Data Protection Configuration

The Data Protection Configuration service collection provides operations for managing data protection policies and configuration entities. Create, update, delete, and query classifications, cloud applications, content patterns, enterprise accounts, file types, sensitivity labels, local application groups, local applications, policies, web locations, and policy precedence.

Language	Last Update
Python	v1.6.5
PowerShell
Go	v0.22.0
TypeScript	v0.6.0
Rust
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
entities.classification.delete.v2 delete_classification	Deletes classifications that match the provided ids
entities.classification.get.v2 get_classification	Gets the classifications that match the provided ids
entities.classification.patch.v2 update_classifications	Update classifications
entities.classification.post.v2 create_classification	Create classifications
entities.cloud-application.create create_cloud_application	Persist the given cloud application for the provided entity instance
entities.cloud-application.delete delete_cloud_application	Delete cloud application
entities.cloud-application.get get_cloud_application	Get a particular cloud-application
entities.cloud-application.patch update_cloud_application	Update a cloud application
entities.content-pattern.create create_content_pattern	Persist the given content pattern for the provided entity instance
entities.content-pattern.delete delete_content_pattern	Delete content pattern
entities.content-pattern.get get_content_pattern	Get a particular content-pattern(s)
entities.content-pattern.patch update_content_pattern	Update a content pattern
entities.enterprise-account.create create_enterprise_account	Persist the given enterprise account for the provided entity instance
entities.enterprise-account.delete delete_enterprise_account	Delete enterprise account
entities.enterprise-account.get get_enterprise_account	Get a particular enterprise-account(s)
entities.enterprise-account.patch update_enterprise_account	Update a enterprise account
entities.file-type.get get_file_type	Get a particular file-type
entities.local-application-group.create create_local_application_group	Persist the given local application group for the provided entity instance
entities.local-application-group.delete delete_local_application_group	Soft Delete local application.
entities.local-application-group.get get_local_application_group	Get specific local application groups
entities.local-application-group.patch update_local_application_group	Update a local application group
entities.local-application.create create_local_application	Persist the given local application for the provided entity instance
entities.local-application.delete delete_local_application	Soft Delete local application.
entities.local-application.get get_local_application	Get a particular local application
entities.local-application.patch update_local_application	Update a local application
entities.policy.delete.v2 delete_policies	Deletes policies that match the provided ids
entities.policy.get.v2 get_policies	Gets policies that match the provided ids
entities.policy.patch.v2 update_policies	Update policies
entities.policy.post.v2 create_policy	Create policies
entities.policy.precedence.post.v1 update_policy_precedence	Update Policy Precedence
entities.sensitivity-label.create-v2 create_sensitivity_label	Create new sensitivity label (V2)
entities.sensitivity-label.delete-v2 delete_sensitivity_label	Delete sensitivity labels matching the IDs (V2)
entities.sensitivity-label.get-v2 get_sensitivity_label	Get sensitivity label matching the IDs (V2)
entities.web-location-group.create entities_web_location_group_create	Create a web location group
entities.web-location-group.delete entities_web_location_group_delete	Soft delete web location groups
entities.web-location-group.get entities_web_location_group_get	Get specific web location groups
entities.web-location-group.patch entities_web_location_group_patch	Update a web location group
entities.web-location.create-v2 create_web_location	Persist the given web-locations
entities.web-location.delete-v2 delete_web_location	Delete web-location
entities.web-location.get-v2 get_web_location	Get web-location entities matching the provided ID(s)
entities.web-location.patch-v2 update_web_location	Update a web-location
queries.classification.get.v2 query_classifications	Search for classifications that match the provided criteria
queries.cloud-application.get-v2 query_cloud_applications	Get all cloud-application IDs matching the query with filter
queries.content-pattern.get-v2 query_content_patterns	Get all content-pattern IDs matching the query with filter
queries.enterprise-account.get-v2 query_enterprise_accounts	Get all enterprise-account IDs matching the query with filter
queries.file-type.get-v2 query_file_type	Get all file-type IDs matching the query with filter
queries.local-application-group.get query_local_application_groups	Get all local application group IDs matching the query with filter
queries.local-application.get query_local_applications	Get all local-application IDs matching the query with filter
queries.policy.get.v2 query_policies	Search for policies that match the provided criteria
queries.sensitivity-label.get-v2 query_sensitivity_label	Get all sensitivity label IDs matching the query with filter
queries.web-location-group.get queries_web_location_group_get	Get all web location group IDs matching the query with filter
queries.web-location.get-v2 query_web_locations	Get web-location IDs matching the query with filter

---

entities.classification.delete.v2

Deletes classifications that match the provided ids

Method DELETE

Route /data-protection/entities/classifications/v2

Scope Data Protection: WRITE

PEP 8 delete_classification

Parameters

ids query · string or list of strings

IDs of the classifications to delete

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_classification(ids=id_list)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_classification_delete_v2(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_classification_delete_v2",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DataProtectionConfiguration.EntitiesClassificationDeleteV2(
    &data_protection_configuration.EntitiesClassificationDeleteV2Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesClassificationDeleteV2(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

response = api.entities_classification_delete_v2(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "classification_properties": {},
    "created_at": "string",
    "created_by": "string",
    "id": "string",
    "modified_at": "string",
    "modified_by": "string",
    "name": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "classification_properties": {},
      "created_at": "string",
      "created_by": "string",
      "id": "string",
      "modified_at": "string",
      "modified_by": "string",
      "name": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "classification_properties": {},
      "created_at": "string",
      "created_by": "string",
      "id": "string",
      "modified_at": "string",
      "modified_by": "string",
      "name": "string"
    }
  ]
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "classification_properties": {},
      "created_at": "string",
      "created_by": "string",
      "id": "string",
      "modified_at": "string",
      "modified_by": "string",
      "name": "string"
    }
  ]
}

409 Conflict

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "classification_properties": {},
      "created_at": "string",
      "created_by": "string",
      "id": "string",
      "modified_at": "string",
      "modified_by": "string",
      "name": "string"
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "classification_properties": {},
      "created_at": "string",
      "created_by": "string",
      "id": "string",
      "modified_at": "string",
      "modified_by": "string",
      "name": "string"
    }
  ]
}

---

---

entities.classification.get.v2

Gets the classifications that match the provided ids

Method GET

Route /data-protection/entities/classifications/v2

Scope Data Protection: READ

PEP 8 get_classification

Parameters

ids query · string or list of strings

IDs of the classifications to get

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_classification(ids=id_list)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_classification_get_v2(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_classification_get_v2",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DataProtectionConfiguration.EntitiesClassificationGetV2(
    &data_protection_configuration.EntitiesClassificationGetV2Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesClassificationGetV2(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

response = api.entities_classification_get_v2(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "classification_properties": {},
    "created_at": "string",
    "created_by": "string",
    "id": "string",
    "modified_at": "string",
    "modified_by": "string",
    "name": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "classification_properties": {},
      "created_at": "string",
      "created_by": "string",
      "id": "string",
      "modified_at": "string",
      "modified_by": "string",
      "name": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "classification_properties": {},
      "created_at": "string",
      "created_by": "string",
      "id": "string",
      "modified_at": "string",
      "modified_by": "string",
      "name": "string"
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "classification_properties": {},
      "created_at": "string",
      "created_by": "string",
      "id": "string",
      "modified_at": "string",
      "modified_by": "string",
      "name": "string"
    }
  ]
}

---

---

entities.classification.patch.v2

Update classifications

Method PATCH

Route /data-protection/entities/classifications/v2

Scope Data Protection: WRITE

PEP 8 update_classifications

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

id body · string

The ID of the classification to update. Required for update operations.

classification_properties body · dictionary

The properties of the classification.

name body · string

The name of the classification.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

classification_properties = {
    "content_patterns": [
        "string"
    ],
    "evidence_duplication_enabled": True,
    "file_types": [
        "string"
    ],
    "protection_mode": "monitor",
    "rules": [
        {
            "ad_groups": [
                "string"
            ],
            "ad_users": [
                "string"
            ],
            "created_time_stamp": "string",
            "description": "string",
            "detection_severity": "informational",
            "enable_printer_egress": True,
            "enable_usb_devices": True,
            "enable_web_locations": True,
            "id": "string",
            "modified_time_stamp": "string",
            "notify_end_user": True,
            "response_action": "allow",
            "trigger_detection": True,
            "user_scope": "all",
            "web_locations": [
                "string"
            ],
            "web_locations_scope": "all"
        }
    ],
    "sensitivity_labels": [
        "string"
    ],
    "web_sources": [
        "string"
    ]
}

response = falcon.update_classifications(id="string",
                                         classification_properties=classification_properties,
                                         name="string")
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

classification_properties = {
    "content_patterns": [
        "string"
    ],
    "evidence_duplication_enabled": True,
    "file_types": [
        "string"
    ],
    "protection_mode": "monitor",
    "rules": [
        {
            "ad_groups": [
                "string"
            ],
            "ad_users": [
                "string"
            ],
            "created_time_stamp": "string",
            "description": "string",
            "detection_severity": "informational",
            "enable_printer_egress": True,
            "enable_usb_devices": True,
            "enable_web_locations": True,
            "id": "string",
            "modified_time_stamp": "string",
            "notify_end_user": True,
            "response_action": "allow",
            "trigger_detection": True,
            "user_scope": "all",
            "web_locations": [
                "string"
            ],
            "web_locations_scope": "all"
        }
    ],
    "sensitivity_labels": [
        "string"
    ],
    "web_sources": [
        "string"
    ]
}

response = falcon.entities_classification_patch_v2(id="string",
                                                   classification_properties=classification_properties,
                                                   name="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "classification_properties": {
                "content_patterns": ["string"],
                "content_patterns_operator": "string",
                "evidence_duplication_enabled": boolean,
                "file_types": ["string"],
                "mac_file_path_patterns": ["string"],
                "protection_mode": "string",
                "rules": ["string"],
                "sensitivity_labels": ["string"],
                "web_sources": ["string"],
                "win_file_path_patterns": ["string"]
            },
            "id": "string",
            "name": "string"
        }
    ]
}

response = falcon.command("entities_classification_patch_v2", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  id := "string"
  name := "string"

  response, err := client.DataProtectionConfiguration.EntitiesClassificationPatchV2(
    &data_protection_configuration.EntitiesClassificationPatchV2Params{
      Body: &models.PolicymanagerUpdateClassificationsRequest{
        Resources: []interface{}{
          {
          ClassificationProperties: &struct{}{},
          ID: &id,
          Name: &name,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesClassificationPatchV2(
  {
    resources: [{
        classificationProperties: {
          contentPatterns: [],
          contentPatternsOperator: "string",
          evidenceDuplicationEnabled: boolean,
          fileTypes: [],
          macFilePathPatterns: [],
          protectionMode: "string",
          rules: [],
          sensitivityLabels: [],
          webSources: [],
          winFilePathPatterns: []
        },
        id: "string",
        name: "string"
      }]
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

body = Falcon::PolicymanagerUpdateClassificationsRequest.new(
  resources: [{
      classification_properties: {
        content_patterns: [],
        content_patterns_operator: 'string',
        evidence_duplication_enabled: boolean,
        file_types: [],
        mac_file_path_patterns: [],
        protection_mode: 'string',
        rules: [],
        sensitivity_labels: [],
        web_sources: [],
        win_file_path_patterns: []
      },
      id: 'string',
      name: 'string'
    }]
)

response = api.entities_classification_patch_v2(body)

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "classification_properties": {},
    "created_at": "string",
    "created_by": "string",
    "id": "string",
    "modified_at": "string",
    "modified_by": "string",
    "name": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "classification_properties": {},
      "created_at": "string",
      "created_by": "string",
      "id": "string",
      "modified_at": "string",
      "modified_by": "string",
      "name": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "classification_properties": {},
      "created_at": "string",
      "created_by": "string",
      "id": "string",
      "modified_at": "string",
      "modified_by": "string",
      "name": "string"
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "classification_properties": {},
      "created_at": "string",
      "created_by": "string",
      "id": "string",
      "modified_at": "string",
      "modified_by": "string",
      "name": "string"
    }
  ]
}

---

---

entities.classification.post.v2

Create classifications

Method POST

Route /data-protection/entities/classifications/v2

Scope Data Protection: WRITE

PEP 8 create_classification

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

classification_properties body · dictionary

The properties of the new classification.

name body · string

The name of the new classification.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

classification_properties = {
    "content_patterns": [
        "string"
    ],
    "evidence_duplication_enabled": True,
    "file_types": [
        "string"
    ],
    "protection_mode": "monitor",
    "rules": [
        {
            "ad_groups": [
                "string"
            ],
            "ad_users": [
                "string"
            ],
            "created_time_stamp": "string",
            "description": "string",
            "detection_severity": "informational",
            "enable_printer_egress": True,
            "enable_usb_devices": True,
            "enable_web_locations": True,
            "id": "string",
            "modified_time_stamp": "string",
            "notify_end_user": True,
            "response_action": "allow",
            "trigger_detection": True,
            "user_scope": "all",
            "web_locations": [
                "string"
            ],
            "web_locations_scope": "all"
        }
    ],
    "sensitivity_labels": [
        "string"
    ],
    "web_sources": [
        "string"
    ]
}

response = falcon.create_classification(classification_properties=classification_properties,
                                        name="string")
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

classification_properties = {
    "content_patterns": [
        "string"
    ],
    "evidence_duplication_enabled": True,
    "file_types": [
        "string"
    ],
    "protection_mode": "monitor",
    "rules": [
        {
            "ad_groups": [
                "string"
            ],
            "ad_users": [
                "string"
            ],
            "created_time_stamp": "string",
            "description": "string",
            "detection_severity": "informational",
            "enable_printer_egress": True,
            "enable_usb_devices": True,
            "enable_web_locations": True,
            "id": "string",
            "modified_time_stamp": "string",
            "notify_end_user": True,
            "response_action": "allow",
            "trigger_detection": True,
            "user_scope": "all",
            "web_locations": [
                "string"
            ],
            "web_locations_scope": "all"
        }
    ],
    "sensitivity_labels": [
        "string"
    ],
    "web_sources": [
        "string"
    ]
}

response = falcon.entities_classification_post_v2(classification_properties=classification_properties,
                                                  name="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "classification_properties": {
                "content_patterns": ["string"],
                "content_patterns_operator": "string",
                "evidence_duplication_enabled": boolean,
                "file_types": ["string"],
                "mac_file_path_patterns": ["string"],
                "protection_mode": "string",
                "rules": ["string"],
                "sensitivity_labels": ["string"],
                "web_sources": ["string"],
                "win_file_path_patterns": ["string"]
            },
            "name": "string"
        }
    ]
}

response = falcon.command("entities_classification_post_v2", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"

  response, err := client.DataProtectionConfiguration.EntitiesClassificationPostV2(
    &data_protection_configuration.EntitiesClassificationPostV2Params{
      Body: &models.PolicymanagerCreateClassificationsRequest{
        Resources: []interface{}{
          {
          ClassificationProperties: &struct{}{},
          Name: &name,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesClassificationPostV2(
  {
    resources: [{
        classificationProperties: {
          contentPatterns: [],
          contentPatternsOperator: "string",
          evidenceDuplicationEnabled: boolean,
          fileTypes: [],
          macFilePathPatterns: [],
          protectionMode: "string",
          rules: [],
          sensitivityLabels: [],
          webSources: [],
          winFilePathPatterns: []
        },
        name: "string"
      }]
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

body = Falcon::PolicymanagerCreateClassificationsRequest.new(
  resources: [{
      classification_properties: {
        content_patterns: [],
        content_patterns_operator: 'string',
        evidence_duplication_enabled: boolean,
        file_types: [],
        mac_file_path_patterns: [],
        protection_mode: 'string',
        rules: [],
        sensitivity_labels: [],
        web_sources: [],
        win_file_path_patterns: []
      },
      name: 'string'
    }]
)

response = api.entities_classification_post_v2(body)

puts response

Responses

201 Created

[
  {
    "cid": "string",
    "classification_properties": {},
    "created_at": "string",
    "created_by": "string",
    "id": "string",
    "modified_at": "string",
    "modified_by": "string",
    "name": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "classification_properties": {},
      "created_at": "string",
      "created_by": "string",
      "id": "string",
      "modified_at": "string",
      "modified_by": "string",
      "name": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "classification_properties": {},
      "created_at": "string",
      "created_by": "string",
      "id": "string",
      "modified_at": "string",
      "modified_by": "string",
      "name": "string"
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "classification_properties": {},
      "created_at": "string",
      "created_by": "string",
      "id": "string",
      "modified_at": "string",
      "modified_by": "string",
      "name": "string"
    }
  ]
}

---

---

entities.cloud-application.create

Persist the given cloud application for the provided entity instance

Method POST

Route /data-protection/entities/cloud-applications/v1

Scope Data Protection: WRITE

PEP 8 create_cloud_application

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

description body · string

The description of the cloud application.

name body · string

The name of the cloud application.

urls body · array

The fields contain the FQDN and the path.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

urls = [
    {
        "fqdn": "string",
        "path": "string"
    }
]

response = falcon.create_cloud_application(description="string",
                                           name="string",
                                           urls=urls)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

urls = [
    {
        "fqdn": "string",
        "path": "string"
    }
]

response = falcon.entities_cloud_application_create(description="string",
                                                    name="string",
                                                    urls=urls)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "name": "string",
    "urls": [
        {
            "fqdn": "string",
            "path": "string"
        }
    ]
}

response = falcon.command("entities_cloud_application_create", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  name := "string"
  fqdn := "string"
  path := "string"

  response, err := client.DataProtectionConfiguration.EntitiesCloudApplicationCreate(
    &data_protection_configuration.EntitiesCloudApplicationCreateParams{
      Body: &models.APICloudApplicationCreateRequestV1{
        Description: &description,
        Name: &name,
        Urls: []interface{}{
          {
          Fqdn: &fqdn,
          Path: &path,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesCloudApplicationCreate(
  {
    description: "string",
    name: "string",
    urls: [{
        fqdn: "string",
        path: "string"
      }]
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

body = Falcon::ApiCloudApplicationCreateRequestV1.new(
  description: 'string',
  name: 'string',
  urls: [{
      fqdn: 'string',
      path: 'string'
    }]
)

response = api.entities_cloud_application_create(body)

puts response

Responses

200 OK

[
  {
    "app_group_id": "string",
    "app_tier": "string",
    "cid": "string",
    "created": "string",
    "deleted": false,
    "description": "string",
    "id": "string",
    "last_updated": "string",
    "name": "string",
    "plugin_definition_id": "string",
    "supports_network_inspection": false,
    "urls": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.cloud-application.delete

Delete cloud application

Method DELETE

Route /data-protection/entities/cloud-applications/v1

Scope Data Protection: WRITE

PEP 8 delete_cloud_application

Parameters

ids query · string or list of strings

The id of the cloud application to delete.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_cloud_application(ids=id_list)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_cloud_application_delete(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_cloud_application_delete",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DataProtectionConfiguration.EntitiesCloudApplicationDelete(
    &data_protection_configuration.EntitiesCloudApplicationDeleteParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesCloudApplicationDelete(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

response = api.entities_cloud_application_delete(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "app_group_id": "string",
    "app_tier": "string",
    "cid": "string",
    "created": "string",
    "deleted": false,
    "description": "string",
    "id": "string",
    "last_updated": "string",
    "name": "string",
    "plugin_definition_id": "string",
    "supports_network_inspection": false,
    "urls": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.cloud-application.get

Get a particular cloud-application

Method GET

Route /data-protection/entities/cloud-applications/v1

Scope Data Protection: READ

PEP 8 get_cloud_application

Parameters

ids query · string or list of strings

The cloud application id(s) to get.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_cloud_application(ids=id_list)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_cloud_application_get(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_cloud_application_get",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DataProtectionConfiguration.EntitiesCloudApplicationGet(
    &data_protection_configuration.EntitiesCloudApplicationGetParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesCloudApplicationGet(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

response = api.entities_cloud_application_get(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "app_group_id": "string",
    "app_tier": "string",
    "cid": "string",
    "created": "string",
    "deleted": false,
    "description": "string",
    "id": "string",
    "last_updated": "string",
    "name": "string",
    "plugin_definition_id": "string",
    "supports_network_inspection": false,
    "urls": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.cloud-application.patch

Update a cloud application

Method PATCH

Route /data-protection/entities/cloud-applications/v1

Scope Data Protection: WRITE

PEP 8 update_cloud_application

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

description body · string

The description of the cloud application.

name body · string

The name of the cloud application.

urls body · array

The fields contain the FQDN and the path.

id query · string

The cloud app id to update.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

urls = [
    {
        "fqdn": "string",
        "path": "string"
    }
]

response = falcon.update_cloud_application(id="string",
                                           description="string",
                                           name="string",
                                           urls=urls)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

urls = [
    {
        "fqdn": "string",
        "path": "string"
    }
]

response = falcon.entities_cloud_application_patch(id="string",
                                                   description="string",
                                                   name="string",
                                                   urls=urls)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "name": "string",
    "urls": [
        {
            "fqdn": "string",
            "path": "string"
        }
    ]
}

response = falcon.command("entities_cloud_application_patch",
                          id="string",
                          body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  name := "string"
  fqdn := "string"
  path := "string"

  response, err := client.DataProtectionConfiguration.EntitiesCloudApplicationPatch(
    &data_protection_configuration.EntitiesCloudApplicationPatchParams{
      Body: &models.APICloudApplicationUpdateRequestV1{
        Description: &description,
        Name: &name,
        Urls: []interface{}{
          {
          Fqdn: &fqdn,
          Path: &path,
          },
        },
      },
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesCloudApplicationPatch(
  "string",  // id
  {  // body
      description: "string",
      name: "string",
      urls: [{
          fqdn: "string",
          path: "string"
        }]
  }
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

body = Falcon::ApiCloudApplicationUpdateRequestV1.new(
  description: 'string',
  name: 'string',
  urls: [{
      fqdn: 'string',
      path: 'string'
    }]
)

response = api.entities_cloud_application_patch(body, 'string')

puts response

Responses

200 OK

[
  {
    "app_group_id": "string",
    "app_tier": "string",
    "cid": "string",
    "created": "string",
    "deleted": false,
    "description": "string",
    "id": "string",
    "last_updated": "string",
    "name": "string",
    "plugin_definition_id": "string",
    "supports_network_inspection": false,
    "urls": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.content-pattern.create

Persist the given content pattern for the provided entity instance

Method POST

Route /data-protection/entities/content-patterns/v1

Scope Data Protection: WRITE

PEP 8 create_content_pattern

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

category body · string

The content pattern category.

description body · string

The description of the content pattern.

example body · string

The new content pattern demonstration.

min_match_threshold body · integer

name body · string

The name of the new content pattern.

regexes body · array

region body · string

The region for the content pattern.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.create_content_pattern(category="string",
                                         description="string",
                                         example="string",
                                         min_match_threshold=integer,
                                         name="string",
                                         regexes=id_list,
                                         region="string")
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_content_pattern_create(category="string",
                                                  description="string",
                                                  example="string",
                                                  min_match_threshold=integer,
                                                  name="string",
                                                  regexes=id_list,
                                                  region="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "category": "string",
    "description": "string",
    "example": "string",
    "min_match_threshold": integer,
    "name": "string",
    "regexes": ["string"],
    "region": "string"
}

response = falcon.command("entities_content_pattern_create", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  category := "string"
  description := "string"
  example := "string"
  min_match_threshold := integer
  name := "string"
  region := "string"

  response, err := client.DataProtectionConfiguration.EntitiesContentPatternCreate(
    &data_protection_configuration.EntitiesContentPatternCreateParams{
      Body: &models.APIContentPatternCreateRequestV1{
        Category: &category,
        Description: &description,
        Example: &example,
        MinMatchThreshold: &min_match_threshold,
        Name: &name,
        Regexes: []string{"string"},
        Region: &region,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesContentPatternCreate(
  {
    category: "string",
    description: "string",
    example: "string",
    minMatchThreshold: integer,
    name: "string",
    regexes: [],
    region: "string"
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

body = Falcon::ApiContentPatternCreateRequestV1.new(
  category: 'string',
  description: 'string',
  example: 'string',
  min_match_threshold: integer,
  name: 'string',
  regexes: [],
  region: 'string'
)

response = api.entities_content_pattern_create(body)

puts response

Responses

200 OK

[
  {
    "category": "string",
    "cid": "string",
    "created": "string",
    "deleted": false,
    "description": "string",
    "example": "string",
    "id": "string",
    "last_updated": "string",
    "min_match_threshold": 0,
    "name": "string",
    "regexes": [],
    "region": "string",
    "type": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.content-pattern.delete

Delete content pattern

Method DELETE

Route /data-protection/entities/content-patterns/v1

Scope Data Protection: WRITE

PEP 8 delete_content_pattern

Parameters

ids query · string or list of strings

The id(s) of the content pattern to delete.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_content_pattern(ids=id_list)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_content_pattern_delete(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_content_pattern_delete",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DataProtectionConfiguration.EntitiesContentPatternDelete(
    &data_protection_configuration.EntitiesContentPatternDeleteParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesContentPatternDelete(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

response = api.entities_content_pattern_delete(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "category": "string",
    "cid": "string",
    "created": "string",
    "deleted": false,
    "description": "string",
    "example": "string",
    "id": "string",
    "last_updated": "string",
    "min_match_threshold": 0,
    "name": "string",
    "regexes": [],
    "region": "string",
    "type": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.content-pattern.get

Get a particular content-pattern(s)

Method GET

Route /data-protection/entities/content-patterns/v1

Scope Data Protection: READ

PEP 8 get_content_pattern

Parameters

ids query · string or list of strings

The content-pattern id(s) to get.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_content_pattern(ids=id_list)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_content_pattern_get(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_content_pattern_get",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DataProtectionConfiguration.EntitiesContentPatternGet(
    &data_protection_configuration.EntitiesContentPatternGetParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesContentPatternGet(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

response = api.entities_content_pattern_get(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "category": "string",
    "cid": "string",
    "created": "string",
    "deleted": false,
    "description": "string",
    "example": "string",
    "id": "string",
    "last_updated": "string",
    "min_match_threshold": 0,
    "name": "string",
    "regexes": [],
    "region": "string",
    "type": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.content-pattern.patch

Update a content pattern

Method PATCH

Route /data-protection/entities/content-patterns/v1

Scope Data Protection: WRITE

PEP 8 update_content_pattern

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

description body · string

The description of the content pattern.

example body · string

The new content pattern demonstration.

min_match_threshold body · integer

name body · string

The name of the new content pattern.

regexes body · array

id query · string

The id of the content pattern to patch.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

category body · string

The content pattern category.

region body · string

The region for the content pattern.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_content_pattern(id="string",
                                         category="string",
                                         description="string",
                                         example="string",
                                         min_match_threshold=integer,
                                         name="string",
                                         regexes=id_list,
                                         region="string")
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_content_pattern_patch(id="string",
                                                 category="string",
                                                 description="string",
                                                 example="string",
                                                 min_match_threshold=integer,
                                                 name="string",
                                                 regexes=id_list,
                                                 region="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "description": "string",
    "example": "string",
    "id": "string",
    "min_match_threshold": integer,
    "name": "string",
    "regexes": ["string"]
}

response = falcon.command("entities_content_pattern_patch",
                          id="string",
                          body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  example := "string"
  id := "string"
  min_match_threshold := integer
  name := "string"

  response, err := client.DataProtectionConfiguration.EntitiesContentPatternPatch(
    &data_protection_configuration.EntitiesContentPatternPatchParams{
      Body: &models.APIContentPatternUpdateRequestV1{
        Description: &description,
        Example: &example,
        ID: &id,
        MinMatchThreshold: &min_match_threshold,
        Name: &name,
        Regexes: []string{"string"},
      },
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesContentPatternPatch(
  "string",  // id
  {  // body
      description: "string",
      example: "string",
      id: "string",
      minMatchThreshold: integer,
      name: "string",
      regexes: []
  }
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

body = Falcon::ApiContentPatternUpdateRequestV1.new(
  description: 'string',
  example: 'string',
  id: 'string',
  min_match_threshold: integer,
  name: 'string',
  regexes: []
)

response = api.entities_content_pattern_patch(body, 'string')

puts response

Responses

200 OK

[
  {
    "category": "string",
    "cid": "string",
    "created": "string",
    "deleted": false,
    "description": "string",
    "example": "string",
    "id": "string",
    "last_updated": "string",
    "min_match_threshold": 0,
    "name": "string",
    "regexes": [],
    "region": "string",
    "type": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.enterprise-account.create

Persist the given enterprise account for the provided entity instance

Method POST

Route /data-protection/entities/enterprise-accounts/v1

Scope Data Protection: WRITE

PEP 8 create_enterprise_account

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

application_group_id body · string

domains body · array

name body · string

The name of the enterprise account.

plugin_config_id body · string

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.create_enterprise_account(application_group_id="string",
                                            domains=id_list,
                                            name="string",
                                            plugin_config_id="string")
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_enterprise_account_create(application_group_id="string",
                                                     domains=id_list,
                                                     name="string",
                                                     plugin_config_id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "application_group_id": "string",
    "domains": ["string"],
    "name": "string",
    "plugin_config_id": "string"
}

response = falcon.command("entities_enterprise_account_create", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  application_group_id := "string"
  name := "string"
  plugin_config_id := "string"

  response, err := client.DataProtectionConfiguration.EntitiesEnterpriseAccountCreate(
    &data_protection_configuration.EntitiesEnterpriseAccountCreateParams{
      Body: &models.APIEnterpriseAccountCreateRequestV1{
        ApplicationGroupID: &application_group_id,
        Domains: []string{"string"},
        Name: &name,
        PluginConfigID: &plugin_config_id,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesEnterpriseAccountCreate(
  {
    applicationGroupId: "string",
    domains: [],
    name: "string",
    pluginConfigId: "string"
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

body = Falcon::ApiEnterpriseAccountCreateRequestV1.new(
  application_group_id: 'string',
  domains: [],
  name: 'string',
  plugin_config_id: 'string'
)

response = api.entities_enterprise_account_create(body)

puts response

Responses

200 OK

[
  {
    "application_group_id": "string",
    "cid": "string",
    "created": "string",
    "deleted": false,
    "domains": [],
    "id": "string",
    "last_updated": "string",
    "name": "string",
    "plugin_config_id": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.enterprise-account.delete

Delete enterprise account

Method DELETE

Route /data-protection/entities/enterprise-accounts/v1

Scope Data Protection: WRITE

PEP 8 delete_enterprise_account

Parameters

ids query · string or list of strings

The id of the enterprise account to delete.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_enterprise_account(ids=id_list)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_enterprise_account_delete(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_enterprise_account_delete",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DataProtectionConfiguration.EntitiesEnterpriseAccountDelete(
    &data_protection_configuration.EntitiesEnterpriseAccountDeleteParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesEnterpriseAccountDelete(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

response = api.entities_enterprise_account_delete(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "application_group_id": "string",
    "cid": "string",
    "created": "string",
    "deleted": false,
    "domains": [],
    "id": "string",
    "last_updated": "string",
    "name": "string",
    "plugin_config_id": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.enterprise-account.get

Get a particular enterprise-account(s)

Method GET

Route /data-protection/entities/enterprise-accounts/v1

Scope Data Protection: READ

PEP 8 get_enterprise_account

Parameters

ids query · string or list of strings

The enterprise-account id(s) to get.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_enterprise_account(ids=id_list)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_enterprise_account_get(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_enterprise_account_get",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DataProtectionConfiguration.EntitiesEnterpriseAccountGet(
    &data_protection_configuration.EntitiesEnterpriseAccountGetParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesEnterpriseAccountGet(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

response = api.entities_enterprise_account_get(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "application_group_id": "string",
    "cid": "string",
    "created": "string",
    "deleted": false,
    "domains": [],
    "id": "string",
    "last_updated": "string",
    "name": "string",
    "plugin_config_id": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.enterprise-account.patch

Update a enterprise account

Method PATCH

Route /data-protection/entities/enterprise-accounts/v1

Scope Data Protection: WRITE

PEP 8 update_enterprise_account

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

domains body · array

name body · string

The name of the enterprise account.

id query · string

The id of the enterprise account to update.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

application_group_id body · string

plugin_config_id body · string

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_enterprise_account(id="string",
                                            application_group_id="string",
                                            domains=id_list,
                                            name="string",
                                            plugin_config_id="string")
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_enterprise_account_patch(id="string",
                                                    application_group_id="string",
                                                    domains=id_list,
                                                    name="string",
                                                    plugin_config_id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "domains": ["string"],
    "id": "string",
    "name": "string"
}

response = falcon.command("entities_enterprise_account_patch",
                          id="string",
                          body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  id := "string"
  name := "string"

  response, err := client.DataProtectionConfiguration.EntitiesEnterpriseAccountPatch(
    &data_protection_configuration.EntitiesEnterpriseAccountPatchParams{
      Body: &models.APIEnterpriseAccountUpdateRequestV1{
        Domains: []string{"string"},
        ID: &id,
        Name: &name,
      },
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesEnterpriseAccountPatch(
  "string",  // id
  {  // body
      domains: [],
      id: "string",
      name: "string"
  }
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

body = Falcon::ApiEnterpriseAccountUpdateRequestV1.new(
  domains: [],
  id: 'string',
  name: 'string'
)

response = api.entities_enterprise_account_patch(body, 'string')

puts response

Responses

200 OK

[
  {
    "application_group_id": "string",
    "cid": "string",
    "created": "string",
    "deleted": false,
    "domains": [],
    "id": "string",
    "last_updated": "string",
    "name": "string",
    "plugin_config_id": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.file-type.get

Get a particular file-type

Method GET

Route /data-protection/entities/file-types/v1

Scope Data Protection: READ

PEP 8 get_file_type

Parameters

ids query · string or list of strings

The file-type id(s) to get.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_file_type(ids=id_list)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_file_type_get(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_file_type_get",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DataProtectionConfiguration.EntitiesFileTypeGet(
    &data_protection_configuration.EntitiesFileTypeGetParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesFileTypeGet(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

response = api.entities_file_type_get(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "category_id": "string",
    "created": "string",
    "description": "string",
    "id": "string",
    "last_updated": "string",
    "name": "string",
    "supported_platforms": [],
    "supports_content_inspection": false,
    "supports_mip_extraction": false
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.local-application-group.create

Persist the given local application group for the provided entity instance

Method POST

Route /data-protection/entities/local-application-groups/v1

Scope Data Protection: WRITE

PEP 8 create_local_application_group

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

description body · string

The description of the local application group.

local_application_ids body · array

List of local application IDs to include in the group.

name body · string

The name of the local application group.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.create_local_application_group(description="string",
                                                 local_application_ids=id_list,
                                                 name="string")
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_local_application_group_create(description="string",
                                                          local_application_ids=id_list,
                                                          name="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "description": "string",
    "local_application_ids": ["string"],
    "name": "string"
}

response = falcon.command("entities_local_application_group_create", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  name := "string"

  response, err := client.DataProtectionConfiguration.EntitiesLocalApplicationGroupCreate(
    &data_protection_configuration.EntitiesLocalApplicationGroupCreateParams{
      Body: &models.APILocalApplicationGroupCreateRequestV1{
        Description: &description,
        LocalApplicationIds: []string{"string"},
        Name: &name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesLocalApplicationGroupCreate(
  {
    description: "string",
    localApplicationIds: [],
    name: "string"
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

body = Falcon::ApiLocalApplicationGroupCreateRequestV1.new(
  description: 'string',
  local_application_ids: [],
  name: 'string'
)

response = api.entities_local_application_group_create(body)

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "created_at": "string",
    "deleted": false,
    "deleted_at": "string",
    "description": "string",
    "id": "string",
    "local_application_ids": [],
    "name": "string",
    "updated_at": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

409 Conflict

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.local-application-group.delete

Soft Delete local application.

Method DELETE

Route /data-protection/entities/local-application-groups/v1

Scope Data Protection: WRITE

PEP 8 delete_local_application_group

Parameters

ids query · string or list of strings

The id of the local application group to delete.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_local_application_group(ids=id_list)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_local_application_group_delete(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_local_application_group_delete",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DataProtectionConfiguration.EntitiesLocalApplicationGroupDelete(
    &data_protection_configuration.EntitiesLocalApplicationGroupDeleteParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesLocalApplicationGroupDelete(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

response = api.entities_local_application_group_delete(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "created_at": "string",
    "deleted": false,
    "deleted_at": "string",
    "description": "string",
    "id": "string",
    "local_application_ids": [],
    "name": "string",
    "updated_at": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.local-application-group.get

Get specific local application groups

Method GET

Route /data-protection/entities/local-application-groups/v1

Scope Data Protection: READ

PEP 8 get_local_application_group

Parameters

ids query · string or list of strings

The local application group id(s) to get.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_local_application_group(ids=id_list)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_local_application_group_get(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_local_application_group_get",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DataProtectionConfiguration.EntitiesLocalApplicationGroupGet(
    &data_protection_configuration.EntitiesLocalApplicationGroupGetParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesLocalApplicationGroupGet(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

response = api.entities_local_application_group_get(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "created_at": "string",
    "deleted": false,
    "deleted_at": "string",
    "description": "string",
    "id": "string",
    "local_application_ids": [],
    "name": "string",
    "updated_at": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.local-application-group.patch

Update a local application group

Method PATCH

Route /data-protection/entities/local-application-groups/v1

Scope Data Protection: WRITE

PEP 8 update_local_application_group

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

description body · string

The description of the local application group.

local_application_ids body · array

List of local application IDs to include in the group.

name body · string

The name of the local application group.

id query · string

The local app id to update.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_local_application_group(id="string",
                                                 description="string",
                                                 local_application_ids=id_list,
                                                 name="string")
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_local_application_group_patch(id="string",
                                                         description="string",
                                                         local_application_ids=id_list,
                                                         name="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "description": "string",
    "local_application_ids": ["string"],
    "name": "string"
}

response = falcon.command("entities_local_application_group_patch",
                          id="string",
                          body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  name := "string"

  response, err := client.DataProtectionConfiguration.EntitiesLocalApplicationGroupPatch(
    &data_protection_configuration.EntitiesLocalApplicationGroupPatchParams{
      Body: &models.APILocalApplicationGroupUpdateRequestV1{
        Description: &description,
        LocalApplicationIds: []string{"string"},
        Name: &name,
      },
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesLocalApplicationGroupPatch(
  "string",  // id
  {  // body
      description: "string",
      localApplicationIds: [],
      name: "string"
  }
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

body = Falcon::ApiLocalApplicationGroupUpdateRequestV1.new(
  description: 'string',
  local_application_ids: [],
  name: 'string'
)

response = api.entities_local_application_group_patch(body, 'string')

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "created_at": "string",
    "deleted": false,
    "deleted_at": "string",
    "description": "string",
    "id": "string",
    "local_application_ids": [],
    "name": "string",
    "updated_at": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

409 Conflict

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.local-application.create

Persist the given local application for the provided entity instance

Method POST

Route /data-protection/entities/local-applications/v1

Scope Data Protection: WRITE

PEP 8 create_local_application

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

apply_rules_for_children_processes body · boolean

Whether to apply rules for children processes of this application.

emit_rule_matched_events_only body · boolean

enable_rename_detection body · boolean

executable_name body · string

The executable name of the local application.

group_ids body · array

List of group IDs to associate with this local application.

name body · string

The name of the local application.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.create_local_application(apply_rules_for_children_processes=boolean,
                                           executable_name="string",
                                           group_ids=id_list,
                                           name="string")
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_local_application_create(apply_rules_for_children_processes=boolean,
                                                    executable_name="string",
                                                    group_ids=id_list,
                                                    name="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "apply_rules_for_children_processes": boolean,
    "emit_rule_matched_events_only": boolean,
    "enable_rename_detection": boolean,
    "executable_name": "string",
    "group_ids": ["string"],
    "name": "string"
}

response = falcon.command("entities_local_application_create", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  apply_rules_for_children_processes := boolean
  emit_rule_matched_events_only := boolean
  enable_rename_detection := boolean
  executable_name := "string"
  name := "string"

  response, err := client.DataProtectionConfiguration.EntitiesLocalApplicationCreate(
    &data_protection_configuration.EntitiesLocalApplicationCreateParams{
      Body: &models.APILocalApplicationCreateRequestV1{
        ApplyRulesForChildrenProcesses: &apply_rules_for_children_processes,
        EmitRuleMatchedEventsOnly: &emit_rule_matched_events_only,
        EnableRenameDetection: &enable_rename_detection,
        ExecutableName: &executable_name,
        GroupIds: []string{"string"},
        Name: &name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesLocalApplicationCreate(
  {
    applyRulesForChildrenProcesses: boolean,
    emitRuleMatchedEventsOnly: boolean,
    enableRenameDetection: boolean,
    executableName: "string",
    groupIds: [],
    name: "string"
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

body = Falcon::ApiLocalApplicationCreateRequestV1.new(
  apply_rules_for_children_processes: boolean,
  emit_rule_matched_events_only: boolean,
  enable_rename_detection: boolean,
  executable_name: 'string',
  group_ids: [],
  name: 'string'
)

response = api.entities_local_application_create(body)

puts response

Responses

200 OK

[
  {
    "apply_rules_for_children_processes": false,
    "cid": "string",
    "created_at": "string",
    "deleted": false,
    "deleted_at": "string",
    "emit_rule_matched_events_only": false,
    "enable_rename_detection": false,
    "executable_name": "string",
    "group_ids": [],
    "id": "string",
    "name": "string",
    "updated_at": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

409 Conflict

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.local-application.delete

Soft Delete local application.

Method DELETE

Route /data-protection/entities/local-applications/v1

Scope Data Protection: WRITE

PEP 8 delete_local_application

Parameters

ids query · string or list of strings

The id of the local application to delete.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_local_application(ids=id_list)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_local_application_delete(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_local_application_delete",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DataProtectionConfiguration.EntitiesLocalApplicationDelete(
    &data_protection_configuration.EntitiesLocalApplicationDeleteParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesLocalApplicationDelete(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

response = api.entities_local_application_delete(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "apply_rules_for_children_processes": false,
    "cid": "string",
    "created_at": "string",
    "deleted": false,
    "deleted_at": "string",
    "emit_rule_matched_events_only": false,
    "enable_rename_detection": false,
    "executable_name": "string",
    "group_ids": [],
    "id": "string",
    "name": "string",
    "updated_at": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.local-application.get

Get a particular local application

Method GET

Route /data-protection/entities/local-applications/v1

Scope Data Protection: READ

PEP 8 get_local_application

Parameters

ids query · string or list of strings

The local application id(s) to get.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_local_application(ids=id_list)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_local_application_get(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_local_application_get",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DataProtectionConfiguration.EntitiesLocalApplicationGet(
    &data_protection_configuration.EntitiesLocalApplicationGetParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesLocalApplicationGet(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

response = api.entities_local_application_get(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "apply_rules_for_children_processes": false,
    "cid": "string",
    "created_at": "string",
    "deleted": false,
    "deleted_at": "string",
    "emit_rule_matched_events_only": false,
    "enable_rename_detection": false,
    "executable_name": "string",
    "group_ids": [],
    "id": "string",
    "name": "string",
    "updated_at": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.local-application.patch

Update a local application

Method PATCH

Route /data-protection/entities/local-applications/v1

Scope Data Protection: WRITE

PEP 8 update_local_application

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

apply_rules_for_children_processes body · boolean

Whether to apply rules for children processes of this application.

emit_rule_matched_events_only body · boolean

enable_rename_detection body · boolean

executable_name body · string

The executable name of the local application.

group_ids body · array

List of group IDs to associate with this local application.

name body · string

The name of the local application.

id query · string

The local app id to update.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_local_application(id="string",
                                           apply_rules_for_children_processes=boolean,
                                           executable_name="string",
                                           group_ids=id_list,
                                           name="string")
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_local_application_patch(id="string",
                                                   apply_rules_for_children_processes=boolean,
                                                   executable_name="string",
                                                   group_ids=id_list,
                                                   name="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "apply_rules_for_children_processes": boolean,
    "emit_rule_matched_events_only": boolean,
    "enable_rename_detection": boolean,
    "executable_name": "string",
    "group_ids": ["string"],
    "name": "string"
}

response = falcon.command("entities_local_application_patch",
                          id="string",
                          body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  apply_rules_for_children_processes := boolean
  emit_rule_matched_events_only := boolean
  enable_rename_detection := boolean
  executable_name := "string"
  name := "string"

  response, err := client.DataProtectionConfiguration.EntitiesLocalApplicationPatch(
    &data_protection_configuration.EntitiesLocalApplicationPatchParams{
      Body: &models.APILocalApplicationUpdateRequestV1{
        ApplyRulesForChildrenProcesses: &apply_rules_for_children_processes,
        EmitRuleMatchedEventsOnly: &emit_rule_matched_events_only,
        EnableRenameDetection: &enable_rename_detection,
        ExecutableName: &executable_name,
        GroupIds: []string{"string"},
        Name: &name,
      },
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesLocalApplicationPatch(
  "string",  // id
  {  // body
      applyRulesForChildrenProcesses: boolean,
      emitRuleMatchedEventsOnly: boolean,
      enableRenameDetection: boolean,
      executableName: "string",
      groupIds: [],
      name: "string"
  }
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

body = Falcon::ApiLocalApplicationUpdateRequestV1.new(
  apply_rules_for_children_processes: boolean,
  emit_rule_matched_events_only: boolean,
  enable_rename_detection: boolean,
  executable_name: 'string',
  group_ids: [],
  name: 'string'
)

response = api.entities_local_application_patch(body, 'string')

puts response

Responses

200 OK

[
  {
    "apply_rules_for_children_processes": false,
    "cid": "string",
    "created_at": "string",
    "deleted": false,
    "deleted_at": "string",
    "emit_rule_matched_events_only": false,
    "enable_rename_detection": false,
    "executable_name": "string",
    "group_ids": [],
    "id": "string",
    "name": "string",
    "updated_at": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

409 Conflict

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.policy.delete.v2

Deletes policies that match the provided ids

Method DELETE

Route /data-protection/entities/policies/v2

Scope Data Protection: WRITE

PEP 8 delete_policies

Parameters

ids query · string or list of strings

IDs of the policies to delete

platform_name query · string

platform name of the policies to update, either ‘win’ or ‘mac’

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_policies(ids=id_list, platform_name="string")
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_policy_delete_v2(ids=id_list, platform_name="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_policy_delete_v2",
                          ids=id_list,
                          platform_name="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DataProtectionConfiguration.EntitiesPolicyDeleteV2(
    &data_protection_configuration.EntitiesPolicyDeleteV2Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      PlatformName: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesPolicyDeleteV2(
  ["ID1", "ID2", "ID3"],  // ids
  "string"  // platformName
);

console.log(response);

Rust

Examples coming soon.

Ruby

Examples coming soon.

Responses

200 OK

[
  {
    "cid": "string",
    "created_at": "string",
    "created_by": "string",
    "description": "string",
    "host_groups": [],
    "id": "string",
    "is_default": false,
    "is_enabled": false,
    "modified_at": "string",
    "modified_by": "string",
    "name": "string",
    "platform_name": "string",
    "policy_properties": {},
    "policy_type": "string",
    "precedence": 0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_at": "string",
      "created_by": "string",
      "description": "string",
      "host_groups": [],
      "id": "string",
      "is_default": false,
      "is_enabled": false,
      "modified_at": "string",
      "modified_by": "string",
      "name": "string",
      "platform_name": "string",
      "policy_properties": {},
      "policy_type": "string",
      "precedence": 0
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_at": "string",
      "created_by": "string",
      "description": "string",
      "host_groups": [],
      "id": "string",
      "is_default": false,
      "is_enabled": false,
      "modified_at": "string",
      "modified_by": "string",
      "name": "string",
      "platform_name": "string",
      "policy_properties": {},
      "policy_type": "string",
      "precedence": 0
    }
  ]
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_at": "string",
      "created_by": "string",
      "description": "string",
      "host_groups": [],
      "id": "string",
      "is_default": false,
      "is_enabled": false,
      "modified_at": "string",
      "modified_by": "string",
      "name": "string",
      "platform_name": "string",
      "policy_properties": {},
      "policy_type": "string",
      "precedence": 0
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_at": "string",
      "created_by": "string",
      "description": "string",
      "host_groups": [],
      "id": "string",
      "is_default": false,
      "is_enabled": false,
      "modified_at": "string",
      "modified_by": "string",
      "name": "string",
      "platform_name": "string",
      "policy_properties": {},
      "policy_type": "string",
      "precedence": 0
    }
  ]
}

---

---

entities.policy.get.v2

Gets policies that match the provided ids

Method GET

Route /data-protection/entities/policies/v2

Scope Data Protection: READ

PEP 8 get_policies

Parameters

ids query · string or list of strings

IDs of the policies to get

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_policies(ids=id_list)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_policy_get_v2(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_policy_get_v2",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DataProtectionConfiguration.EntitiesPolicyGetV2(
    &data_protection_configuration.EntitiesPolicyGetV2Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesPolicyGetV2(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

response = api.entities_policy_get_v2(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "created_at": "string",
    "created_by": "string",
    "description": "string",
    "host_groups": [],
    "id": "string",
    "is_default": false,
    "is_enabled": false,
    "modified_at": "string",
    "modified_by": "string",
    "name": "string",
    "platform_name": "string",
    "policy_properties": {},
    "policy_type": "string",
    "precedence": 0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_at": "string",
      "created_by": "string",
      "description": "string",
      "host_groups": [],
      "id": "string",
      "is_default": false,
      "is_enabled": false,
      "modified_at": "string",
      "modified_by": "string",
      "name": "string",
      "platform_name": "string",
      "policy_properties": {},
      "policy_type": "string",
      "precedence": 0
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_at": "string",
      "created_by": "string",
      "description": "string",
      "host_groups": [],
      "id": "string",
      "is_default": false,
      "is_enabled": false,
      "modified_at": "string",
      "modified_by": "string",
      "name": "string",
      "platform_name": "string",
      "policy_properties": {},
      "policy_type": "string",
      "precedence": 0
    }
  ]
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_at": "string",
      "created_by": "string",
      "description": "string",
      "host_groups": [],
      "id": "string",
      "is_default": false,
      "is_enabled": false,
      "modified_at": "string",
      "modified_by": "string",
      "name": "string",
      "platform_name": "string",
      "policy_properties": {},
      "policy_type": "string",
      "precedence": 0
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_at": "string",
      "created_by": "string",
      "description": "string",
      "host_groups": [],
      "id": "string",
      "is_default": false,
      "is_enabled": false,
      "modified_at": "string",
      "modified_by": "string",
      "name": "string",
      "platform_name": "string",
      "policy_properties": {},
      "policy_type": "string",
      "precedence": 0
    }
  ]
}

---

---

entities.policy.patch.v2

Update policies

Method PATCH

Route /data-protection/entities/policies/v2

Scope Data Protection: WRITE

PEP 8 update_policies

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

platform_name query · string

platform name of the policies to update, either ‘win’ or ‘mac’

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

id body · string

The ID of the policy to update. Required for update operations.

is_enabled body · boolean

Flag indicating if the policy is enabled.

host_groups body · string or list of strings

List of host group IDs to assign to the policy.

description body · string

The description of the policy.

name body · string

The name of the policy.

policy_properties body · dictionary

The properties of the policy.

precedence body · integer

The order of precedence.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

policy_properties = {
    "allow_notifications": "default",
    "be_exclude_domains": "string",
    "be_paste_clipboard_max_size": 0,
    "be_paste_clipboard_max_size_unit": "Bytes",
    "be_paste_clipboard_min_size": 0,
    "be_paste_clipboard_min_size_unit": "Bytes",
    "be_paste_clipboard_over_size_behaviour_block": True,
    "be_paste_timeout_duration_milliseconds": 0,
    "be_paste_timeout_response": "block",
    "be_splash_custom_message": "string",
    "be_splash_enabled": True,
    "be_splash_message_source": "default",
    "be_upload_timeout_duration_seconds": 0,
    "be_upload_timeout_response": "block",
    "block_all_data_access": True,
    "block_notifications": "default",
    "browsers_without_active_extension": "allow",
    "classifications": [
        "string"
    ],
    "custom_allow_notification": "string",
    "custom_block_notification": "string",
    "enable_clipboard_inspection": True,
    "enable_content_inspection": True,
    "enable_context_inspection": True,
    "enable_end_user_notifications_unsupported_browser": True,
    "enable_network_inspection": True,
    "euj_dialog_box_logo": "string",
    "euj_dialog_timeout": 0,
    "euj_dropdown_options": {
        "justifications": [
            {
                "default": True,
                "id": "string",
                "justification": "string",
                "selected": True
            }
        ]
    },
    "euj_header_text": {
        "headers": [
            {
                "default": True,
                "header": "string",
                "selected": True
            }
        ]
    },
    "euj_require_additional_details": True,
    "euj_response_cache_timeout": 0,
    "evidence_download_enabled": True,
    "evidence_duplication_enabled_default": True,
    "evidence_encrypted_enabled": True,
    "evidence_storage_free_disk_perc": 0,
    "evidence_storage_max_size": 0,
    "inspection_depth": "balanced",
    "max_file_size_to_inspect": 0,
    "max_file_size_to_inspect_unit": "Bytes",
    "min_confidence_level": "low",
    "network_inspection_files_exceeding_size_limit": "block",
    "similarity_detection": True,
    "similarity_threshold": "10",
    "unsupported_browsers_action": "allow"
}

response = falcon.update_policies(platform_name="string",
                                  id="string",
                                  is_enabled=boolean,
                                  host_groups=id_list,
                                  description="string",
                                  name="string",
                                  policy_properties=policy_properties,
                                  precedence=integer)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

policy_properties = {
    "allow_notifications": "default",
    "be_exclude_domains": "string",
    "be_paste_clipboard_max_size": 0,
    "be_paste_clipboard_max_size_unit": "Bytes",
    "be_paste_clipboard_min_size": 0,
    "be_paste_clipboard_min_size_unit": "Bytes",
    "be_paste_clipboard_over_size_behaviour_block": True,
    "be_paste_timeout_duration_milliseconds": 0,
    "be_paste_timeout_response": "block",
    "be_splash_custom_message": "string",
    "be_splash_enabled": True,
    "be_splash_message_source": "default",
    "be_upload_timeout_duration_seconds": 0,
    "be_upload_timeout_response": "block",
    "block_all_data_access": True,
    "block_notifications": "default",
    "browsers_without_active_extension": "allow",
    "classifications": [
        "string"
    ],
    "custom_allow_notification": "string",
    "custom_block_notification": "string",
    "enable_clipboard_inspection": True,
    "enable_content_inspection": True,
    "enable_context_inspection": True,
    "enable_end_user_notifications_unsupported_browser": True,
    "enable_network_inspection": True,
    "euj_dialog_box_logo": "string",
    "euj_dialog_timeout": 0,
    "euj_dropdown_options": {
        "justifications": [
            {
                "default": True,
                "id": "string",
                "justification": "string",
                "selected": True
            }
        ]
    },
    "euj_header_text": {
        "headers": [
            {
                "default": True,
                "header": "string",
                "selected": True
            }
        ]
    },
    "euj_require_additional_details": True,
    "euj_response_cache_timeout": 0,
    "evidence_download_enabled": True,
    "evidence_duplication_enabled_default": True,
    "evidence_encrypted_enabled": True,
    "evidence_storage_free_disk_perc": 0,
    "evidence_storage_max_size": 0,
    "inspection_depth": "balanced",
    "max_file_size_to_inspect": 0,
    "max_file_size_to_inspect_unit": "Bytes",
    "min_confidence_level": "low",
    "network_inspection_files_exceeding_size_limit": "block",
    "similarity_detection": True,
    "similarity_threshold": "10",
    "unsupported_browsers_action": "allow"
}

response = falcon.entities_policy_patch_v2(platform_name="string",
                                           id="string",
                                           is_enabled=boolean,
                                           host_groups=id_list,
                                           description="string",
                                           name="string",
                                           policy_properties=policy_properties,
                                           precedence=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "resources": [
        {
            "description": "string",
            "host_groups": ["string"],
            "id": "string",
            "is_enabled": boolean,
            "name": "string",
            "policy_properties": {
                "allow_notifications": "string",
                "be_exclude_domains": "string",
                "be_paste_clipboard_max_size": integer,
                "be_paste_clipboard_max_size_unit": "string",
                "be_paste_clipboard_min_size": integer,
                "be_paste_clipboard_min_size_unit": "string",
                "be_paste_clipboard_over_size_behaviour_block": boolean,
                "be_paste_timeout_duration_milliseconds": integer,
                "be_paste_timeout_response": "string",
                "be_splash_custom_message": "string",
                "be_splash_enabled": boolean,
                "be_splash_message_source": "string",
                "be_upload_timeout_duration_seconds": integer,
                "be_upload_timeout_response": "string",
                "block_all_data_access": boolean,
                "block_notifications": "string",
                "browsers_without_active_extension": "string",
                "classifications": ["string"],
                "custom_allow_notification": "string",
                "custom_block_notification": "string",
                "enable_clipboard_inspection": boolean,
                "enable_clipboard_web_origin": boolean,
                "enable_content_inspection": boolean,
                "enable_context_inspection": boolean,
                "enable_end_user_notifications_unsupported_browser": boolean,
                "enable_network_inspection": boolean,
                "enable_ocr": boolean,
                "enable_screen_capture": boolean,
                "euj_dialog_box_logo": "string",
                "euj_dialog_timeout": integer,
                "euj_dropdown_options": {},
                "euj_header_text": {},
                "euj_require_additional_details": boolean,
                "evidence_download_enabled": boolean,
                "evidence_duplication_enabled_default": boolean,
                "evidence_encrypted_enabled": boolean,
                "evidence_storage_free_disk_perc": integer,
                "evidence_storage_max_size": integer,
                "inspection_depth": "string",
                "max_file_size_to_inspect": integer,
                "max_file_size_to_inspect_unit": "string",
                "min_confidence_level": "string",
                "network_inspection_files_exceeding_size_limit": "string",
                "screen_capture_duration_post_event": "string",
                "screen_capture_duration_pre_event": "string",
                "similarity_detection": boolean,
                "similarity_threshold": "string"
            }
        }
    ]
}

response = falcon.command("entities_policy_patch_v2",
                          platform_name="string",
                          body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  id := "string"
  is_enabled := boolean
  name := "string"

  response, err := client.DataProtectionConfiguration.EntitiesPolicyPatchV2(
    &data_protection_configuration.EntitiesPolicyPatchV2Params{
      Body: &models.PolicymanagerUpdatePoliciesRequest{
        Resources: []interface{}{
          {
          Description: &description,
          HostGroups: []string{"string"},
          ID: &id,
          IsEnabled: &is_enabled,
          Name: &name,
          PolicyProperties: &struct{}{},
          },
        },
      },
      PlatformName: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesPolicyPatchV2(
  "string",  // platformName
  {  // body
      resources: [{
          description: "string",
          hostGroups: [],
          id: "string",
          isEnabled: boolean,
          name: "string",
          policyProperties: {
            allowNotifications: "string",
            beExcludeDomains: "string",
            bePasteClipboardMaxSize: integer,
            bePasteClipboardMaxSizeUnit: "string",
            bePasteClipboardMinSize: integer,
            bePasteClipboardMinSizeUnit: "string",
            bePasteClipboardOverSizeBehaviourBlock: boolean,
            bePasteTimeoutDurationMilliseconds: integer,
            bePasteTimeoutResponse: "string",
            beSplashCustomMessage: "string",
            beSplashEnabled: boolean,
            beSplashMessageSource: "string",
            beUploadTimeoutDurationSeconds: integer,
            beUploadTimeoutResponse: "string",
            blockAllDataAccess: boolean,
            blockNotifications: "string",
            browsersWithoutActiveExtension: "string",
            classifications: [],
            customAllowNotification: "string",
            customBlockNotification: "string",
            enableClipboardInspection: boolean,
            enableClipboardWebOrigin: boolean,
            enableContentInspection: boolean,
            enableContextInspection: boolean,
            enableEndUserNotificationsUnsupportedBrowser: boolean,
            enableNetworkInspection: boolean,
            enableOcr: boolean,
            enableScreenCapture: boolean,
            eujDialogBoxLogo: "string",
            eujDialogTimeout: integer,
            eujDropdownOptions: {},
            eujHeaderText: {},
            eujRequireAdditionalDetails: boolean,
            evidenceDownloadEnabled: boolean,
            evidenceDuplicationEnabledDefault: boolean,
            evidenceEncryptedEnabled: boolean,
            evidenceStorageFreeDiskPerc: integer,
            evidenceStorageMaxSize: integer,
            inspectionDepth: "string",
            maxFileSizeToInspect: integer,
            maxFileSizeToInspectUnit: "string",
            minConfidenceLevel: "string",
            networkInspectionFilesExceedingSizeLimit: "string",
            screenCaptureDurationPostEvent: "string",
            screenCaptureDurationPreEvent: "string",
            similarityDetection: boolean,
            similarityThreshold: "string"
          }
        }]
  }
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

body = Falcon::PolicymanagerUpdatePoliciesRequest.new(
  resources: [{
      description: 'string',
      host_groups: [],
      id: 'string',
      is_enabled: boolean,
      name: 'string',
      policy_properties: {
        allow_notifications: 'string',
        be_exclude_domains: 'string',
        be_paste_clipboard_max_size: integer,
        be_paste_clipboard_max_size_unit: 'string',
        be_paste_clipboard_min_size: integer,
        be_paste_clipboard_min_size_unit: 'string',
        be_paste_clipboard_over_size_behaviour_block: boolean,
        be_paste_timeout_duration_milliseconds: integer,
        be_paste_timeout_response: 'string',
        be_splash_custom_message: 'string',
        be_splash_enabled: boolean,
        be_splash_message_source: 'string',
        be_upload_timeout_duration_seconds: integer,
        be_upload_timeout_response: 'string',
        block_all_data_access: boolean,
        block_notifications: 'string',
        browsers_without_active_extension: 'string',
        classifications: [],
        custom_allow_notification: 'string',
        custom_block_notification: 'string',
        enable_clipboard_inspection: boolean,
        enable_clipboard_web_origin: boolean,
        enable_content_inspection: boolean,
        enable_context_inspection: boolean,
        enable_end_user_notifications_unsupported_browser: boolean,
        enable_network_inspection: boolean,
        enable_ocr: boolean,
        enable_screen_capture: boolean,
        euj_dialog_box_logo: 'string',
        euj_dialog_timeout: integer,
        euj_dropdown_options: {},
        euj_header_text: {},
        euj_require_additional_details: boolean,
        evidence_download_enabled: boolean,
        evidence_duplication_enabled_default: boolean,
        evidence_encrypted_enabled: boolean,
        evidence_storage_free_disk_perc: integer,
        evidence_storage_max_size: integer,
        inspection_depth: 'string',
        max_file_size_to_inspect: integer,
        max_file_size_to_inspect_unit: 'string',
        min_confidence_level: 'string',
        network_inspection_files_exceeding_size_limit: 'string',
        screen_capture_duration_post_event: 'string',
        screen_capture_duration_pre_event: 'string',
        similarity_detection: boolean,
        similarity_threshold: 'string'
      }
    }]
)

response = api.entities_policy_patch_v2(body, 'string')

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "created_at": "string",
    "created_by": "string",
    "description": "string",
    "host_groups": [],
    "id": "string",
    "is_default": false,
    "is_enabled": false,
    "modified_at": "string",
    "modified_by": "string",
    "name": "string",
    "platform_name": "string",
    "policy_properties": {},
    "policy_type": "string",
    "precedence": 0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_at": "string",
      "created_by": "string",
      "description": "string",
      "host_groups": [],
      "id": "string",
      "is_default": false,
      "is_enabled": false,
      "modified_at": "string",
      "modified_by": "string",
      "name": "string",
      "platform_name": "string",
      "policy_properties": {},
      "policy_type": "string",
      "precedence": 0
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_at": "string",
      "created_by": "string",
      "description": "string",
      "host_groups": [],
      "id": "string",
      "is_default": false,
      "is_enabled": false,
      "modified_at": "string",
      "modified_by": "string",
      "name": "string",
      "platform_name": "string",
      "policy_properties": {},
      "policy_type": "string",
      "precedence": 0
    }
  ]
}

409 Conflict

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_at": "string",
      "created_by": "string",
      "description": "string",
      "host_groups": [],
      "id": "string",
      "is_default": false,
      "is_enabled": false,
      "modified_at": "string",
      "modified_by": "string",
      "name": "string",
      "platform_name": "string",
      "policy_properties": {},
      "policy_type": "string",
      "precedence": 0
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_at": "string",
      "created_by": "string",
      "description": "string",
      "host_groups": [],
      "id": "string",
      "is_default": false,
      "is_enabled": false,
      "modified_at": "string",
      "modified_by": "string",
      "name": "string",
      "platform_name": "string",
      "policy_properties": {},
      "policy_type": "string",
      "precedence": 0
    }
  ]
}

---

---

entities.policy.post.v2

Create policies

Method POST

Route /data-protection/entities/policies/v2

Scope Data Protection: WRITE

PEP 8 create_policy

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

platform_name query · string

platform name of the policies to update, either ‘win’ or ‘mac’

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

description body · string

The description of the new policy.

name body · string

The name of the new policy.

policy_properties body · dictionary

The properties of the new policy.

precedence body · integer

The order of precedence.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

policy_properties = {
    "allow_notifications": "default",
    "be_exclude_domains": "string",
    "be_paste_clipboard_max_size": 0,
    "be_paste_clipboard_max_size_unit": "Bytes",
    "be_paste_clipboard_min_size": 0,
    "be_paste_clipboard_min_size_unit": "Bytes",
    "be_paste_clipboard_over_size_behaviour_block": True,
    "be_paste_timeout_duration_milliseconds": 0,
    "be_paste_timeout_response": "block",
    "be_splash_custom_message": "string",
    "be_splash_enabled": True,
    "be_splash_message_source": "default",
    "be_upload_timeout_duration_seconds": 0,
    "be_upload_timeout_response": "block",
    "block_all_data_access": True,
    "block_notifications": "default",
    "browsers_without_active_extension": "allow",
    "classifications": [
        "string"
    ],
    "custom_allow_notification": "string",
    "custom_block_notification": "string",
    "enable_clipboard_inspection": True,
    "enable_content_inspection": True,
    "enable_context_inspection": True,
    "enable_end_user_notifications_unsupported_browser": True,
    "enable_network_inspection": True,
    "euj_dialog_box_logo": "string",
    "euj_dialog_timeout": 0,
    "euj_dropdown_options": {
        "justifications": [
            {
                "default": True,
                "id": "string",
                "justification": "string",
                "selected": True
            }
        ]
    },
    "euj_header_text": {
        "headers": [
            {
                "default": True,
                "header": "string",
                "selected": True
            }
        ]
    },
    "euj_require_additional_details": True,
    "euj_response_cache_timeout": 0,
    "evidence_download_enabled": True,
    "evidence_duplication_enabled_default": True,
    "evidence_encrypted_enabled": True,
    "evidence_storage_free_disk_perc": 0,
    "evidence_storage_max_size": 0,
    "inspection_depth": "balanced",
    "max_file_size_to_inspect": 0,
    "max_file_size_to_inspect_unit": "Bytes",
    "min_confidence_level": "low",
    "network_inspection_files_exceeding_size_limit": "block",
    "similarity_detection": True,
    "similarity_threshold": "10",
    "unsupported_browsers_action": "allow"
}

response = falcon.create_policy(platform_name="string",
                                description="string",
                                name="string",
                                policy_properties=policy_properties,
                                precedence=integer)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

policy_properties = {
    "allow_notifications": "default",
    "be_exclude_domains": "string",
    "be_paste_clipboard_max_size": 0,
    "be_paste_clipboard_max_size_unit": "Bytes",
    "be_paste_clipboard_min_size": 0,
    "be_paste_clipboard_min_size_unit": "Bytes",
    "be_paste_clipboard_over_size_behaviour_block": True,
    "be_paste_timeout_duration_milliseconds": 0,
    "be_paste_timeout_response": "block",
    "be_splash_custom_message": "string",
    "be_splash_enabled": True,
    "be_splash_message_source": "default",
    "be_upload_timeout_duration_seconds": 0,
    "be_upload_timeout_response": "block",
    "block_all_data_access": True,
    "block_notifications": "default",
    "browsers_without_active_extension": "allow",
    "classifications": [
        "string"
    ],
    "custom_allow_notification": "string",
    "custom_block_notification": "string",
    "enable_clipboard_inspection": True,
    "enable_content_inspection": True,
    "enable_context_inspection": True,
    "enable_end_user_notifications_unsupported_browser": True,
    "enable_network_inspection": True,
    "euj_dialog_box_logo": "string",
    "euj_dialog_timeout": 0,
    "euj_dropdown_options": {
        "justifications": [
            {
                "default": True,
                "id": "string",
                "justification": "string",
                "selected": True
            }
        ]
    },
    "euj_header_text": {
        "headers": [
            {
                "default": True,
                "header": "string",
                "selected": True
            }
        ]
    },
    "euj_require_additional_details": True,
    "euj_response_cache_timeout": 0,
    "evidence_download_enabled": True,
    "evidence_duplication_enabled_default": True,
    "evidence_encrypted_enabled": True,
    "evidence_storage_free_disk_perc": 0,
    "evidence_storage_max_size": 0,
    "inspection_depth": "balanced",
    "max_file_size_to_inspect": 0,
    "max_file_size_to_inspect_unit": "Bytes",
    "min_confidence_level": "low",
    "network_inspection_files_exceeding_size_limit": "block",
    "similarity_detection": True,
    "similarity_threshold": "10",
    "unsupported_browsers_action": "allow"
}

response = falcon.entities_policy_post_v2(platform_name="string",
                                          description="string",
                                          name="string",
                                          policy_properties=policy_properties,
                                          precedence=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "description": "string",
            "name": "string",
            "policy_properties": {
                "allow_notifications": "string",
                "be_exclude_domains": "string",
                "be_paste_clipboard_max_size": integer,
                "be_paste_clipboard_max_size_unit": "string",
                "be_paste_clipboard_min_size": integer,
                "be_paste_clipboard_min_size_unit": "string",
                "be_paste_clipboard_over_size_behaviour_block": boolean,
                "be_paste_timeout_duration_milliseconds": integer,
                "be_paste_timeout_response": "string",
                "be_splash_custom_message": "string",
                "be_splash_enabled": boolean,
                "be_splash_message_source": "string",
                "be_upload_timeout_duration_seconds": integer,
                "be_upload_timeout_response": "string",
                "block_all_data_access": boolean,
                "block_notifications": "string",
                "browsers_without_active_extension": "string",
                "classifications": ["string"],
                "custom_allow_notification": "string",
                "custom_block_notification": "string",
                "enable_clipboard_inspection": boolean,
                "enable_clipboard_web_origin": boolean,
                "enable_content_inspection": boolean,
                "enable_context_inspection": boolean,
                "enable_end_user_notifications_unsupported_browser": boolean,
                "enable_network_inspection": boolean,
                "enable_ocr": boolean,
                "enable_screen_capture": boolean,
                "euj_dialog_box_logo": "string",
                "euj_dialog_timeout": integer,
                "euj_dropdown_options": {},
                "euj_header_text": {},
                "euj_require_additional_details": boolean,
                "evidence_download_enabled": boolean,
                "evidence_duplication_enabled_default": boolean,
                "evidence_encrypted_enabled": boolean,
                "evidence_storage_free_disk_perc": integer,
                "evidence_storage_max_size": integer,
                "inspection_depth": "string",
                "max_file_size_to_inspect": integer,
                "max_file_size_to_inspect_unit": "string",
                "min_confidence_level": "string",
                "network_inspection_files_exceeding_size_limit": "string",
                "screen_capture_duration_post_event": "string",
                "screen_capture_duration_pre_event": "string",
                "similarity_detection": boolean,
                "similarity_threshold": "string"
            },
            "precedence": integer
        }
    ]
}

response = falcon.command("entities_policy_post_v2",
                          platform_name="string",
                          body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  name := "string"
  precedence := integer

  response, err := client.DataProtectionConfiguration.EntitiesPolicyPostV2(
    &data_protection_configuration.EntitiesPolicyPostV2Params{
      Body: &models.PolicymanagerCreatePoliciesRequest{
        Resources: []interface{}{
          {
          Description: &description,
          Name: &name,
          PolicyProperties: &struct{}{},
          Precedence: &precedence,
          },
        },
      },
      PlatformName: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesPolicyPostV2(
  "string",  // platformName
  {  // body
      resources: [{
          description: "string",
          name: "string",
          policyProperties: {
            allowNotifications: "string",
            beExcludeDomains: "string",
            bePasteClipboardMaxSize: integer,
            bePasteClipboardMaxSizeUnit: "string",
            bePasteClipboardMinSize: integer,
            bePasteClipboardMinSizeUnit: "string",
            bePasteClipboardOverSizeBehaviourBlock: boolean,
            bePasteTimeoutDurationMilliseconds: integer,
            bePasteTimeoutResponse: "string",
            beSplashCustomMessage: "string",
            beSplashEnabled: boolean,
            beSplashMessageSource: "string",
            beUploadTimeoutDurationSeconds: integer,
            beUploadTimeoutResponse: "string",
            blockAllDataAccess: boolean,
            blockNotifications: "string",
            browsersWithoutActiveExtension: "string",
            classifications: [],
            customAllowNotification: "string",
            customBlockNotification: "string",
            enableClipboardInspection: boolean,
            enableClipboardWebOrigin: boolean,
            enableContentInspection: boolean,
            enableContextInspection: boolean,
            enableEndUserNotificationsUnsupportedBrowser: boolean,
            enableNetworkInspection: boolean,
            enableOcr: boolean,
            enableScreenCapture: boolean,
            eujDialogBoxLogo: "string",
            eujDialogTimeout: integer,
            eujDropdownOptions: {},
            eujHeaderText: {},
            eujRequireAdditionalDetails: boolean,
            evidenceDownloadEnabled: boolean,
            evidenceDuplicationEnabledDefault: boolean,
            evidenceEncryptedEnabled: boolean,
            evidenceStorageFreeDiskPerc: integer,
            evidenceStorageMaxSize: integer,
            inspectionDepth: "string",
            maxFileSizeToInspect: integer,
            maxFileSizeToInspectUnit: "string",
            minConfidenceLevel: "string",
            networkInspectionFilesExceedingSizeLimit: "string",
            screenCaptureDurationPostEvent: "string",
            screenCaptureDurationPreEvent: "string",
            similarityDetection: boolean,
            similarityThreshold: "string"
          },
          precedence: integer
        }]
  }
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

body = Falcon::PolicymanagerCreatePoliciesRequest.new(
  resources: [{
      description: 'string',
      name: 'string',
      policy_properties: {
        allow_notifications: 'string',
        be_exclude_domains: 'string',
        be_paste_clipboard_max_size: integer,
        be_paste_clipboard_max_size_unit: 'string',
        be_paste_clipboard_min_size: integer,
        be_paste_clipboard_min_size_unit: 'string',
        be_paste_clipboard_over_size_behaviour_block: boolean,
        be_paste_timeout_duration_milliseconds: integer,
        be_paste_timeout_response: 'string',
        be_splash_custom_message: 'string',
        be_splash_enabled: boolean,
        be_splash_message_source: 'string',
        be_upload_timeout_duration_seconds: integer,
        be_upload_timeout_response: 'string',
        block_all_data_access: boolean,
        block_notifications: 'string',
        browsers_without_active_extension: 'string',
        classifications: [],
        custom_allow_notification: 'string',
        custom_block_notification: 'string',
        enable_clipboard_inspection: boolean,
        enable_clipboard_web_origin: boolean,
        enable_content_inspection: boolean,
        enable_context_inspection: boolean,
        enable_end_user_notifications_unsupported_browser: boolean,
        enable_network_inspection: boolean,
        enable_ocr: boolean,
        enable_screen_capture: boolean,
        euj_dialog_box_logo: 'string',
        euj_dialog_timeout: integer,
        euj_dropdown_options: {},
        euj_header_text: {},
        euj_require_additional_details: boolean,
        evidence_download_enabled: boolean,
        evidence_duplication_enabled_default: boolean,
        evidence_encrypted_enabled: boolean,
        evidence_storage_free_disk_perc: integer,
        evidence_storage_max_size: integer,
        inspection_depth: 'string',
        max_file_size_to_inspect: integer,
        max_file_size_to_inspect_unit: 'string',
        min_confidence_level: 'string',
        network_inspection_files_exceeding_size_limit: 'string',
        screen_capture_duration_post_event: 'string',
        screen_capture_duration_pre_event: 'string',
        similarity_detection: boolean,
        similarity_threshold: 'string'
      },
      precedence: integer
    }]
)

response = api.entities_policy_post_v2(body, 'string')

puts response

Responses

201 Created

[
  {
    "cid": "string",
    "created_at": "string",
    "created_by": "string",
    "description": "string",
    "host_groups": [],
    "id": "string",
    "is_default": false,
    "is_enabled": false,
    "modified_at": "string",
    "modified_by": "string",
    "name": "string",
    "platform_name": "string",
    "policy_properties": {},
    "policy_type": "string",
    "precedence": 0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_at": "string",
      "created_by": "string",
      "description": "string",
      "host_groups": [],
      "id": "string",
      "is_default": false,
      "is_enabled": false,
      "modified_at": "string",
      "modified_by": "string",
      "name": "string",
      "platform_name": "string",
      "policy_properties": {},
      "policy_type": "string",
      "precedence": 0
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

409 Conflict

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_at": "string",
      "created_by": "string",
      "description": "string",
      "host_groups": [],
      "id": "string",
      "is_default": false,
      "is_enabled": false,
      "modified_at": "string",
      "modified_by": "string",
      "name": "string",
      "platform_name": "string",
      "policy_properties": {},
      "policy_type": "string",
      "precedence": 0
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_at": "string",
      "created_by": "string",
      "description": "string",
      "host_groups": [],
      "id": "string",
      "is_default": false,
      "is_enabled": false,
      "modified_at": "string",
      "modified_by": "string",
      "name": "string",
      "platform_name": "string",
      "policy_properties": {},
      "policy_type": "string",
      "precedence": 0
    }
  ]
}

---

---

entities.policy.precedence.post.v1

Update Policy Precedence

Method POST

Route /data-protection/entities/data-protection-precedence/v1

Scope Data Protection: WRITE

PEP 8 update_policy_precedence

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

platform body · string

The platform for the policy precedence update (e.g., ‘win’ or ‘mac’)

precedence body · string or list of strings

Ordered list of policy IDs defining the precedence order.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_policy_precedence(platform="string",
                                           precedence=id_list)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_policy_precedence_post_v1(platform="string",
                                                     precedence=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "resources": [
        {
            "platform": "string",
            "precedence": ["string"]
        }
    ]
}

response = falcon.command("entities_policy_precedence_post_v1", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  platform := "string"

  response, err := client.DataProtectionConfiguration.EntitiesPolicyPrecedencePostV1(
    &data_protection_configuration.EntitiesPolicyPrecedencePostV1Params{
      Body: &models.PolicymanagerPoliciesPrecedence{
        Resources: []interface{}{
          {
          Platform: &platform,
          Precedence: []string{"string"},
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesPolicyPrecedencePostV1(
  {
    resources: [{
        platform: "string",
        precedence: []
      }]
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

body = Falcon::PolicymanagerPoliciesPrecedence.new(
  resources: [{
      platform: 'string',
      precedence: []
    }]
)

response = api.entities_policy_precedence_post_v1(body)

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "created_at": "string",
    "created_by": "string",
    "description": "string",
    "host_groups": [],
    "id": "string",
    "is_default": false,
    "is_enabled": false,
    "modified_at": "string",
    "modified_by": "string",
    "name": "string",
    "platform_name": "string",
    "policy_properties": {},
    "policy_type": "string",
    "precedence": 0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_at": "string",
      "created_by": "string",
      "description": "string",
      "host_groups": [],
      "id": "string",
      "is_default": false,
      "is_enabled": false,
      "modified_at": "string",
      "modified_by": "string",
      "name": "string",
      "platform_name": "string",
      "policy_properties": {},
      "policy_type": "string",
      "precedence": 0
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_at": "string",
      "created_by": "string",
      "description": "string",
      "host_groups": [],
      "id": "string",
      "is_default": false,
      "is_enabled": false,
      "modified_at": "string",
      "modified_by": "string",
      "name": "string",
      "platform_name": "string",
      "policy_properties": {},
      "policy_type": "string",
      "precedence": 0
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_at": "string",
      "created_by": "string",
      "description": "string",
      "host_groups": [],
      "id": "string",
      "is_default": false,
      "is_enabled": false,
      "modified_at": "string",
      "modified_by": "string",
      "name": "string",
      "platform_name": "string",
      "policy_properties": {},
      "policy_type": "string",
      "precedence": 0
    }
  ]
}

---

---

entities.sensitivity-label.create-v2

Create new sensitivity label (V2)

Method POST

Route /data-protection/entities/labels/v2

Scope Data Protection: WRITE

PEP 8 create_sensitivity_label

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

co_authoring body · boolean

display_name body · string

external_id body · string

label_provider body · string

name body · string

The name of the new sensitivity label.

plugins_configuration_id body · string

synced body · boolean

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.create_sensitivity_label(co_authoring=boolean,
                                           display_name="string",
                                           external_id="string",
                                           label_provider="string",
                                           name="string",
                                           plugins_configuration_id="string",
                                           synced=boolean)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.entities_sensitivity_label_create_v2(co_authoring=boolean,
                                                       display_name="string",
                                                       external_id="string",
                                                       label_provider="string",
                                                       name="string",
                                                       plugins_configuration_id="string",
                                                       synced=boolean)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "co_authoring": boolean,
    "display_name": "string",
    "external_id": "string",
    "label_provider": "string",
    "name": "string",
    "plugins_configuration_id": "string",
    "synced": boolean
}

response = falcon.command("entities_sensitivity_label_create_v2", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  co_authoring := boolean
  display_name := "string"
  external_id := "string"
  label_provider := "string"
  name := "string"
  plugins_configuration_id := "string"
  synced := boolean

  response, err := client.DataProtectionConfiguration.EntitiesSensitivityLabelCreateV2(
    &data_protection_configuration.EntitiesSensitivityLabelCreateV2Params{
      Body: &models.APISensitivityLabelCreateRequestV2{
        CoAuthoring: &co_authoring,
        DisplayName: &display_name,
        ExternalID: &external_id,
        LabelProvider: &label_provider,
        Name: &name,
        PluginsConfigurationID: &plugins_configuration_id,
        Synced: &synced,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesSensitivityLabelCreateV2(
  {
    coAuthoring: boolean,
    displayName: "string",
    externalId: "string",
    labelProvider: "string",
    name: "string",
    pluginsConfigurationId: "string",
    synced: boolean
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

body = Falcon::ApiSensitivityLabelCreateRequestV2.new(
  co_authoring: boolean,
  display_name: 'string',
  external_id: 'string',
  label_provider: 'string',
  name: 'string',
  plugins_configuration_id: 'string',
  synced: boolean
)

response = api.entities_sensitivity_label_create_v2(body)

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "co_authoring": false,
    "created": "string",
    "deleted": false,
    "display_name": "string",
    "external_id": "string",
    "id": "string",
    "label_provider": "string",
    "last_updated": "string",
    "name": "string",
    "plugins_configuration_id": "string",
    "synced": false
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.sensitivity-label.delete-v2

Delete sensitivity labels matching the IDs (V2)

Method DELETE

Route /data-protection/entities/labels/v2

Scope Data Protection: WRITE

PEP 8 delete_sensitivity_label

Parameters

ids query · string or list of strings

The sensitivity label entity id(s) to delete.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_sensitivity_label(ids=id_list)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_sensitivity_label_delete_v2(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_sensitivity_label_delete_v2",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DataProtectionConfiguration.EntitiesSensitivityLabelDeleteV2(
    &data_protection_configuration.EntitiesSensitivityLabelDeleteV2Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesSensitivityLabelDeleteV2(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

response = api.entities_sensitivity_label_delete_v2(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "co_authoring": false,
    "created": "string",
    "deleted": false,
    "display_name": "string",
    "external_id": "string",
    "id": "string",
    "label_provider": "string",
    "last_updated": "string",
    "name": "string",
    "plugins_configuration_id": "string",
    "synced": false
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.sensitivity-label.get-v2

Get sensitivity label matching the IDs (V2)

Method GET

Route /data-protection/entities/labels/v2

Scope Data Protection: READ

PEP 8 get_sensitivity_label

Parameters

ids query · string or list of strings

The sensitivity label entity id(s) to get.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_sensitivity_label(ids=id_list)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_sensitivity_label_get_v2(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_sensitivity_label_get_v2",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DataProtectionConfiguration.EntitiesSensitivityLabelGetV2(
    &data_protection_configuration.EntitiesSensitivityLabelGetV2Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesSensitivityLabelGetV2(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

response = api.entities_sensitivity_label_get_v2(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "co_authoring": false,
    "created": "string",
    "deleted": false,
    "display_name": "string",
    "external_id": "string",
    "id": "string",
    "label_provider": "string",
    "last_updated": "string",
    "name": "string",
    "plugins_configuration_id": "string",
    "synced": false
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.web-location-group.create

Create a web location group

Method POST

Route /data-protection/entities/web-location-groups/v2

Scope Data Protection: WRITE

PEP 8 entities_web_location_group_create

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

description body · string

The description value.

name body · string

The name value.

web_location_ids body · array

The web_location_ids value.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.entities_web_location_group_create(description="string",
                                                     name="string",
                                                     web_location_ids=["string"])
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.entities_web_location_group_create(description="string",
                                                     name="string",
                                                     web_location_ids=["string"])
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "name": "string",
    "web_location_ids": ["string"]
}

response = falcon.command("entities_web_location_group_create", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

Examples coming soon.

TypeScript

Examples coming soon.

Rust

Examples coming soon.

Ruby

Examples coming soon.

Responses

200 OK

[
  {
    "cid": "string",
    "created_at": "string",
    "deleted": false,
    "deleted_at": "string",
    "description": "string",
    "id": "string",
    "name": "string",
    "updated_at": "string",
    "web_location_ids": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

409 Conflict

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.web-location-group.delete

Soft delete web location groups

Method DELETE

Route /data-protection/entities/web-location-groups/v2

Scope Data Protection: WRITE

PEP 8 entities_web_location_group_delete

Parameters

ids query · string or list of strings

The id(s) of the web location group to delete.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_web_location_group_delete(ids=id_list)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_web_location_group_delete(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_web_location_group_delete",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

Examples coming soon.

TypeScript

Examples coming soon.

Rust

Examples coming soon.

Ruby

Examples coming soon.

Responses

200 OK

[
  {
    "cid": "string",
    "created_at": "string",
    "deleted": false,
    "deleted_at": "string",
    "description": "string",
    "id": "string",
    "name": "string",
    "updated_at": "string",
    "web_location_ids": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.web-location-group.get

Get specific web location groups

Method GET

Route /data-protection/entities/web-location-groups/v2

Scope Data Protection: READ

PEP 8 entities_web_location_group_get

Parameters

ids query · string or list of strings

The web location group id(s) to get.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_web_location_group_get(ids=id_list)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_web_location_group_get(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_web_location_group_get",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

Examples coming soon.

TypeScript

Examples coming soon.

Rust

Examples coming soon.

Ruby

Examples coming soon.

Responses

200 OK

[
  {
    "cid": "string",
    "created_at": "string",
    "deleted": false,
    "deleted_at": "string",
    "description": "string",
    "id": "string",
    "name": "string",
    "updated_at": "string",
    "web_location_ids": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.web-location-group.patch

Update a web location group

Method PATCH

Route /data-protection/entities/web-location-groups/v2

Scope Data Protection: WRITE

PEP 8 entities_web_location_group_patch

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

description body · string

The description value.

name body · string

The name value.

web_location_ids body · array

The web_location_ids value.

id query · string

The web location group id to update.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.entities_web_location_group_patch(id="string",
                                                    description="string",
                                                    name="string",
                                                    web_location_ids=["string"])
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.entities_web_location_group_patch(id="string",
                                                    description="string",
                                                    name="string",
                                                    web_location_ids=["string"])
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "name": "string",
    "web_location_ids": ["string"]
}

response = falcon.command("entities_web_location_group_patch",
                          id="string",
                          body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

Examples coming soon.

TypeScript

Examples coming soon.

Rust

Examples coming soon.

Ruby

Examples coming soon.

Responses

200 OK

[
  {
    "cid": "string",
    "created_at": "string",
    "deleted": false,
    "deleted_at": "string",
    "description": "string",
    "id": "string",
    "name": "string",
    "updated_at": "string",
    "web_location_ids": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

409 Conflict

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.web-location.create-v2

Persist the given web-locations

Method POST

Route /data-protection/entities/web-locations/v2

Scope Data Protection: WRITE

PEP 8 create_web_location

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

web_locations body · array

application_id body · string

Associated application ID.

application_id body · string

The ID of the application.

deleted body · boolean

Flag indicating if this location is deleted.

enterprise_account_id body · string

Associated enterprise account ID.

location_type body · string

Location type.

name body · string

Location name.

provider_location_id body · string

Provider location ID.

provider_location_name body · string

Provider location name.

type body · string

Type.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.create_web_location(application_id="string",
                                      application_id="string",
                                      deleted=boolean,
                                      enterprise_account_id="string",
                                      location_type="string",
                                      name="string",
                                      provider_location_id="string",
                                      provider_location_name="string",
                                      type="string")
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.entities_web_location_create_v2(application_id="string",
                                                  application_id="string",
                                                  deleted=boolean,
                                                  enterprise_account_id="string",
                                                  location_type="string",
                                                  name="string",
                                                  provider_location_id="string",
                                                  provider_location_name="string",
                                                  type="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "web_locations": [
        {
            "application_id": "string",
            "deleted": boolean,
            "enterprise_account_id": "string",
            "location_type": "string",
            "name": "string",
            "provider_location_id": "string",
            "provider_location_name": "string",
            "type": "string",
            "web_location_group_ids": ["string"]
        }
    ]
}

response = falcon.command("entities_web_location_create_v2", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  application_id := "string"
  deleted := boolean
  enterprise_account_id := "string"
  location_type := "string"
  name := "string"
  provider_location_id := "string"
  provider_location_name := "string"
  typeVar := "string"

  response, err := client.DataProtectionConfiguration.EntitiesWebLocationCreateV2(
    &data_protection_configuration.EntitiesWebLocationCreateV2Params{
      Body: &models.APICreateWebLocationsRequestV2{
        WebLocations: []interface{}{
          {
          ApplicationID: &application_id,
          Deleted: &deleted,
          EnterpriseAccountID: &enterprise_account_id,
          LocationType: &location_type,
          Name: &name,
          ProviderLocationID: &provider_location_id,
          ProviderLocationName: &provider_location_name,
          Type: &typeVar,
          WebLocationGroupIds: []string{"string"},
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesWebLocationCreateV2(
  {
    webLocations: [{
        applicationId: "string",
        deleted: boolean,
        enterpriseAccountId: "string",
        locationType: "string",
        name: "string",
        providerLocationId: "string",
        providerLocationName: "string",
        type: "string",
        webLocationGroupIds: []
      }]
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

body = Falcon::ApiCreateWebLocationsRequestV2.new(
  web_locations: [{
      application_id: 'string',
      deleted: boolean,
      enterprise_account_id: 'string',
      location_type: 'string',
      name: 'string',
      provider_location_id: 'string',
      provider_location_name: 'string',
      type: 'string',
      web_location_group_ids: []
    }]
)

response = api.entities_web_location_create_v2(body)

puts response

Responses

200 OK

[
  {
    "application_id": "string",
    "cid": "string",
    "created": "string",
    "deleted": false,
    "enterprise_account_id": "string",
    "id": "string",
    "last_updated": "string",
    "location_type": "string",
    "name": "string",
    "provider_location_id": "string",
    "provider_location_name": "string",
    "supports_network_inspection": false,
    "type": "string",
    "web_location_group_ids": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.web-location.delete-v2

Delete web-location

Method DELETE

Route /data-protection/entities/web-locations/v2

Scope Data Protection: WRITE

PEP 8 delete_web_location

Parameters

ids query · string or list of strings

The ids of the web-location to delete.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_web_location(ids=id_list)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_web_location_delete_v2(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_web_location_delete_v2",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DataProtectionConfiguration.EntitiesWebLocationDeleteV2(
    &data_protection_configuration.EntitiesWebLocationDeleteV2Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesWebLocationDeleteV2(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

response = api.entities_web_location_delete_v2(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "application_id": "string",
    "cid": "string",
    "created": "string",
    "deleted": false,
    "enterprise_account_id": "string",
    "id": "string",
    "last_updated": "string",
    "location_type": "string",
    "name": "string",
    "provider_location_id": "string",
    "provider_location_name": "string",
    "supports_network_inspection": false,
    "type": "string",
    "web_location_group_ids": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.web-location.get-v2

Get web-location entities matching the provided ID(s)

Method GET

Route /data-protection/entities/web-locations/v2

Scope Data Protection: READ

PEP 8 get_web_location

Parameters

ids query · string or list of strings

The web-location entity id(s) to get.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_web_location(ids=id_list)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_web_location_get_v2(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_web_location_get_v2",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DataProtectionConfiguration.EntitiesWebLocationGetV2(
    &data_protection_configuration.EntitiesWebLocationGetV2Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesWebLocationGetV2(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

response = api.entities_web_location_get_v2(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "application_id": "string",
    "cid": "string",
    "created": "string",
    "deleted": false,
    "enterprise_account_id": "string",
    "id": "string",
    "last_updated": "string",
    "location_type": "string",
    "name": "string",
    "provider_location_id": "string",
    "provider_location_name": "string",
    "supports_network_inspection": false,
    "type": "string",
    "web_location_group_ids": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.web-location.patch-v2

Update a web-location

Method PATCH

Route /data-protection/entities/web-locations/v2

Scope Data Protection: WRITE

PEP 8 update_web_location

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

application_id body · string

The ID of the application.

deleted body · boolean

Flag indicating if this location is deleted.

enterprise_account_id body · string

Associated enterprise account ID.

location_type body · string

Location type.

name body · string

Location name.

provider_location_id body · string

Provider location ID.

provider_location_name body · string

Provider location name.

type body · string

Type.

web_location_group_ids body · array

id query · string

The web-location entity id to update.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.update_web_location(application_id="string",
                                      application_id="string",
                                      deleted=boolean,
                                      enterprise_account_id="string",
                                      location_type="string",
                                      name="string",
                                      provider_location_id="string",
                                      provider_location_name="string",
                                      type="string")
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.entities_web_location_patch_v2(application_id="string",
                                                 application_id="string",
                                                 deleted=boolean,
                                                 enterprise_account_id="string",
                                                 location_type="string",
                                                 name="string",
                                                 provider_location_id="string",
                                                 provider_location_name="string",
                                                 type="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "application_id": "string",
    "deleted": boolean,
    "enterprise_account_id": "string",
    "id": "string",
    "location_type": "string",
    "name": "string",
    "provider_location_id": "string",
    "provider_location_name": "string",
    "type": "string",
    "web_location_group_ids": ["string"]
}

response = falcon.command("entities_web_location_patch_v2",
                          id="string",
                          body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  application_id := "string"
  deleted := boolean
  enterprise_account_id := "string"
  id := "string"
  location_type := "string"
  name := "string"
  provider_location_id := "string"
  provider_location_name := "string"
  typeVar := "string"

  response, err := client.DataProtectionConfiguration.EntitiesWebLocationPatchV2(
    &data_protection_configuration.EntitiesWebLocationPatchV2Params{
      Body: &models.APIUpdateWebLocationRequestV2{
        ApplicationID: &application_id,
        Deleted: &deleted,
        EnterpriseAccountID: &enterprise_account_id,
        ID: &id,
        LocationType: &location_type,
        Name: &name,
        ProviderLocationID: &provider_location_id,
        ProviderLocationName: &provider_location_name,
        Type: &typeVar,
        WebLocationGroupIds: []string{"string"},
      },
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.entitiesWebLocationPatchV2(
  "string",  // id
  {  // body
      applicationId: "string",
      deleted: boolean,
      enterpriseAccountId: "string",
      id: "string",
      locationType: "string",
      name: "string",
      providerLocationId: "string",
      providerLocationName: "string",
      type: "string",
      webLocationGroupIds: []
  }
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

body = Falcon::ApiUpdateWebLocationRequestV2.new(
  application_id: 'string',
  deleted: boolean,
  enterprise_account_id: 'string',
  id: 'string',
  location_type: 'string',
  name: 'string',
  provider_location_id: 'string',
  provider_location_name: 'string',
  type: 'string',
  web_location_group_ids: []
)

response = api.entities_web_location_patch_v2(body, 'string')

puts response

Responses

200 OK

[
  {
    "application_id": "string",
    "cid": "string",
    "created": "string",
    "deleted": false,
    "enterprise_account_id": "string",
    "id": "string",
    "last_updated": "string",
    "location_type": "string",
    "name": "string",
    "provider_location_id": "string",
    "provider_location_name": "string",
    "supports_network_inspection": false,
    "type": "string",
    "web_location_group_ids": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

queries.classification.get.v2

Search for classifications that match the provided criteria

Method GET

Route /data-protection/queries/classifications/v2

Scope Data Protection: READ

PEP 8 query_classifications

Parameters

filter query · string

Filter results by specific attributes , allowed attributes are

Available values (12)

created_by	properties.content_patterns_operator	properties.protection_mode
properties.sensitivity_labels	created_at	modified_by
modified_at	properties.content_patterns	properties.evidence_duplication_enabled
properties.file_types	properties.web_sources	name

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return

sort query · string

The property to sort by, allowed fields are :

Available values (3)

name

created_at

modified_at

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.query_classifications(filter="string",
                                        offset=integer,
                                        limit=integer,
                                        sort="string")
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.queries_classification_get_v2(filter="string",
                                                offset=integer,
                                                limit=integer,
                                                sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_classification_get_v2",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.DataProtectionConfiguration.QueriesClassificationGetV2(
    &data_protection_configuration.QueriesClassificationGetV2Params{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.queriesClassificationGetV2(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

Rust

Examples coming soon.

Ruby

Examples coming soon.

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

---

---

queries.cloud-application.get-v2

Get all cloud-application IDs matching the query with filter

Method GET

Route /data-protection/queries/cloud-applications/v2

Scope Data Protection: READ

PEP 8 query_cloud_applications

Parameters

filter query · string

Optional filter for searching cloud applications.

sort query · string

The sort instructions to order by on.

limit query · integer

The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.

offset query · integer

The offset to start retrieving records from. Use with the limit parameter to manage pagination of results.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.query_cloud_applications(filter="string",
                                           sort="string",
                                           limit=integer,
                                           offset=integer)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.queries_cloud_application_get_v2(filter="string",
                                                   sort="string",
                                                   limit=integer,
                                                   offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_cloud_application_get_v2",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.DataProtectionConfiguration.QueriesCloudApplicationGetV2(
    &data_protection_configuration.QueriesCloudApplicationGetV2Params{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.queriesCloudApplicationGetV2(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

response = api.queries_cloud_application_get_v2(filter: 'string',
                                                sort: 'string',
                                                limit: integer,
                                                offset: integer)

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

queries.content-pattern.get-v2

Get all content-pattern IDs matching the query with filter

Method GET

Route /data-protection/queries/content-patterns/v2

Scope Data Protection: READ

PEP 8 query_content_patterns

Parameters

filter query · string

The filter to use when finding content patterns.

sort query · string

The sort instructions to order by on.

limit query · integer

The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.

offset query · integer

The offset to start retrieving records from. Use with the limit parameter to manage pagination of results.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.query_content_patterns(filter="string",
                                         sort="string",
                                         limit=integer,
                                         offset=integer)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.queries_content_pattern_get_v2(filter="string",
                                                 sort="string",
                                                 limit=integer,
                                                 offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_content_pattern_get_v2",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.DataProtectionConfiguration.QueriesContentPatternGetV2(
    &data_protection_configuration.QueriesContentPatternGetV2Params{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.queriesContentPatternGetV2(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

response = api.queries_content_pattern_get_v2(filter: 'string',
                                              sort: 'string',
                                              limit: integer,
                                              offset: integer)

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

queries.enterprise-account.get-v2

Get all enterprise-account IDs matching the query with filter

Method GET

Route /data-protection/queries/enterprise-accounts/v2

Scope Data Protection: READ

PEP 8 query_enterprise_accounts

Parameters

filter query · string

The filter to use when finding enterprise accounts.

sort query · string

The sort instructions to order by on.

limit query · integer

The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.

offset query · integer

The offset to start retrieving records from. Use with the limit parameter to manage pagination of results.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.query_enterprise_accounts(filter="string",
                                            sort="string",
                                            limit=integer,
                                            offset=integer)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.queries_enterprise_account_get_v2(filter="string",
                                                    sort="string",
                                                    limit=integer,
                                                    offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_enterprise_account_get_v2",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.DataProtectionConfiguration.QueriesEnterpriseAccountGetV2(
    &data_protection_configuration.QueriesEnterpriseAccountGetV2Params{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.queriesEnterpriseAccountGetV2(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

response = api.queries_enterprise_account_get_v2(filter: 'string',
                                                 sort: 'string',
                                                 limit: integer,
                                                 offset: integer)

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

queries.file-type.get-v2

Get all file-type IDs matching the query with filter

Method GET

Route /data-protection/queries/file-types/v2

Scope Data Protection: READ

PEP 8 query_file_type

Parameters

filter query · string

The filter to use when finding file types.

sort query · string

The sort instructions to order by on.

limit query · integer

The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.

offset query · integer

The offset to start retrieving records from. Use with the limit parameter to manage pagination of results.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.query_file_type(filter="string",
                                  sort="string",
                                  limit=integer,
                                  offset=integer)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.queries_file_type_get_v2(filter="string",
                                           sort="string",
                                           limit=integer,
                                           offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_file_type_get_v2",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.DataProtectionConfiguration.QueriesFileTypeGetV2(
    &data_protection_configuration.QueriesFileTypeGetV2Params{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.queriesFileTypeGetV2(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

response = api.queries_file_type_get_v2(filter: 'string',
                                        sort: 'string',
                                        limit: integer,
                                        offset: integer)

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

queries.local-application-group.get

Get all local application group IDs matching the query with filter

Method GET

Route /data-protection/queries/local-application-groups/v1

Scope Data Protection: READ

PEP 8 query_local_application_groups

Parameters

filter query · string

Optional filter for searching local application group. Allowed filters are:

Available values (2)

is_deleted

platform

limit query · integer

The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.

offset query · integer

The offset to start retrieving records from. Use with the limit parameter to manage pagination of results.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.query_local_application_groups(filter="string",
                                                 limit=integer,
                                                 offset=integer)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.queries_local_application_group_get(filter="string",
                                                      limit=integer,
                                                      offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_local_application_group_get",
                          filter="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.DataProtectionConfiguration.QueriesLocalApplicationGroupGet(
    &data_protection_configuration.QueriesLocalApplicationGroupGetParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.queriesLocalApplicationGroupGet(
  "string",  // filter
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

response = api.queries_local_application_group_get('string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

queries.local-application.get

Get all local-application IDs matching the query with filter

Method GET

Route /data-protection/queries/local-applications/v1

Scope Data Protection: READ

PEP 8 query_local_applications

Parameters

filter query · string

Optional filter for searching local applications. Allowed filters are:

Available values (4)

name	is_deleted	created_at
updated_at

limit query · integer

The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.

offset query · integer

The offset to start retrieving records from. Use with the limit parameter to manage pagination of results.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.query_local_applications(filter="string",
                                           limit=integer,
                                           offset=integer)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.queries_local_application_get(filter="string",
                                                limit=integer,
                                                offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_local_application_get",
                          filter="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.DataProtectionConfiguration.QueriesLocalApplicationGet(
    &data_protection_configuration.QueriesLocalApplicationGetParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.queriesLocalApplicationGet(
  "string",  // filter
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

response = api.queries_local_application_get('string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

queries.policy.get.v2

Search for policies that match the provided criteria

Method GET

Route /data-protection/queries/policies/v2

Scope Data Protection: READ

PEP 8 query_policies

Parameters

platform_name query · string

platform name of the policies to search, either ‘win’ or ‘mac’

filter query · string

Filter results by specific attributes , allowed attributes are

Available values (51)

precedence	is_default	properties.evidence_encrypted_enabled
properties.be_upload_timeout_duration_seconds	properties.enable_screen_capture	description
modified_by	properties.evidence_download_enabled	properties.classifications
properties.be_paste_timeout_response	name	is_enabled
created_at	modified_at	properties.inspection_depth
properties.enable_clipboard_web_origin	properties.besplash_custom_message	properties.be_paste_clipboard_over_size_behaviour_block
properties.min_confidence_level	properties.enable_clipboard_inspection	properties.allow_notifications
properties.block_notifications	properties.be_upload_timeout_response	properties.be_paste_clipboard_min_size_unit
properties.be_paste_clipboard_max_size	properties.screen_capture_duration_pre_event	properties.max_file_size_to_inspect_unit
properties.browsers_without_active_extension	properties.evidence_duplication_enabled_default	properties.enable_network_inspection
properties.be_exclude_domains	properties.be_paste_timeout_duration_milliseconds	properties.be_paste_clipboard_min_size
properties.be_paste_clipboard_max_size_unit	created_by	properties.enable_content_inspection
properties.enable_context_inspection	properties.custom_allow_notification	properties.custom_block_notification
properties.besplash_enabled	properties.besplash_message_source	properties.max_file_size_to_inspect
properties.block_all_data_access	properties.similarity_detection	properties.evidence_storage_free_disk_perc
properties.evidence_storage_max_size	properties.euj_dialog_timeout	properties.screen_capture_duration_post_event
properties.enable_ocr	properties.similarity_threshold	properties.network_inspection_files_exceeding_size_limit

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return

sort query · string

The property to sort by, allowed fields are :

Available values (4)

name	precedence	created_at
modified_at

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.query_policies(platform_name="string",
                                 filter="string",
                                 offset=integer,
                                 limit=integer,
                                 sort="string")
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.queries_policy_get_v2(platform_name="string",
                                        filter="string",
                                        offset=integer,
                                        limit=integer,
                                        sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_policy_get_v2",
                          platform_name="string",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.DataProtectionConfiguration.QueriesPolicyGetV2(
    &data_protection_configuration.QueriesPolicyGetV2Params{
      PlatformName: "string",
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.queriesPolicyGetV2(
  "string",  // platformName
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

Rust

Examples coming soon.

Ruby

Examples coming soon.

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "field": "string",
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

---

---

queries.sensitivity-label.get-v2

Get all sensitivity label IDs matching the query with filter

Method GET

Route /data-protection/queries/labels/v2

Scope Data Protection: READ

PEP 8 query_sensitivity_label

Parameters

filter query · string

The filter to use when finding sensitivity labels.

sort query · string

The sort instructions to order by on.

limit query · integer

The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.

offset query · integer

The offset to start retrieving records from. Use with the limit parameter to manage pagination of results.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.query_sensitivity_label(filter="string",
                                          sort="string",
                                          limit=integer,
                                          offset=integer)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.queries_sensitivity_label_get_v2(filter="string",
                                                   sort="string",
                                                   limit=integer,
                                                   offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_sensitivity_label_get_v2",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.DataProtectionConfiguration.QueriesSensitivityLabelGetV2(
    &data_protection_configuration.QueriesSensitivityLabelGetV2Params{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.queriesSensitivityLabelGetV2(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

response = api.queries_sensitivity_label_get_v2(filter: 'string',
                                                sort: 'string',
                                                limit: integer,
                                                offset: integer)

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

queries.web-location-group.get

Get all web location group IDs matching the query with filter

Method GET

Route /data-protection/queries/web-location-groups/v2

Scope Data Protection: READ

PEP 8 queries_web_location_group_get

Parameters

filter query · string

Optional filter for searching web location groups. Allowed filters are ‘name’ (string), ‘deleted’ (boolean), ‘type’ (string: ‘predefined’ or ‘custom’), ‘created’ and ‘last_updated’

type query · string

The type of entity to query. Allowed values are:

Available values (3)

predefined

and

custom

sort query · string

The sort instructions to order by on. Allowed values are ‘name’, ‘created’ and ‘last_updated’

limit query · integer

The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.

offset query · integer

The offset to start retrieving records from. Use with the limit parameter to manage pagination of results.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.queries_web_location_group_get(filter="string",
                                                 type="string",
                                                 sort="string",
                                                 limit=integer,
                                                 offset=integer)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.queries_web_location_group_get(filter="string",
                                                 type="string",
                                                 sort="string",
                                                 limit=integer,
                                                 offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_web_location_group_get",
                          filter="string",
                          type="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Examples coming soon.

Go

Examples coming soon.

TypeScript

Examples coming soon.

Rust

Examples coming soon.

Ruby

Examples coming soon.

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

queries.web-location.get-v2

Get web-location IDs matching the query with filter

Method GET

Route /data-protection/queries/web-locations/v2

Scope Data Protection: READ

PEP 8 query_web_locations

Parameters

filter query · string

The filter to use when finding web locations.

type query · string

The type of entity to query. Allowed values are:

Available values (3)

predefined

and

custom

limit query · integer

The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.

offset query · integer

The offset to start retrieving records from. Use with the limit parameter to manage pagination of results.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.query_web_locations(filter="string",
                                      type="string",
                                      limit=integer,
                                      offset=integer)
print(response)

Operation ID

from falconpy import DataProtectionConfiguration

falcon = DataProtectionConfiguration(client_id=CLIENT_ID,
                                     client_secret=CLIENT_SECRET
                                     )

response = falcon.queries_web_location_get_v2(filter="string",
                                              type="string",
                                              limit=integer,
                                              offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_web_location_get_v2",
                          filter="string",
                          type="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/data_protection_configuration"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  typeVar := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.DataProtectionConfiguration.QueriesWebLocationGetV2(
    &data_protection_configuration.QueriesWebLocationGetV2Params{
      Filter: &filter,
      Type: &typeVar,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.dataProtectionConfiguration.queriesWebLocationGetV2(
  "string",  // filter
  "string",  // type
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DataProtectionConfiguration.new

response = api.queries_web_location_get_v2(filter: 'string',
                                           type: 'string',
                                           limit: integer,
                                           offset: integer)

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}