",
                                    status="string",
                                    tenant_ids=id_list)
print(response)

Operation ID

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetDiscoverCloudAzureAccount(ids=id_list,
                                               limit=integer,
                                               offset=integer,
                                               scan_type="string",
                                               status="string",
                                               tenant_ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetDiscoverCloudAzureAccount",
                          ids=id_list,
                          tenant_ids=id_list,
                          scan_type="string",
                          status="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/d4c_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  status := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.D4cRegistration.GetDiscoverCloudAzureAccount(
    &d4c_registration.GetDiscoverCloudAzureAccountParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      TenantIds: []string{"ID1", "ID2", "ID3"},
      ScanType: "string",
      Status: &status,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.d4cRegistration.getDiscoverCloudAzureAccount(
  ["ID1", "ID2", "ID3"],  // ids
  ["ID1", "ID2", "ID3"],  // tenantIds
  "string",  // scanType
  "string",  // status
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::d4c_registration_api::get_discover_cloud_azure_account;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_discover_cloud_azure_account(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
        Some(vec!["string".to_string()]),  // tenant_ids
        Some("string"),  // scan_type
        Some("string"),  // status
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::D4cRegistration.new

response = api.get_discover_cloud_azure_account(ids: ['ID1', 'ID2', 'ID3'],
                                                tenant_ids: ['ID1', 'ID2', 'ID3'],
                                                scan_type: 'string',
                                                status: 'string',
                                                limit: integer,
                                                offset: integer)

puts response

Responses

200 OK

[
  {
    "CreatedAt": "string",
    "DeletedAt": "string",
    "ID": 0,
    "UpdatedAt": "string",
    "account_type": "string",
    "azure_permissions_status": [],
    "cid": "string",
    "client_id": "string",
    "cloud_scopes": [],
    "conditions": [],
    "credentials_end_date": "string",
    "credentials_type": "string",
    "default_subscription_id": "string",
    "environment": "string",
    "ioa_status": "string",
    "iom_status": "string",
    "is_cspm_lite": false,
    "object_id": "string",
    "parent_management_group_id": "string",
    "parent_management_group_name": "string",
    "primary_domain": "string",
    "public_certificate": "string",
    "public_certificate_raw": "string",
    "role_assignments": [],
    "show_modal": false,
    "status": "string",
    "subscription_id": "string",
    "subscription_name": "string",
    "tenant_id": "string",
    "tenant_name": "string",
    "years_valid": 0
  }
]

207 Multi-Status

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_type": "string",
      "azure_permissions_status": [],
      "cid": "string",
      "client_id": "string",
      "cloud_scopes": [],
      "conditions": [],
      "credentials_end_date": "string",
      "credentials_type": "string",
      "default_subscription_id": "string",
      "environment": "string",
      "ioa_status": "string",
      "iom_status": "string",
      "is_cspm_lite": false,
      "object_id": "string",
      "parent_management_group_id": "string",
      "parent_management_group_name": "string",
      "primary_domain": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "role_assignments": [],
      "show_modal": false,
      "status": "string",
      "subscription_id": "string",
      "subscription_name": "string",
      "tenant_id": "string",
      "tenant_name": "string",
      "years_valid": 0
    }
  ]
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_type": "string",
      "azure_permissions_status": [],
      "cid": "string",
      "client_id": "string",
      "cloud_scopes": [],
      "conditions": [],
      "credentials_end_date": "string",
      "credentials_type": "string",
      "default_subscription_id": "string",
      "environment": "string",
      "ioa_status": "string",
      "iom_status": "string",
      "is_cspm_lite": false,
      "object_id": "string",
      "parent_management_group_id": "string",
      "parent_management_group_name": "string",
      "primary_domain": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "role_assignments": [],
      "show_modal": false,
      "status": "string",
      "subscription_id": "string",
      "subscription_name": "string",
      "tenant_id": "string",
      "tenant_name": "string",
      "years_valid": 0
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "CreatedAt": "string",
      "DeletedAt": "string",
      "ID": 0,
      "UpdatedAt": "string",
      "account_type": "string",
      "azure_permissions_status": [],
      "cid": "string",
      "client_id": "string",
      "cloud_scopes": [],
      "conditions": [],
      "credentials_end_date": "string",
      "credentials_type": "string",
      "default_subscription_id": "string",
      "environment": "string",
      "ioa_status": "string",
      "iom_status": "string",
      "is_cspm_lite": false,
      "object_id": "string",
      "parent_management_group_id": "string",
      "parent_management_group_name": "string",
      "primary_domain": "string",
      "public_certificate": "string",
      "public_certificate_raw": "string",
      "role_assignments": [],
      "show_modal": false,
      "status": "string",
      "subscription_id": "string",
      "subscription_name": "string",
      "tenant_id": "string",
      "tenant_name": "string",
      "years_valid": 0
    }
  ]
}

---

---

GetDiscoverCloudAzureTenantIDs

Return available tenant ids for discover for cloud

Method GET

Route /cloud-connect-azure/entities/tenant-id/v1

Scope D4C registration: READ

PEP 8 get_azure_tenant_ids

Code Examples

Python

PEP 8

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_azure_tenant_ids()
print(response)

Operation ID

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.GetDiscoverCloudAzureTenantIDs()
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetDiscoverCloudAzureTenantIDs")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/d4c_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.D4cRegistration.GetDiscoverCloudAzureTenantIDs(
    &d4c_registration.GetDiscoverCloudAzureTenantIDsParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.d4cRegistration.getDiscoverCloudAzureTenantIDs();

console.log(response);

Rust

use rusty_falcon::apis::d4c_registration_api::get_discover_cloud_azure_tenant_ids;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_discover_cloud_azure_tenant_ids(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::D4cRegistration.new

response = api.get_discover_cloud_azure_tenant_ids

puts response

Responses

200 OK

[
  {
    "subscription_ids": [],
    "tenant_id": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "subscription_ids": [],
      "tenant_id": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "subscription_ids": [],
      "tenant_id": "string"
    }
  ]
}

---

---

GetDiscoverCloudAzureUserScripts

Return a script for customer to run in their cloud environment to grant us access to their Azure environment

Method GET

Route /cloud-connect-azure/entities/user-scripts/v1

Scope D4C registration: READ

PEP 8 get_azure_user_scripts

Code Examples

Python

PEP 8

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_azure_user_scripts()
print(response)

Operation ID

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.GetDiscoverCloudAzureUserScripts()
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetDiscoverCloudAzureUserScripts")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/d4c_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.D4cRegistration.GetDiscoverCloudAzureUserScripts(
    &d4c_registration.GetDiscoverCloudAzureUserScriptsParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.d4cRegistration.getDiscoverCloudAzureUserScripts();

console.log(response);

Rust

use rusty_falcon::apis::d4c_registration_api::get_discover_cloud_azure_user_scripts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_discover_cloud_azure_user_scripts(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::D4cRegistration.new

response = api.get_discover_cloud_azure_user_scripts

puts response

Responses

200 OK

[
  {
    "bash": "string",
    "service_account_public_keys": []
  }
]

207 Multi-Status

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "bash": "string",
      "service_account_public_keys": []
    }
  ]
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "bash": "string",
      "service_account_public_keys": []
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "bash": "string",
      "service_account_public_keys": []
    }
  ]
}

---

---

GetDiscoverCloudAzureUserScriptsAttachment

Return a script for customer to run in their cloud environment to grant us access to their Azure environment as a downloadable attachment

Method GET

Route /cloud-connect-azure/entities/user-scripts-download/v1

Scope D4C registration: READ

PEP 8 get_azure_user_scripts_attachment

Parameters

tenant-id query · string or list of strings

Azure Tenant ID

subscription_ids query · string or list of strings

Azure Subscription ID

template query · string

Template to be rendered

azure_management_group query · boolean

Use Azure Management Group

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

tenant_id body · string

Azure tenant ID.

Code Examples

Python

PEP 8

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.get_azure_user_scripts_attachment(azure_management_group=boolean,
                                                        subscription_ids=id_list,
                                                        template="string",
                                                        tenant_id="string",
                                                        stream=boolean)
    save_file.write(response)

Operation ID

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.GetDiscoverCloudAzureUserScriptsAttachment(azure_management_group=boolean,
                                                                 subscription_ids=id_list,
                                                                 template="string",
                                                                 tenant_id="string",
                                                                 stream=boolean)
    save_file.write(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.command("GetDiscoverCloudAzureUserScriptsAttachment",
                              tenant_id=id_list,
                              subscription_ids=id_list,
                              template="string",
                              azure_management_group=boolean)
    save_file.write(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/d4c_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  template := "string"
  azureManagementGroup := boolean

  response, err := client.D4cRegistration.GetDiscoverCloudAzureUserScriptsAttachment(
    &d4c_registration.GetDiscoverCloudAzureUserScriptsAttachmentParams{
      TenantID: []string{"ID1", "ID2", "ID3"},
      SubscriptionIds: []string{"ID1", "ID2", "ID3"},
      Template: &template,
      AzureManagementGroup: &azureManagementGroup,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.d4cRegistration.getDiscoverCloudAzureUserScriptsAttachment(
  ["ID1", "ID2", "ID3"],  // tenantId
  ["ID1", "ID2", "ID3"],  // subscriptionIds
  "string",  // template
  boolean  // azureManagementGroup
);

console.log(response);

Rust

use rusty_falcon::apis::d4c_registration_api::get_discover_cloud_azure_user_scripts_attachment;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_discover_cloud_azure_user_scripts_attachment(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // tenant_id
        Some(vec!["string".to_string()]),  // subscription_ids
        Some("string"),  // template
        Some(boolean),  // azure_management_group
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::D4cRegistration.new

response = api.get_discover_cloud_azure_user_scripts_attachment('string')

puts response

Responses

200 OK

[
  {
    "bash": "string",
    "service_account_public_keys": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "bash": "string",
      "service_account_public_keys": []
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "bash": "string",
      "service_account_public_keys": []
    }
  ]
}

---

---

GetHorizonD4CScripts

Returns static install scripts for Horizon.

Method GET

Route /settings-discover/entities/gen/scripts/v1

Scope D4C registration: READ

PEP 8 get_aws_horizon_scripts

Parameters

single_account query · string

Get static script for single account

Available values (2)

false

true

organization-id query · string

AWS organization ID

delete query · string

Generate a delete script.

Available values (2)

false

true

account_type query · string

Account type (e.g.: commercial,gov) Only applicable when registering AWS commercial account in a Gov environment

Available values (2)

commercial

gov

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

organization_id body · string

AWS organization ID.

Code Examples

Python

PEP 8

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_aws_horizon_scripts(account_type="string",
                                          delete="string",
                                          organization_id="string",
                                          single_account="string")
print(response)

Operation ID

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.GetHorizonD4CScripts(account_type="string",
                                       delete="string",
                                       organization_id="string",
                                       single_account="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetHorizonD4CScripts",
                          single_account="string",
                          organization_id="string",
                          delete="string",
                          account_type="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/d4c_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  singleAccount := "string"
  delete := "string"
  accountType := "string"

  response, err := client.D4cRegistration.GetHorizonD4CScripts(
    &d4c_registration.GetHorizonD4CScriptsParams{
      SingleAccount: &singleAccount,
      OrganizationID: "string",
      Delete: &delete,
      AccountType: &accountType,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.d4cRegistration.getHorizonD4CScripts(
  "string",  // singleAccount
  "string",  // organizationId
  "string",  // _delete
  "string"  // accountType
);

console.log(response);

Rust

use rusty_falcon::apis::d4c_registration_api::get_horizon_d4_c_scripts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_horizon_d4_c_scripts(
        &falcon.cfg,  // configuration
        Some("string"),  // single_account
        Some("string"),  // organization_id
        Some("string"),  // delete
        Some("string"),  // account_type
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::D4cRegistration.new

response = api.get_horizon_d4_c_scripts(single_account: 'string',
                                        organization_id: 'string',
                                        delete: 'string',
                                        account_type: 'string')

puts response

Responses

200 OK

[
  {}
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

UpdateD4CGCPServiceAccountsExt

Patches the service account key for external clients.

Method PATCH

Route /cloud-connect-gcp/entities/service-accounts/v1

Scope D4C registration: WRITE

PEP 8 update_gcp_service_account

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

List of GCP service accounts to validate. Overrides other keywords except for body.

client_email body · string

Client email associated with the service account.

client_id body · string

GCP Client ID.

private_key body · string

GCP private key.

private_key_id body · string

GCP private key ID.

project_id body · string

GCP project ID.

service_account_conditions body · list of dictionaries

GCP service account conditions.

service_account_id body · integer

GCP service account ID.

Code Examples

Python

PEP 8

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

service_account_conditions = [
    {
        "feature": "string",
        "is_visible": "boolean",
        "last_transition": "UTC date string",
        "message": "string",
        "reason": "string",
        "status": "string",
        "type": "string"
    }
]

response = falcon.update_gcp_service_account(client_email="string",
                                             client_id="string",
                                             private_key="string",
                                             private_key_id="string",
                                             project_id="string",
                                             resources="string",
                                             service_account_conditions=service_account_conditions,
                                             service_account_id=integer)
print(response)

Operation ID

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

service_account_conditions = [
    {
        "feature": "string",
        "is_visible": "boolean",
        "last_transition": "UTC date string",
        "message": "string",
        "reason": "string",
        "status": "string",
        "type": "string"
    }
]

response = falcon.UpdateD4CGCPServiceAccountsExt(client_email="string",
                                                 client_id="string",
                                                 private_key="string",
                                                 private_key_id="string",
                                                 project_id="string",
                                                 resources="string",
                                                 service_account_conditions=service_account_conditions,
                                                 service_account_id=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "client_email": "string",
            "client_id": "string",
            "private_key": "string",
            "private_key_id": "string",
            "project_id": "string",
            "service_account_conditions": [
                {
                    "feature": "string",
                    "is_visible": boolean,
                    "last_transition": "string",
                    "message": "string",
                    "reason": "string",
                    "status": "string",
                    "type": "string"
                }
            ],
            "service_account_id": integer
        }
    ]
}

response = falcon.command("UpdateD4CGCPServiceAccountsExt", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/d4c_registration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  client_email := "string"
  client_id := "string"
  private_key := "string"
  private_key_id := "string"
  project_id := "string"
  feature := "string"
  is_visible := boolean
  last_transition := "string"
  message := "string"
  reason := "string"
  status := "string"
  typeVar := "string"
  service_account_id := integer

  response, err := client.D4cRegistration.UpdateD4CGCPServiceAccountsExt(
    &d4c_registration.UpdateD4CGCPServiceAccountsExtParams{
      Body: &models.RegistrationGCPServiceAccountPatchRequestV1{
        Resources: []interface{}{
          {
          ClientEmail: &client_email,
          ClientID: &client_id,
          PrivateKey: &private_key,
          PrivateKeyID: &private_key_id,
          ProjectID: &project_id,
          ServiceAccountConditions: []interface{}{
            {
            Feature: &feature,
            IsVisible: &is_visible,
            LastTransition: &last_transition,
            Message: &message,
            Reason: &reason,
            Status: &status,
            Type: &typeVar,
            },
          },
          ServiceAccountID: &service_account_id,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.d4cRegistration.updateD4CGCPServiceAccountsExt(
  {
    resources: [{
        clientEmail: "string",
        clientId: "string",
        privateKey: "string",
        privateKeyId: "string",
        projectId: "string",
        serviceAccountConditions: [{
            feature: "string",
            isVisible: boolean,
            lastTransition: "string",
            message: "string",
            reason: "string",
            status: "string",
            type: "string"
          }],
        serviceAccountId: integer
      }]
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::d4c_registration_api::update_d4_cgcp_service_accounts_ext;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RegistrationGcpServiceAccountPatchRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RegistrationGcpServiceAccountPatchRequestV1 {
        resources: vec![],
        ..Default::default()
    };

    let response = update_d4_cgcp_service_accounts_ext(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::D4cRegistration.new

body = Falcon::RegistrationGCPServiceAccountPatchRequestV1.new(
  resources: [{
      client_email: 'string',
      client_id: 'string',
      private_key: 'string',
      private_key_id: 'string',
      project_id: 'string',
      service_account_conditions: [{
          feature: 'string',
          is_visible: boolean,
          last_transition: 'string',
          message: 'string',
          reason: 'string',
          status: 'string',
          type: 'string'
        }],
      service_account_id: integer
    }]
)

response = api.update_d4_cgcp_service_accounts_ext(body)

puts response

Responses

200 OK

[
  {
    "client_email": "string",
    "client_id": "string",
    "project_id": "string",
    "service_account_conditions": [],
    "service_account_id": 0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_email": "string",
      "client_id": "string",
      "project_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_email": "string",
      "client_id": "string",
      "project_id": "string",
      "service_account_conditions": [],
      "service_account_id": 0
    }
  ]
}

---

---

UpdateDiscoverCloudAzureAccountClientID

Update an Azure service account in our system by with the user-created client_id created with the public key we’ve provided

Method PATCH

Route /cloud-connect-azure/entities/client-id/v1

Scope D4C registration: WRITE

PEP 8 update_azure_account_client_id

Parameters

id query · string

ClientID to use for the Service Principal associated with the customer’s Azure account

object_id query · string

Object ID to use for the Service Principal associated with the customer’s Azure account

tenant-id query · string

Tenant ID to update client ID for. Required if multiple tenants are registered.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

tenant_id body · string

Tenant ID to update client ID for. Required if multiple tenants are registered.

Code Examples

Python

PEP 8

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.update_azure_account_client_id(id="string",
                                                 object_id="string",
                                                 tenant_id="string")
print(response)

Operation ID

from falconpy import D4CRegistration

falcon = D4CRegistration(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.UpdateDiscoverCloudAzureAccountClientID(id="string",
                                                          object_id="string",
                                                          tenant_id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("UpdateDiscoverCloudAzureAccountClientID",
                          id="string",
                          object_id="string",
                          tenant_id="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/d4c_registration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  objectID := "string"

  response, err := client.D4cRegistration.UpdateDiscoverCloudAzureAccountClientID(
    &d4c_registration.UpdateDiscoverCloudAzureAccountClientIDParams{
      ID: "string",
      ObjectID: &objectID,
      TenantID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.d4cRegistration.updateDiscoverCloudAzureAccountClientID(
  "string",  // id
  "string",  // objectId
  "string"  // tenantId
);

console.log(response);

Rust

use rusty_falcon::apis::d4c_registration_api::update_discover_cloud_azure_account_client_id;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = update_discover_cloud_azure_account_client_id(
        &falcon.cfg,  // configuration
        "string",  // id
        Some("string"),  // object_id
        Some("string"),  // tenant_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::D4cRegistration.new

response = api.update_discover_cloud_azure_account_client_id('string')

puts response

Responses

201 Created

[
  {
    "account_type": "string",
    "behavior_assessment_override": false,
    "cid": "string",
    "client_id": "string",
    "cloud_registration_enabled": false,
    "conditions": [],
    "cspm_enabled": false,
    "default_subscription_id": "string",
    "encrypted_private_key": "string",
    "is_shared_client": false,
    "object_id": "string",
    "public_certificate": "string",
    "resource_permissions": [],
    "tenant_id": "string",
    "x5t": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "account_type": "string",
      "behavior_assessment_override": false,
      "cid": "string",
      "client_id": "string",
      "cloud_registration_enabled": false,
      "conditions": [],
      "cspm_enabled": false,
      "default_subscription_id": "string",
      "encrypted_private_key": "string",
      "is_shared_client": false,
      "object_id": "string",
      "public_certificate": "string",
      "resource_permissions": [],
      "tenant_id": "string",
      "x5t": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "account_type": "string",
      "behavior_assessment_override": false,
      "cid": "string",
      "client_id": "string",
      "cloud_registration_enabled": false,
      "conditions": [],
      "cspm_enabled": false,
      "default_subscription_id": "string",
      "encrypted_private_key": "string",
      "is_shared_client": false,
      "object_id": "string",
      "public_certificate": "string",
      "resource_permissions": [],
      "tenant_id": "string",
      "x5t": "string"
    }
  ]
}