Skip to content
CrowdStrike Developer Center

Detects

The Detects service collection provides operations for aggregating, updating, and querying detection data. Get detection aggregates, modify detection states and assignees, view detection summaries, and search for detection IDs using FQL filters.

LanguageLast Update
Pythonv1.6.5
PowerShell
Gov0.22.0
TypeScriptv0.6.0
Rustv0.7.1
Rubyv1.4.0

This service collection has code examples posted to the repository.

DEPRECATED: This entire service collection is deprecated. Developers should leverage operations from the Alerts service collection instead. These endpoints will be decommissioned on September 30, 2025.

Table of Contents

Section titled “Table of Contents”
OperationDescription
GetAggregateDetects
get_aggregate_detects		Deprecated: This endpoint will be decommissioned on September 30, 2025.
deprecated
GetDetectSummaries
get_detect_summaries		Deprecated: This endpoint will be decommissioned on September 30, 2025.
deprecated
QueryDetects
query_detects		Deprecated: This endpoint will be decommissioned on September 30, 2025.
deprecated
UpdateDetectsByIdsV2
update_detects_by_ids		Deprecated: This endpoint will be decommissioned on September 30, 2025.
deprecated

GetAggregateDetects

Section titled “GetAggregateDetects”

Deprecated: This endpoint will be decommissioned on September 30, 2025.

Method POST
Route /detects/aggregates/detects/GET/v1
Scope Detections: READ
PEP 8 get_aggregate_detects

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
If peforming a date range query specify the from and to date ranges. These can be in common date formats like 2019-07-18 or now.
exclude body · string
Fields to exclude.
extended_bounds body · object
field body · string
Term you want to aggregate on. If doing a date_range query, this is the date field you want to apply the date ranges to.
filter body · string
Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
filters_spec body · object
from body · integer
include body · string
Fields to include.
interval body · string
Available values (6)
yearmonthweek
dayhourminute
max_doc_count body · integer
Maximum number of documents.
min_doc_count body · integer
Minimum number of documents.
missing body · string
name body · string
Scan name.
percents body · array
q body · string
FQL syntax.
ranges body · array
size body · integer
sort body · string
FQL syntax.
Available values (2)
_count
sort by document count
_term
sort by the string value alphabetically
sub_aggregates body · array
time_zone body · string
type body · string
Available values (10)
date_histogram
Aggregates counts on a specified time interval. Requires use of “interval” field.
date_range
Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
terms
Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
range
Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.
cardinality
Returns the count of distinct values in a specified field.
max
Returns the maximum value of a specified field.
min
Returns the minimum value of a specified field.
avg
Returns the average value of the specified field.
sum
Returns the total sum of all values for the specified field.
percentiles
Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.
Code Examples
from falconpy import Detects


falcon = Detects(client_id=CLIENT_ID,
                 client_secret=CLIENT_SECRET
                 )


date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]


ranges = [
    {
        "From": 0,
        "To": 0
    }
]


response = falcon.get_aggregate_detects(date_ranges=date_ranges,
                                        exclude="string",
                                        field="string",
                                        filter="string",
                                        from=integer,
                                        include="string",
                                        interval="string",
                                        max_doc_count=integer,
                                        min_doc_count=integer,
                                        missing="string",
                                        name="string",
                                        q="string",
                                        ranges=ranges,
                                        size=integer,
                                        sort="string",
                                        sub_aggregates=["string"],
                                        time_zone="string",
                                        type="string")
print(response)
Responses
[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

GetDetectSummaries

Section titled “GetDetectSummaries”

Deprecated: This endpoint will be decommissioned on September 30, 2025.

Method POST
Route /detects/entities/summaries/GET/v1
Scope Detections: READ
PEP 8 get_detect_summaries

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
ids body · array
ID(s) of the detections to retrieve.
Code Examples
from falconpy import Detects


falcon = Detects(client_id=CLIENT_ID,
                 client_secret=CLIENT_SECRET
                 )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_detect_summaries(ids=id_list)
print(response)
Responses
[
  {
    "adversary_ids": [],
    "assigned_to_name": "string",
    "assigned_to_uid": "string",
    "behaviors": [],
    "behaviors_processed": [],
    "cid": "string",
    "created_timestamp": "string",
    "date_updated": "string",
    "detection_id": "string",
    "device": {},
    "email_sent": false,
    "first_behavior": "string",
    "hostinfo": {},
    "last_behavior": "string",
    "max_confidence": 0,
    "max_severity": 0,
    "max_severity_displayname": "string",
    "overwatch_notes": "string",
    "quarantined_files": [],
    "seconds_to_resolved": 0,
    "seconds_to_triaged": 0,
    "show_in_ui": false,
    "status": "string"
  }
]

QueryDetects

Section titled “QueryDetects”

Deprecated: This endpoint will be decommissioned on September 30, 2025.

Method GET
Route /detects/queries/detects/v1
Scope Detections: READ
PEP 8 query_detects

Parameters

Section titled “Parameters”
offset query · integer
The first detection to return, where 0 is the latest detection. Use with the limit parameter to manage pagination of results.
limit query · integer
The maximum number of detections to return in this response (default: 9999; max: 9999). Use with the offset parameter to manage pagination of results.
sort query · string
Sort detections using these options:
Available values (6)
first_behavior
Timestamp of the first behavior associated with this detection
last_behavior
Timestamp of the last behavior associated with this detection
max_severity
Highest severity of the behaviors associated with this detection
max_confidence
Highest confidence of the behaviors associated with this detection
adversary_id
ID of the adversary associated with this detection, if any
devices.hostname
Hostname of the host where this detection was detected
filter query · string
Filter detections using a query in Falcon Query Language (FQL) An asterisk wildcard * includes all results. Complete list of available FQL filters. More details regarding filters can be found in the documentation inside the Falcon console.
q query · string
Search all detection metadata for the provided string
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Detects


falcon = Detects(client_id=CLIENT_ID,
                 client_secret=CLIENT_SECRET
                 )


response = falcon.query_detects(filter="string",
                                limit=integer,
                                offset=integer,
                                q="string",
                                sort="string")
print(response)
Responses
[
  "string"
]

UpdateDetectsByIdsV2

Section titled “UpdateDetectsByIdsV2”

Deprecated: This endpoint will be decommissioned on September 30, 2025.

Method PATCH
Route /detects/entities/detects/v2
Scope Detections: WRITE
PEP 8 update_detects_by_ids

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
assigned_to_uuid body · string
A user ID to assign the detection to.
comment body · string
Optional comment to add to the detection. Comments are displayed with the detection in Falcon and are usually used to provide context or notes for other Falcon users. A detection can have multiple comments over time.
ids body · array
ID(s) of the detection to update.
new_behaviors_processed body · array
show_in_ui body · boolean
Boolean determining if this detection is displayed in the Falcon console.
Available values (2)
true
This detection is displayed in Falcon
false
This detection is not displayed in Falcon. Most commonly used together with the status key’s false_positive value.
status body · string
Current status of the detection. Allowed values:
Available values (5)
ignorednewin_progress
true_positivefalse_positive
Code Examples
from falconpy import Detects


falcon = Detects(client_id=CLIENT_ID,
                 client_secret=CLIENT_SECRET
                 )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.update_detects_by_ids(assigned_to_uuid="string",
                                        comment="string",
                                        ids=id_list,
                                        new_behaviors_processed=id_list,
                                        show_in_ui=boolean,
                                        status="string")
print(response)
Responses
{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}
© 2026 CrowdStrike, Inc. All rights reserved. Privacy Notice Cookie Notice Terms of Use