Device Content

The Device Content service collection provides operations for retrieving and querying host content state information. Fetch the content state for specific device IDs, or query hosts by FQL filter to find devices matching particular content state criteria.

Language	Last Update
Python	v1.4.8
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

Table of Contents

Operation	Description
entities_states_v1 get_states	Retrieve the host content state for a number of ids between 1 and 100.
queries_states_v1 query_states	Query for the content state of the host.

---

entities_states_v1

Retrieve the host content state for a number of IDs between 1 and 100.

GET /device-content/entities/states/v1

Scope Device Content: READ Consumes · Produces application/json

PEP 8 get_states

Parameters

Name	Type	Data type	Description
ids	query	array (string)	The IDs of the devices to fetch the content state of.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.

Code Examples

Python

PEP 8

from falconpy import DeviceContent

falcon = DeviceContent(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_states(ids=id_list)
print(response)

Operation ID

from falconpy import DeviceContent

falcon = DeviceContent(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_states_v1(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_states_v1",
                          ids=id_list)
print(response)

PowerShell

Get-FalconContentState -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/device_content"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DeviceContent.EntitiesStatesV1(
    &device_content.EntitiesStatesV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.deviceContent.entitiesStatesV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

Examples coming soon.

---

queries_states_v1

Query for the content state of the host.

GET /device-content/queries/states/v1

Scope Device Content: READ Consumes · Produces application/json

PEP 8 query_states

Parameters

Name	Type	Data type	Description
filter	query	string	The FQL search filter.
limit	query	integer	The max number of resource ids to return.
sort	query	string	What field to sort the results on.
offset	query	integer	The offset token returned from the previous query. If none was returned, there are no more pages to the result set.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.

Code Examples

Python

PEP 8

from falconpy import DeviceContent

falcon = DeviceContent(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.query_states(limit=integer,
                               sort="string",
                               offset=integer,
                               filter="string")
print(response)

Operation ID

from falconpy import DeviceContent

falcon = DeviceContent(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.queries_states_v1(limit=integer,
                                    sort="string",
                                    offset=integer,
                                    filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_states_v1",
                          limit=integer,
                          sort="string",
                          offset=integer,
                          filter="string")
print(response)

PowerShell

Get-FalconContentState -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/device_content"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  sort := "string"
  offset := int64(0)
  filter := "string"

  response, err := client.DeviceContent.QueriesStatesV1(
    &device_content.QueriesStatesV1Params{
      Limit: &limit,
      Sort: &sort,
      Offset: &offset,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.deviceContent.queriesStatesV1(
  integer,  // limit
  "string",  // sort
  integer,  // offset
  "string"  // filter
);

console.log(response);

Rust

Examples coming soon.

Ruby

Examples coming soon.