Device Content

The Device Content service collection provides operations for retrieving and querying host content state information. Fetch the content state for specific device IDs, or query hosts by FQL filter to find devices matching particular content state criteria.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

Operation	Description
entities.states.v1 `get_states`	Retrieve the host content state for a number of ids between 1 and 100.
queries.states.v1 `query_states`	Query for the content state of the host.

entities.states.v1

Retrieve the host content state for a number of ids between 1 and 100.

Method GET

Route /device-content/entities/states/v1

Scope Device Content: READ

PEP 8 get_states

Parameters

ids query · string or list of strings

The ids of the devices to fetch the content state of.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import DeviceContent

falcon = DeviceContent(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_states(ids=id_list)
print(response)

from falconpy import DeviceContent

falcon = DeviceContent(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_states_v1(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_states_v1",
                          ids=id_list)
print(response)

Get-FalconContentState -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/device_content"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DeviceContent.EntitiesStatesV1(
    &device_content.EntitiesStatesV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.deviceContent.entitiesStatesV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::device_content_api::entities_states_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = entities_states_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DeviceContent.new

response = api.entities_states_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "cid": "string",
    "content_update_policy_applied_date": "string",
    "content_update_policy_id": "string",
    "device_id": "string",
    "groups": [],
    "hidden_status": "string",
    "hostname": "string",
    "last_seen": "string",
    "platform_name": "string",
    "rapid_response_content": {},
    "reduced_functionality_mode": "string",
    "sensor_operations": {},
    "system_critical": {},
    "vulnerability_management": {}
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

queries.states.v1

Query for the content state of the host.

Method GET

Route /device-content/queries/states/v1

Scope Device Content: READ

PEP 8 query_states

Parameters

limit query · integer

The max number of resource ids to return.

sort query · string

What field to sort the results on.

offset query · integer

The offset token returned from the previous query. If none was returned, there are no more pages to the result set.

filter query · string

The FQL search filter.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import DeviceContent

falcon = DeviceContent(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.query_states(limit=integer,
                               sort="string",
                               offset=integer,
                               filter="string")
print(response)

from falconpy import DeviceContent

falcon = DeviceContent(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.queries_states_v1(limit=integer,
                                    sort="string",
                                    offset=integer,
                                    filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_states_v1",
                          limit=integer,
                          sort="string",
                          offset=integer,
                          filter="string")
print(response)

Get-FalconContentState -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/device_content"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  sort := "string"
  offset := int64(0)
  filter := "string"

  response, err := client.DeviceContent.QueriesStatesV1(
    &device_content.QueriesStatesV1Params{
      Limit: &limit,
      Sort: &sort,
      Offset: &offset,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.deviceContent.queriesStatesV1(
  integer,  // limit
  "string",  // sort
  integer,  // offset
  "string"  // filter
);

console.log(response);

use rusty_falcon::apis::device_content_api::queries_states_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = queries_states_v1(
        &falcon.cfg,  // configuration
        Some(integer),  // limit
        Some("string"),  // sort
        Some(integer),  // offset
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DeviceContent.new

response = api.queries_states_v1(limit: integer,
                                 sort: 'string',
                                 offset: integer,
                                 filter: 'string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

Device Content

Table of Contents

entities.states.v1

Parameters

queries.states.v1

Parameters