Device Control Policies

The Device Control Policies service collection provides operations for managing device control policies across your CrowdStrike Falcon environment. Search, create, update, and delete Device Control Policies. Set policy precedence, manage policy members, and configure default device control settings for USB and Bluetooth devices.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

Operation	Description
createDeviceControlPolicies `create_policies`	Create Device Control Policies by specifying details about the policy to create deprecated
deleteDeviceControlPolicies `delete_policies`	Delete a set of Device Control Policies by specifying their IDs
getDefaultDeviceControlPolicies `get_default_policies`	Retrieve the configuration for a Default Device Control Policy deprecated
getDefaultDeviceControlSettings `get_default_settings`	Get default device control settings (USB and Bluetooth)
getDeviceControlPolicies `get_policies`	Retrieve a set of Device Control Policies by specifying their IDs deprecated
getDeviceControlPoliciesV2 `get_policies_v2`	Get device control policies for the given filter criteria.
patchDeviceControlPoliciesClassesV1 `update_policy_classes`	Update device control policy’s classes (USB and Bluetooth)
patchDeviceControlPoliciesV2 `update_policies_v2`	Update device control policy base (USB and Bluetooth)
performDeviceControlPoliciesAction `perform_action`	Perform the specified action on the Device Control Policies specified in the request
postDeviceControlPoliciesV2 `create_policies_v2`	Create/clone a device control policy (USB and Bluetooth)
queryCombinedDeviceControlPolicies `query_combined_policies`	Search for Device Control Policies in your environment by providing an FQL filter and paging details.
queryCombinedDeviceControlPolicyMembers `query_combined_policy_members`	Search for members of a Device Control Policy in your environment by providing an FQL filter and paging details.
queryDeviceControlPolicies `query_policies`	Search for Device Control Policies in your environment by providing an FQL filter and paging details.
queryDeviceControlPolicyMembers `query_policy_members`	Search for members of a Device Control Policy in your environment by providing an FQL filter and paging details.
setDeviceControlPoliciesPrecedence `set_precedence`	Sets the precedence of Device Control Policies based on the order of IDs specified in the request.
updateDefaultDeviceControlPolicies `update_default_policies`	Update the configuration for a Default Device Control Policy deprecated
updateDefaultDeviceControlSettings `update_default_settings`	Update the configuration for Default Device Control Settings
updateDeviceControlPolicies `update_policies`	Update Device Control Policies by specifying the ID of the policy and details to update deprecated

createDeviceControlPolicies

Create Device Control Policies by specifying details about the policy to create

Method POST

Route /policy/entities/device-control/v1

Scope Device control policies: WRITE

PEP 8 create_policies

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

List of policies to create. Maximum batch size: 1000.

clone_id body · string

ID of the Device Control Policy to clone.

description body · string

Device Control Policy description.

name body · string

Device Control Policy name.

platform_name body · string

Name of the operating system platform.

settings body · dictionary

Device Control policy specific settings. See above for JSON dictionary format example.

Code Examples

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

settings = {
    "classes": [
        {
            "action": "FULL_ACCESS",
            "exceptions": [
                {
                    "action": "string",
                    "combined_id": "string",
                    "description": "string",
                    "expiration_time": "2023-06-08T06:04:53.563Z",
                    "id": "string",
                    "product_id": "string",
                    "product_id_decimal": "string",
                    "product_name": "string",
                    "serial_number": "string",
                    "use_wildcard": True,
                    "vendor_id": "string",
                    "vendor_id_decimal": "string",
                    "vendor_name": "string"
                }
            ],
            "id": "string"
        }
    ],
    "custom_notifications": {
        "blocked_notification": {
            "custom_message": "string",
            "use_custom": True
        },
        "restricted_notification": {
            "custom_message": "string",
            "use_custom": True
        }
    },
    "delete_exceptions": [
        "string"
    ],
    "end_user_notification": "SILENT",
    "enforcement_mode": "MONITOR_ONLY",
    "enhanced_file_metadata": True
}

response = falcon.create_policies(clone_id="string",
                                  description="string",
                                  name="string",
                                  platform_name="string",
                                  settings=settings)
print(response)

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

settings = {
    "classes": [
        {
            "action": "FULL_ACCESS",
            "exceptions": [
                {
                    "action": "string",
                    "combined_id": "string",
                    "description": "string",
                    "expiration_time": "2023-06-08T06:04:53.563Z",
                    "id": "string",
                    "product_id": "string",
                    "product_id_decimal": "string",
                    "product_name": "string",
                    "serial_number": "string",
                    "use_wildcard": True,
                    "vendor_id": "string",
                    "vendor_id_decimal": "string",
                    "vendor_name": "string"
                }
            ],
            "id": "string"
        }
    ],
    "custom_notifications": {
        "blocked_notification": {
            "custom_message": "string",
            "use_custom": True
        },
        "restricted_notification": {
            "custom_message": "string",
            "use_custom": True
        }
    },
    "delete_exceptions": [
        "string"
    ],
    "end_user_notification": "SILENT",
    "enforcement_mode": "MONITOR_ONLY",
    "enhanced_file_metadata": True
}

response = falcon.createDeviceControlPolicies(clone_id="string",
                                              description="string",
                                              name="string",
                                              platform_name="string",
                                              settings=settings)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "clone_id": "string",
            "description": "string",
            "name": "string",
            "platform_name": "string",
            "settings": {
                "classes": ["string"],
                "custom_notifications": {},
                "delete_exceptions": ["string"],
                "end_user_notification": "string",
                "enforcement_mode": "string",
                "enhanced_file_metadata": boolean
            }
        }
    ]
}

response = falcon.command("createDeviceControlPolicies", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/device_control_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  clone_id := "string"
  description := "string"
  name := "string"
  platform_name := "string"

  response, err := client.DeviceControlPolicies.CreateDeviceControlPolicies(
    &device_control_policies.CreateDeviceControlPoliciesParams{
      Body: &models.DeviceControlCreatePoliciesV1{
        Resources: []interface{}{
          {
          CloneID: &clone_id,
          Description: &description,
          Name: &name,
          PlatformName: &platform_name,
          Settings: &struct{}{},
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.deviceControlPolicies.createDeviceControlPolicies(
  {
    resources: [{
        cloneId: "string",
        description: "string",
        name: "string",
        platformName: "string",
        settings: {
          classes: [],
          customNotifications: {},
          deleteExceptions: [],
          endUserNotification: "string",
          enforcementMode: "string",
          enhancedFileMetadata: boolean
        }
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::device_control_policies_api::create_device_control_policies;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DeviceControlCreatePoliciesV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DeviceControlCreatePoliciesV1 {
        resources: vec![CreatePolicyReqV1 {
            name: Some("string".to_string()),
            platform_name: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = create_device_control_policies(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DeviceControlPolicies.new

body = Falcon::DeviceControlCreatePoliciesV1.new(
  resources: [{
      clone_id: 'string',
      description: 'string',
      name: 'string',
      platform_name: 'string',
      settings: {
        classes: [],
        custom_notifications: {},
        delete_exceptions: [],
        end_user_notification: 'string',
        enforcement_mode: 'string',
        enhanced_file_metadata: boolean
      }
    }]
)

response = api.create_device_control_policies(body)

puts response

Responses

[
  {
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform_name": "string",
    "settings": {}
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

deleteDeviceControlPolicies

Delete a set of Device Control Policies by specifying their IDs

Method DELETE

Route /policy/entities/device-control/v1

Scope Device control policies: WRITE

PEP 8 delete_policies

Parameters

ids query · string or list of strings

The IDs of the Device Control Policies to delete

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_policies(ids=id_list)
print(response)

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteDeviceControlPolicies(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deleteDeviceControlPolicies",
                          ids=id_list)
print(response)

Remove-FalconDeviceControlPolicy -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/device_control_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DeviceControlPolicies.DeleteDeviceControlPolicies(
    &device_control_policies.DeleteDeviceControlPoliciesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.deviceControlPolicies.deleteDeviceControlPolicies(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::device_control_policies_api::delete_device_control_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_device_control_policies(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DeviceControlPolicies.new

response = api.delete_device_control_policies(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

getDefaultDeviceControlPolicies

Retrieve the configuration for a Default Device Control Policy

Method GET

Route /policy/entities/default-device-control/v1

Scope Device control policies: READ

PEP 8 get_default_policies

Code Examples

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.get_default_policies()
print(response)

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.getDefaultDeviceControlPolicies()
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("getDefaultDeviceControlPolicies")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/device_control_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DeviceControlPolicies.GetDefaultDeviceControlPolicies(
    &device_control_policies.GetDefaultDeviceControlPoliciesParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.deviceControlPolicies.getDefaultDeviceControlPolicies();

console.log(response);

use rusty_falcon::apis::device_control_policies_api::get_default_device_control_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_default_device_control_policies(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DeviceControlPolicies.new

response = api.get_default_device_control_policies

puts response

Responses

[
  {
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform_name": "string",
    "settings": {}
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

getDefaultDeviceControlSettings

Get default device control settings (USB and Bluetooth)

Method GET

Route /policy/entities/device-control-default-settings/v1

Scope Device control policies: READ

PEP 8 get_default_settings

Code Examples

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.get_default_settings()
print(response)

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.getDefaultDeviceControlSettings()
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("getDefaultDeviceControlSettings")
print(response)

Get-FalconDeviceControlNotification

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/device_control_with_bluetooth"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DeviceControlWithBluetooth.GetDefaultDeviceControlSettings(
    &device_control_with_bluetooth.GetDefaultDeviceControlSettingsParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.deviceControlWithBluetooth.getDefaultDeviceControlSettings();

console.log(response);

use rusty_falcon::apis::device_control_with_bluetooth_api::get_default_device_control_settings;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_default_device_control_settings(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DeviceControlWithBluetooth.new

response = api.get_default_device_control_settings

puts response

Responses

[
  {
    "bluetooth_custom_notifications": {},
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "usb_custom_notifications": {}
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

getDeviceControlPolicies

Retrieve a set of Device Control Policies by specifying their IDs

Method GET

Route /policy/entities/device-control/v1

Scope Device control policies: READ

PEP 8 get_policies

Parameters

ids query · string or list of strings

The IDs of the Device Control Policies to return

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_policies(ids=id_list)
print(response)

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getDeviceControlPolicies(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getDeviceControlPolicies",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/device_control_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DeviceControlPolicies.GetDeviceControlPolicies(
    &device_control_policies.GetDeviceControlPoliciesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.deviceControlPolicies.getDeviceControlPolicies(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::device_control_policies_api::get_device_control_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_device_control_policies(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DeviceControlPolicies.new

response = api.get_device_control_policies(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform_name": "string",
    "settings": {}
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

getDeviceControlPoliciesV2

Get device control policies for the given filter criteria.

Method GET

Route /policy/entities/device-control/v2

Scope Device control policies: READ

PEP 8 get_policies_v2

Parameters

ids query · string or list of strings

The IDs of the policies to get

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_policies_v2(ids=id_list)
print(response)

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getDeviceControlPoliciesV2(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getDeviceControlPoliciesV2",
                          ids=id_list)
print(response)

Get-FalconDeviceControlPolicy -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/device_control_with_bluetooth"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DeviceControlWithBluetooth.GetDeviceControlPoliciesV2(
    &device_control_with_bluetooth.GetDeviceControlPoliciesV2Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.deviceControlWithBluetooth.getDeviceControlPoliciesV2(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::device_control_with_bluetooth_api::get_device_control_policies_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_device_control_policies_v2(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DeviceControlPolicies.new

response = api.get_device_control_policies(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "assignment_type": "string",
    "bluetooth_channel_version": 0,
    "bluetooth_settings": {},
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform_id": "string",
    "platform_name": "string",
    "precedence": 0,
    "propagated": false,
    "settings_hash": "string",
    "usb_channel_version": 0,
    "usb_settings": {}
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

patchDeviceControlPoliciesClassesV1

Update device control policy’s classes (USB and Bluetooth)

Method PATCH

Route /policy/entities/device-control-classes/v1

Scope Device control policies: WRITE

PEP 8 update_policy_classes

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

policies body · array

List of policy classes to update. Maximum batch size: 1000

bluetooth_classes body · dictionary

Bluetooth device control policy.

id body · string

Device control policy ID.

usb_classes body · dictionary

USB device control policy.

Code Examples

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

bluetooth_classes = {
    "classes": [
        {
            "action": "string",
            "class": "string",
            "minor_classes": [
                {
                    "action": "string",
                    "minor_class": "string"
                }
            ]
        }
    ],
    "delete_exceptions": [
        "string"
    ],
    "upsert_exceptions": [
        {
            "action": "string",
            "class": "string",
            "description": "string",
            "expiration_time": "UTC date string",
            "id": "string",
            "minor_classes": [
                "string"
            ],
            "product_id": "string",
            "product_name": "string",
            "vendor_id": "string",
            "vendor_id_source": "string",
            "vendor_name": "string"
        }
    ]
}

usb_classes = {
    "classes": [
        {
            "action": "string",
            "class": "string"
        }
    ],
    "delete_exceptions": [
        "string"
    ],
    "upsert_exceptions": [
        {
            "action": "string",
            "class": "string",
            "combined_id": "string",
            "description": "string",
            "expiration_time": "UTC date string",
            "id": "string",
            "product_id": "string",
            "product_name": "string",
            "serial_number": "string",
            "use_wildcard": "boolean",
            "vendor_id": "string",
            "vendor_name": "string"
        }
    ]
}

response = falcon.update_policy_classes(bluetooth_classes=bluetooth_classes,
                                        id="string",
                                        usb_classes=usb_classes)
print(response)

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

bluetooth_classes = {
    "classes": [
        {
            "action": "string",
            "class": "string",
            "minor_classes": [
                {
                    "action": "string",
                    "minor_class": "string"
                }
            ]
        }
    ],
    "delete_exceptions": [
        "string"
    ],
    "upsert_exceptions": [
        {
            "action": "string",
            "class": "string",
            "description": "string",
            "expiration_time": "UTC date string",
            "id": "string",
            "minor_classes": [
                "string"
            ],
            "product_id": "string",
            "product_name": "string",
            "vendor_id": "string",
            "vendor_id_source": "string",
            "vendor_name": "string"
        }
    ]
}

usb_classes = {
    "classes": [
        {
            "action": "string",
            "class": "string"
        }
    ],
    "delete_exceptions": [
        "string"
    ],
    "upsert_exceptions": [
        {
            "action": "string",
            "class": "string",
            "combined_id": "string",
            "description": "string",
            "expiration_time": "UTC date string",
            "id": "string",
            "product_id": "string",
            "product_name": "string",
            "serial_number": "string",
            "use_wildcard": "boolean",
            "vendor_id": "string",
            "vendor_name": "string"
        }
    ]
}

response = falcon.patchDeviceControlPoliciesClassesV1(bluetooth_classes=bluetooth_classes,
                                                      id="string",
                                                      usb_classes=usb_classes)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "policies": [
        {
            "bluetooth_classes": {
                "classes": ["string"],
                "delete_exceptions": ["string"],
                "upsert_exceptions": ["string"]
            },
            "id": "string",
            "usb_classes": {
                "classes": ["string"],
                "delete_exceptions": ["string"],
                "upsert_exceptions": ["string"]
            }
        }
    ]
}

response = falcon.command("patchDeviceControlPoliciesClassesV1", body=body_payload)
print(response)

Edit-FalconDeviceControlClass -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/device_control_with_bluetooth"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  id := "string"

  response, err := client.DeviceControlWithBluetooth.PatchDeviceControlPoliciesClassesV1(
    &device_control_with_bluetooth.PatchDeviceControlPoliciesClassesV1Params{
      Body: &models.DevicecontrolapiReqUpdatePoliciesClassesV1{
        Policies: []interface{}{
          {
          BluetoothClasses: &struct{}{},
          ID: &id,
          UsbClasses: &struct{}{},
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.deviceControlWithBluetooth.patchDeviceControlPoliciesClassesV1(
  {
    policies: [{
        bluetoothClasses: {
          classes: [],
          deleteExceptions: [],
          upsertExceptions: []
        },
        id: "string",
        usbClasses: {
          classes: [],
          deleteExceptions: [],
          upsertExceptions: []
        }
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::device_control_with_bluetooth_api::patch_device_control_policies_classes_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DevicecontrolapiReqUpdatePoliciesClassesV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DevicecontrolapiReqUpdatePoliciesClassesV1 {
        policies: vec![ReqUpdatePolicyClassesV1 {
            id: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = patch_device_control_policies_classes_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DeviceControlWithBluetooth.new

body = Falcon::DevicecontrolapiReqUpdatePoliciesClassesV1.new(
  policies: [{
      bluetooth_classes: {
        classes: [],
        delete_exceptions: [],
        upsert_exceptions: []
      },
      id: 'string',
      usb_classes: {
        classes: [],
        delete_exceptions: [],
        upsert_exceptions: []
      }
    }]
)

response = api.patch_device_control_policies_classes_v1(body)

puts response

Responses

[
  {
    "assignment_type": "string",
    "bluetooth_channel_version": 0,
    "bluetooth_settings": {},
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform_id": "string",
    "platform_name": "string",
    "precedence": 0,
    "propagated": false,
    "settings_hash": "string",
    "usb_channel_version": 0,
    "usb_settings": {}
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

patchDeviceControlPoliciesV2

Update device control policy base (USB and Bluetooth)

Method PATCH

Route /policy/entities/device-control/v2

Scope Device control policies: WRITE

PEP 8 update_policies_v2

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

policies body · array

List of policies to update. Maximum batch size: 1000

bluetooth_settings body · string

Device Control policy USB specific settings. See above for JSON dictionary format example.

description body · string

Device Control Policy description.

id body · string

ID of the Device Control Policy to update.

name body · string

Device Control Policy name.

platform_name body · string

Name of the operating system platform.

usb_settings body · string

Device Control policy USB specific settings. See above for JSON dictionary format example.

Code Examples

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.update_policies_v2(bluetooth_settings="string",
                                     description="string",
                                     id="string",
                                     name="string",
                                     platform_name="string",
                                     usb_settings="string")
print(response)

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.patchDeviceControlPoliciesV2(bluetooth_settings="string",
                                               description="string",
                                               id="string",
                                               name="string",
                                               platform_name="string",
                                               usb_settings="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "policies": [
        {
            "bluetooth_settings": {
                "custom_end_user_notifications": {},
                "end_user_notification": "string",
                "enforcement_mode": "string"
            },
            "description": "string",
            "id": "string",
            "name": "string",
            "propagated": boolean,
            "usb_settings": {
                "custom_notifications": {},
                "end_user_notification": "string",
                "enforcement_mode": "string",
                "enhanced_file_metadata": boolean,
                "pcie_enforcement_mode": "string",
                "storage_space_enforcement_mode": "string",
                "user_based_enforcement_mode": "string"
            }
        }
    ]
}

response = falcon.command("patchDeviceControlPoliciesV2", body=body_payload)
print(response)

Edit-FalconDeviceControlPolicy -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/device_control_with_bluetooth"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  id := "string"
  name := "string"
  propagated := boolean

  response, err := client.DeviceControlWithBluetooth.PatchDeviceControlPoliciesV2(
    &device_control_with_bluetooth.PatchDeviceControlPoliciesV2Params{
      Body: &models.DevicecontrolapiReqUpdateBasesV1External{
        Policies: []interface{}{
          {
          BluetoothSettings: &struct{}{},
          Description: &description,
          ID: &id,
          Name: &name,
          Propagated: &propagated,
          UsbSettings: &struct{}{},
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.deviceControlWithBluetooth.patchDeviceControlPoliciesV2(
  {
    policies: [{
        bluetoothSettings: {
          customEndUserNotifications: {},
          endUserNotification: "string",
          enforcementMode: "string"
        },
        description: "string",
        id: "string",
        name: "string",
        propagated: boolean,
        usbSettings: {
          customNotifications: {},
          endUserNotification: "string",
          enforcementMode: "string",
          enhancedFileMetadata: boolean,
          pcieEnforcementMode: "string",
          storageSpaceEnforcementMode: "string",
          userBasedEnforcementMode: "string"
        }
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::device_control_with_bluetooth_api::patch_device_control_policies_v2;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DevicecontrolapiReqUpdateBasesV1External;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DevicecontrolapiReqUpdateBasesV1External {
        policies: vec![ReqUpdateBaseV1External {
            id: Some("string".to_string()),
            propagated: Some(boolean),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = patch_device_control_policies_v2(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DeviceControlWithBluetooth.new

body = Falcon::DevicecontrolapiReqUpdateBasesV1External.new(
  policies: [{
      bluetooth_settings: {
        custom_end_user_notifications: {},
        end_user_notification: 'string',
        enforcement_mode: 'string'
      },
      description: 'string',
      id: 'string',
      name: 'string',
      propagated: boolean,
      usb_settings: {
        custom_notifications: {},
        end_user_notification: 'string',
        enforcement_mode: 'string',
        enhanced_file_metadata: boolean,
        pcie_enforcement_mode: 'string',
        storage_space_enforcement_mode: 'string',
        user_based_enforcement_mode: 'string'
      }
    }]
)

response = api.patch_device_control_policies_v2(body)

puts response

Responses

[
  {
    "assignment_type": "string",
    "bluetooth_channel_version": 0,
    "bluetooth_settings": {},
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform_id": "string",
    "platform_name": "string",
    "precedence": 0,
    "propagated": false,
    "settings_hash": "string",
    "usb_channel_version": 0,
    "usb_settings": {}
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

performDeviceControlPoliciesAction

Perform the specified action on the Device Control Policies specified in the request

Method POST

Route /policy/entities/device-control-actions/v1

Scope Device control policies: WRITE

PEP 8 perform_action

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

action_parameters body · array

Action specific parameter options.

ids body · array

Device Control policy ID(s) to perform actions against.

action_name query · string

The action to perform

Available values (6)

`add-host-group`	`add-rule-group`	`disable`
`enable`	`remove-host-group`	`remove-rule-group`

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

group_id body · string

Host Group ID to apply the policy to. Overridden if action_parameters is specified.

Code Examples

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.perform_action(action_name="string",
                                 action_parameters=[{"key": "value"}],
                                 group_id="string",
                                 ids=id_list)
print(response)

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.performDeviceControlPoliciesAction(action_name="string",
                                                     action_parameters=[{"key": "value"}],
                                                     group_id="string",
                                                     ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "action_parameters": [
        {
            "name": "string",
            "value": "string"
        }
    ],
    "ids": ["string"]
}

response = falcon.command("performDeviceControlPoliciesAction",
                          action_name="string",
                          body=body_payload)
print(response)

Invoke-FalconDeviceControlPolicyAction -Name "string" -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/device_control_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"
  value := "string"

  response, err := client.DeviceControlPolicies.PerformDeviceControlPoliciesAction(
    &device_control_policies.PerformDeviceControlPoliciesActionParams{
      Body: &models.MsaEntityActionRequestV2{
        ActionParameters: []interface{}{
          {
          Name: &name,
          Value: &value,
          },
        },
        Ids: []string{"string"},
      },
      ActionName: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.deviceControlPolicies.performDeviceControlPoliciesAction(
  "string",  // actionName
  {  // body
      actionParameters: [{
          name: "string",
          value: "string"
        }],
      ids: []
  }
);

console.log(response);

use rusty_falcon::apis::device_control_policies_api::perform_device_control_policies_action;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaEntityActionRequestV2;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaEntityActionRequestV2 {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = perform_device_control_policies_action(
        &falcon.cfg,  // configuration
        "string",  // action_name
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DeviceControlPolicies.new

body = Falcon::MsaEntityActionRequestV2.new(
  action_parameters: [{
      name: 'string',
      value: 'string'
    }],
  ids: []
)

response = api.perform_device_control_policies_action(body, 'string')

puts response

Responses

[
  {
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform_name": "string",
    "settings": {}
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

postDeviceControlPoliciesV2

Create/clone a device control policy (USB and Bluetooth)

Method POST

Route /policy/entities/device-control/v2

Scope Device control policies: WRITE

PEP 8 create_policies_v2

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

policies body · array

List of policies to create. Maximum batch size: 1000

bluetooth_settings body · string

Device Control policy USB specific settings. See above for JSON dictionary format example.

clone_id body · string

ID of the Device Control Policy to clone.

description body · string

Device Control Policy description.

name body · string

Device Control Policy name.

platform_name body · string

Name of the operating system platform.

usb_settings body · string

Device Control policy USB specific settings. See above for JSON dictionary format example.

Code Examples

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.create_policies_v2(bluetooth_settings="string",
                                     clone_id="string",
                                     description="string",
                                     name="string",
                                     platform_name="string",
                                     usb_settings="string")
print(response)

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.postDeviceControlPoliciesV2(bluetooth_settings="string",
                                              clone_id="string",
                                              description="string",
                                              name="string",
                                              platform_name="string",
                                              usb_settings="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "policies": [
        {
            "bluetooth_settings": {
                "custom_end_user_notifications": {},
                "end_user_notification": "string",
                "enforcement_mode": "string"
            },
            "clone_id": "string",
            "description": "string",
            "name": "string",
            "platform_name": "string",
            "usb_settings": {
                "custom_notifications": {},
                "end_user_notification": "string",
                "enforcement_mode": "string",
                "enhanced_file_metadata": boolean,
                "pcie_enforcement_mode": "string",
                "storage_space_enforcement_mode": "string",
                "user_based_enforcement_mode": "string",
                "whitelist_mode": "string"
            }
        }
    ]
}

response = falcon.command("postDeviceControlPoliciesV2", body=body_payload)
print(response)

New-FalconDeviceControlPolicy -Name "string" -PlatformName "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/device_control_with_bluetooth"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  clone_id := "string"
  description := "string"
  name := "string"
  platform_name := "string"

  response, err := client.DeviceControlWithBluetooth.PostDeviceControlPoliciesV2(
    &device_control_with_bluetooth.PostDeviceControlPoliciesV2Params{
      Body: &models.DevicecontrolapiReqCreatePoliciesV1{
        Policies: []interface{}{
          {
          BluetoothSettings: &struct{}{},
          CloneID: &clone_id,
          Description: &description,
          Name: &name,
          PlatformName: &platform_name,
          UsbSettings: &struct{}{},
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.deviceControlWithBluetooth.postDeviceControlPoliciesV2(
  {
    policies: [{
        bluetoothSettings: {
          customEndUserNotifications: {},
          endUserNotification: "string",
          enforcementMode: "string"
        },
        cloneId: "string",
        description: "string",
        name: "string",
        platformName: "string",
        usbSettings: {
          customNotifications: {},
          endUserNotification: "string",
          enforcementMode: "string",
          enhancedFileMetadata: boolean,
          pcieEnforcementMode: "string",
          storageSpaceEnforcementMode: "string",
          userBasedEnforcementMode: "string",
          whitelistMode: "string"
        }
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::device_control_with_bluetooth_api::post_device_control_policies_v2;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DevicecontrolapiReqCreatePoliciesV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DevicecontrolapiReqCreatePoliciesV1 {
        policies: vec![],
        ..Default::default()
    };

    let response = post_device_control_policies_v2(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DeviceControlWithBluetooth.new

body = Falcon::DevicecontrolapiReqCreatePoliciesV1.new(
  policies: [{
      bluetooth_settings: {
        custom_end_user_notifications: {},
        end_user_notification: 'string',
        enforcement_mode: 'string'
      },
      clone_id: 'string',
      description: 'string',
      name: 'string',
      platform_name: 'string',
      usb_settings: {
        custom_notifications: {},
        end_user_notification: 'string',
        enforcement_mode: 'string',
        enhanced_file_metadata: boolean,
        pcie_enforcement_mode: 'string',
        storage_space_enforcement_mode: 'string',
        user_based_enforcement_mode: 'string',
        whitelist_mode: 'string'
      }
    }]
)

response = api.post_device_control_policies_v2(body)

puts response

Responses

[
  {
    "assignment_type": "string",
    "bluetooth_channel_version": 0,
    "bluetooth_settings": {},
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform_id": "string",
    "platform_name": "string",
    "precedence": 0,
    "propagated": false,
    "settings_hash": "string",
    "usb_channel_version": 0,
    "usb_settings": {}
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

queryCombinedDeviceControlPolicies

Search for Device Control Policies in your environment by providing an FQL filter and paging details.

Method GET

Route /policy/combined/device-control/v1

Scope Device control policies: READ

PEP 8 query_combined_policies

Parameters

filter query · string

FQL Syntax formatted string used to limit the results.

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return. [1-5000]

sort query · string

The property to sort by. (Ex: modified_timestamp.desc)

Available values (16)

`created_by.asc`	`created_by.desc`	`created_timestamp.asc`
`created_timestamp.desc`	`enabled.asc`	`enabled.desc`
`modified_by.asc`	`modified_by.desc`	`modified_timestamp.asc`
`modified_timestamp.desc`	`name.asc`	`name.desc`
`platform_name.asc`	`platform_name.desc`	`precedence.asc`
`precedence.desc`

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.query_combined_policies(filter="string",
                                          limit=integer,
                                          offset=integer,
                                          sort="string")
print(response)

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.queryCombinedDeviceControlPolicies(filter="string",
                                                     limit=integer,
                                                     offset=integer,
                                                     sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryCombinedDeviceControlPolicies",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/device_control_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.DeviceControlPolicies.QueryCombinedDeviceControlPolicies(
    &device_control_policies.QueryCombinedDeviceControlPoliciesParams{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.deviceControlPolicies.queryCombinedDeviceControlPolicies(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::device_control_policies_api::query_combined_device_control_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_combined_device_control_policies(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DeviceControlPolicies.new

response = api.query_combined_device_control_policies(filter: 'string',
                                                      offset: integer,
                                                      limit: integer,
                                                      sort: 'string')

puts response

Responses

[
  {
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform_name": "string",
    "settings": {}
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

queryCombinedDeviceControlPolicyMembers

Search for members of a Device Control Policy in your environment by providing an FQL filter and paging details.

Method GET

Route /policy/combined/device-control-members/v1

Scope Device control policies: READ

PEP 8 query_combined_policy_members

Parameters

id query · string

The ID of the Device Control Policy to search for members of

filter query · string

FQL Syntax formatted string used to limit the results.

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return. [1-5000]

sort query · string

The property to sort by. (Ex: modified_timestamp.desc)

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.query_combined_policy_members(id="string",
                                                filter="string",
                                                limit=integer,
                                                offset=integer,
                                                sort="string")
print(response)

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.queryCombinedDeviceControlPolicyMembers(id="string",
                                                          filter="string",
                                                          limit=integer,
                                                          offset=integer,
                                                          sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryCombinedDeviceControlPolicyMembers",
                          id="string",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

Get-FalconDeviceControlPolicyMember -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/device_control_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  iD := "string"
  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.DeviceControlPolicies.QueryCombinedDeviceControlPolicyMembers(
    &device_control_policies.QueryCombinedDeviceControlPolicyMembersParams{
      ID: &iD,
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.deviceControlPolicies.queryCombinedDeviceControlPolicyMembers(
  "string",  // id
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::device_control_policies_api::query_combined_device_control_policy_members;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_combined_device_control_policy_members(
        &falcon.cfg,  // configuration
        Some("string"),  // id
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DeviceControlPolicies.new

response = api.query_combined_device_control_policy_members(id: 'string',
                                                            filter: 'string',
                                                            offset: integer,
                                                            limit: integer,
                                                            sort: 'string')

puts response

Responses

[
  {
    "agent_load_flags": "string",
    "agent_local_time": "string",
    "agent_version": "string",
    "base_image_version": "string",
    "bios_manufacturer": "string",
    "bios_version": "string",
    "build_number": "string",
    "chassis_type": "string",
    "chassis_type_desc": "string",
    "cid": "string",
    "cloud_service_compartment_id": "string",
    "config_id_base": "string",
    "config_id_build": "string",
    "config_id_platform": "string",
    "connection_ip": "string",
    "connection_mac_address": "string",
    "cpu_signature": "string",
    "cpu_vendor": "string",
    "criticality": "string",
    "default_gateway_ip": "string",
    "deployment_type": "string",
    "detection_suppression_status": "string",
    "device_id": "string",
    "device_policies": {},
    "email": "string",
    "external_ip": "string",
    "filesystem_containment_status": "string",
    "first_login_timestamp": "string",
    "first_login_user": "string",
    "first_seen": "string",
    "group_hash": "string",
    "groups": [],
    "host_deleted_status": "string",
    "host_hidden_status": "string",
    "host_utc_offset": "string",
    "hostname": "string",
    "instance_id": "string",
    "internet_exposure": "string",
    "k8s_cluster_git_version": "string",
    "k8s_cluster_id": "string",
    "k8s_cluster_version": "string",
    "kernel_version": "string",
    "last_login_timestamp": "string",
    "last_login_uid": "string",
    "last_login_user": "string",
    "last_login_user_sid": "string",
    "last_reboot": "string",
    "last_seen": "string",
    "license_activation_state": "string",
    "linux_sensor_mode": "string",
    "local_ip": "string",
    "mac_address": "string",
    "machine_domain": "string",
    "major_version": "string",
    "managed_apps": {},
    "meta": {},
    "migration_completed_time": "string",
    "minor_version": "string",
    "modified_timestamp": "string",
    "notes": [],
    "os_build": "string",
    "os_product_name": "string",
    "os_version": "string",
    "ou": [],
    "platform_id": "string",
    "platform_name": "string",
    "pod_annotations": [],
    "pod_host_ip4": "string",
    "pod_host_ip6": "string",
    "pod_hostname": "string",
    "pod_id": "string",
    "pod_ip4": "string",
    "pod_ip6": "string",
    "pod_labels": [],
    "pod_name": "string",
    "pod_namespace": "string",
    "pod_service_account_name": "string",
    "pointer_size": "string",
    "policies": [],
    "product_type": "string",
    "product_type_desc": "string",
    "provision_status": "string",
    "reduced_functionality_mode": "string",
    "release_group": "string",
    "rtr_state": "string",
    "safe_mode": "string",
    "serial_number": "string",
    "service_pack_major": "string",
    "service_pack_minor": "string",
    "service_provider": "string",
    "service_provider_account_id": "string",
    "site_name": "string",
    "slow_changing_modified_timestamp": "string",
    "status": "string",
    "system_manufacturer": "string",
    "system_product_name": "string",
    "tags": [],
    "zone_group": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "agent_load_flags": "string",
      "agent_local_time": "string",
      "agent_version": "string",
      "base_image_version": "string",
      "bios_manufacturer": "string",
      "bios_version": "string",
      "build_number": "string",
      "chassis_type": "string",
      "chassis_type_desc": "string",
      "cid": "string",
      "cloud_service_compartment_id": "string",
      "config_id_base": "string",
      "config_id_build": "string",
      "config_id_platform": "string",
      "connection_ip": "string",
      "connection_mac_address": "string",
      "cpu_signature": "string",
      "cpu_vendor": "string",
      "criticality": "string",
      "default_gateway_ip": "string",
      "deployment_type": "string",
      "detection_suppression_status": "string",
      "device_id": "string",
      "device_policies": {},
      "email": "string",
      "external_ip": "string",
      "filesystem_containment_status": "string",
      "first_login_timestamp": "string",
      "first_login_user": "string",
      "first_seen": "string",
      "group_hash": "string",
      "groups": [],
      "host_deleted_status": "string",
      "host_hidden_status": "string",
      "host_utc_offset": "string",
      "hostname": "string",
      "instance_id": "string",
      "internet_exposure": "string",
      "k8s_cluster_git_version": "string",
      "k8s_cluster_id": "string",
      "k8s_cluster_version": "string",
      "kernel_version": "string",
      "last_login_timestamp": "string",
      "last_login_uid": "string",
      "last_login_user": "string",
      "last_login_user_sid": "string",
      "last_reboot": "string",
      "last_seen": "string",
      "license_activation_state": "string",
      "linux_sensor_mode": "string",
      "local_ip": "string",
      "mac_address": "string",
      "machine_domain": "string",
      "major_version": "string",
      "managed_apps": {},
      "meta": {},
      "migration_completed_time": "string",
      "minor_version": "string",
      "modified_timestamp": "string",
      "notes": [],
      "os_build": "string",
      "os_product_name": "string",
      "os_version": "string",
      "ou": [],
      "platform_id": "string",
      "platform_name": "string",
      "pod_annotations": [],
      "pod_host_ip4": "string",
      "pod_host_ip6": "string",
      "pod_hostname": "string",
      "pod_id": "string",
      "pod_ip4": "string",
      "pod_ip6": "string",
      "pod_labels": [],
      "pod_name": "string",
      "pod_namespace": "string",
      "pod_service_account_name": "string",
      "pointer_size": "string",
      "policies": [],
      "product_type": "string",
      "product_type_desc": "string",
      "provision_status": "string",
      "reduced_functionality_mode": "string",
      "release_group": "string",
      "rtr_state": "string",
      "safe_mode": "string",
      "serial_number": "string",
      "service_pack_major": "string",
      "service_pack_minor": "string",
      "service_provider": "string",
      "service_provider_account_id": "string",
      "site_name": "string",
      "slow_changing_modified_timestamp": "string",
      "status": "string",
      "system_manufacturer": "string",
      "system_product_name": "string",
      "tags": [],
      "zone_group": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "agent_load_flags": "string",
      "agent_local_time": "string",
      "agent_version": "string",
      "base_image_version": "string",
      "bios_manufacturer": "string",
      "bios_version": "string",
      "build_number": "string",
      "chassis_type": "string",
      "chassis_type_desc": "string",
      "cid": "string",
      "cloud_service_compartment_id": "string",
      "config_id_base": "string",
      "config_id_build": "string",
      "config_id_platform": "string",
      "connection_ip": "string",
      "connection_mac_address": "string",
      "cpu_signature": "string",
      "cpu_vendor": "string",
      "criticality": "string",
      "default_gateway_ip": "string",
      "deployment_type": "string",
      "detection_suppression_status": "string",
      "device_id": "string",
      "device_policies": {},
      "email": "string",
      "external_ip": "string",
      "filesystem_containment_status": "string",
      "first_login_timestamp": "string",
      "first_login_user": "string",
      "first_seen": "string",
      "group_hash": "string",
      "groups": [],
      "host_deleted_status": "string",
      "host_hidden_status": "string",
      "host_utc_offset": "string",
      "hostname": "string",
      "instance_id": "string",
      "internet_exposure": "string",
      "k8s_cluster_git_version": "string",
      "k8s_cluster_id": "string",
      "k8s_cluster_version": "string",
      "kernel_version": "string",
      "last_login_timestamp": "string",
      "last_login_uid": "string",
      "last_login_user": "string",
      "last_login_user_sid": "string",
      "last_reboot": "string",
      "last_seen": "string",
      "license_activation_state": "string",
      "linux_sensor_mode": "string",
      "local_ip": "string",
      "mac_address": "string",
      "machine_domain": "string",
      "major_version": "string",
      "managed_apps": {},
      "meta": {},
      "migration_completed_time": "string",
      "minor_version": "string",
      "modified_timestamp": "string",
      "notes": [],
      "os_build": "string",
      "os_product_name": "string",
      "os_version": "string",
      "ou": [],
      "platform_id": "string",
      "platform_name": "string",
      "pod_annotations": [],
      "pod_host_ip4": "string",
      "pod_host_ip6": "string",
      "pod_hostname": "string",
      "pod_id": "string",
      "pod_ip4": "string",
      "pod_ip6": "string",
      "pod_labels": [],
      "pod_name": "string",
      "pod_namespace": "string",
      "pod_service_account_name": "string",
      "pointer_size": "string",
      "policies": [],
      "product_type": "string",
      "product_type_desc": "string",
      "provision_status": "string",
      "reduced_functionality_mode": "string",
      "release_group": "string",
      "rtr_state": "string",
      "safe_mode": "string",
      "serial_number": "string",
      "service_pack_major": "string",
      "service_pack_minor": "string",
      "service_provider": "string",
      "service_provider_account_id": "string",
      "site_name": "string",
      "slow_changing_modified_timestamp": "string",
      "status": "string",
      "system_manufacturer": "string",
      "system_product_name": "string",
      "tags": [],
      "zone_group": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "agent_load_flags": "string",
      "agent_local_time": "string",
      "agent_version": "string",
      "base_image_version": "string",
      "bios_manufacturer": "string",
      "bios_version": "string",
      "build_number": "string",
      "chassis_type": "string",
      "chassis_type_desc": "string",
      "cid": "string",
      "cloud_service_compartment_id": "string",
      "config_id_base": "string",
      "config_id_build": "string",
      "config_id_platform": "string",
      "connection_ip": "string",
      "connection_mac_address": "string",
      "cpu_signature": "string",
      "cpu_vendor": "string",
      "criticality": "string",
      "default_gateway_ip": "string",
      "deployment_type": "string",
      "detection_suppression_status": "string",
      "device_id": "string",
      "device_policies": {},
      "email": "string",
      "external_ip": "string",
      "filesystem_containment_status": "string",
      "first_login_timestamp": "string",
      "first_login_user": "string",
      "first_seen": "string",
      "group_hash": "string",
      "groups": [],
      "host_deleted_status": "string",
      "host_hidden_status": "string",
      "host_utc_offset": "string",
      "hostname": "string",
      "instance_id": "string",
      "internet_exposure": "string",
      "k8s_cluster_git_version": "string",
      "k8s_cluster_id": "string",
      "k8s_cluster_version": "string",
      "kernel_version": "string",
      "last_login_timestamp": "string",
      "last_login_uid": "string",
      "last_login_user": "string",
      "last_login_user_sid": "string",
      "last_reboot": "string",
      "last_seen": "string",
      "license_activation_state": "string",
      "linux_sensor_mode": "string",
      "local_ip": "string",
      "mac_address": "string",
      "machine_domain": "string",
      "major_version": "string",
      "managed_apps": {},
      "meta": {},
      "migration_completed_time": "string",
      "minor_version": "string",
      "modified_timestamp": "string",
      "notes": [],
      "os_build": "string",
      "os_product_name": "string",
      "os_version": "string",
      "ou": [],
      "platform_id": "string",
      "platform_name": "string",
      "pod_annotations": [],
      "pod_host_ip4": "string",
      "pod_host_ip6": "string",
      "pod_hostname": "string",
      "pod_id": "string",
      "pod_ip4": "string",
      "pod_ip6": "string",
      "pod_labels": [],
      "pod_name": "string",
      "pod_namespace": "string",
      "pod_service_account_name": "string",
      "pointer_size": "string",
      "policies": [],
      "product_type": "string",
      "product_type_desc": "string",
      "provision_status": "string",
      "reduced_functionality_mode": "string",
      "release_group": "string",
      "rtr_state": "string",
      "safe_mode": "string",
      "serial_number": "string",
      "service_pack_major": "string",
      "service_pack_minor": "string",
      "service_provider": "string",
      "service_provider_account_id": "string",
      "site_name": "string",
      "slow_changing_modified_timestamp": "string",
      "status": "string",
      "system_manufacturer": "string",
      "system_product_name": "string",
      "tags": [],
      "zone_group": "string"
    }
  ]
}

queryDeviceControlPolicies

Search for Device Control Policies in your environment by providing an FQL filter and paging details.

Method GET

Route /policy/queries/device-control/v1

Scope Device control policies: READ

PEP 8 query_policies

Parameters

filter query · string

FQL Syntax formatted string used to limit the results.

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return. [1-5000]

sort query · string

The property to sort by. (Ex: modified_timestamp.desc)

Available values (16)

`created_by.asc`	`created_by.desc`	`created_timestamp.asc`
`created_timestamp.desc`	`enabled.asc`	`enabled.desc`
`modified_by.asc`	`modified_by.desc`	`modified_timestamp.asc`
`modified_timestamp.desc`	`name.asc`	`name.desc`
`platform_name.asc`	`platform_name.desc`	`precedence.asc`
`precedence.desc`

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.query_policies(filter="string",
                                 limit=integer,
                                 offset=integer,
                                 sort="string")
print(response)

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.queryDeviceControlPolicies(filter="string",
                                             limit=integer,
                                             offset=integer,
                                             sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryDeviceControlPolicies",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

Get-FalconDeviceControlPolicy -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/device_control_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.DeviceControlPolicies.QueryDeviceControlPolicies(
    &device_control_policies.QueryDeviceControlPoliciesParams{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.deviceControlPolicies.queryDeviceControlPolicies(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::device_control_policies_api::query_device_control_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_device_control_policies(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DeviceControlPolicies.new

response = api.query_device_control_policies(filter: 'string',
                                             offset: integer,
                                             limit: integer,
                                             sort: 'string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

queryDeviceControlPolicyMembers

Search for members of a Device Control Policy in your environment by providing an FQL filter and paging details.

Method GET

Route /policy/queries/device-control-members/v1

Scope Device control policies: READ

PEP 8 query_policy_members

Parameters

id query · string

The ID of the Device Control Policy to search for members of

filter query · string

FQL Syntax formatted string used to limit the results.

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return. [1-5000]

sort query · string

The property to sort by. (Ex: modified_timestamp.desc)

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.query_policy_members(id="string",
                                       filter="string",
                                       limit=integer,
                                       offset=integer,
                                       sort="string")
print(response)

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.queryDeviceControlPolicyMembers(id="string",
                                                  filter="string",
                                                  limit=integer,
                                                  offset=integer,
                                                  sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryDeviceControlPolicyMembers",
                          id="string",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

Get-FalconDeviceControlPolicyMember -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/device_control_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  iD := "string"
  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.DeviceControlPolicies.QueryDeviceControlPolicyMembers(
    &device_control_policies.QueryDeviceControlPolicyMembersParams{
      ID: &iD,
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.deviceControlPolicies.queryDeviceControlPolicyMembers(
  "string",  // id
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::device_control_policies_api::query_device_control_policy_members;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_device_control_policy_members(
        &falcon.cfg,  // configuration
        Some("string"),  // id
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DeviceControlPolicies.new

response = api.query_device_control_policy_members(id: 'string',
                                                   filter: 'string',
                                                   offset: integer,
                                                   limit: integer,
                                                   sort: 'string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

setDeviceControlPoliciesPrecedence

Sets the precedence of Device Control Policies based on the order of IDs specified in the request.

Method POST

Route /policy/entities/device-control-precedence/v1

Scope Device control policies: WRITE

PEP 8 set_precedence

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

ids body · array

The ids of all current prevention policies for the platform specified. The precedence will be set in the order the ids are specified

platform_name body · string

The name of the platform for which to set precedence

Available values (3)

Windows Mac Linux

Code Examples

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.set_precedence(ids=id_list, platform_name="string")
print(response)

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.setDeviceControlPoliciesPrecedence(ids=id_list,
                                                     platform_name="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "ids": ["string"],
    "platform_name": "string"
}

response = falcon.command("setDeviceControlPoliciesPrecedence", body=body_payload)
print(response)

Set-FalconDeviceControlPrecedence -PlatformName "string" -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/device_control_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  platform_name := "string"

  response, err := client.DeviceControlPolicies.SetDeviceControlPoliciesPrecedence(
    &device_control_policies.SetDeviceControlPoliciesPrecedenceParams{
      Body: &models.BaseSetPolicyPrecedenceReqV1{
        Ids: []string{"string"},
        PlatformName: &platform_name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.deviceControlPolicies.setDeviceControlPoliciesPrecedence(
  {
    ids: [],
    platformName: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::device_control_policies_api::set_device_control_policies_precedence;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::BaseSetPolicyPrecedenceReqV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = BaseSetPolicyPrecedenceReqV1 {
        ids: vec!["string".to_string()],
        platform_name: Some("string".to_string()),
        ..Default::default()
    };

    let response = set_device_control_policies_precedence(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DeviceControlPolicies.new

body = Falcon::BaseSetPolicyPrecedenceReqV1.new(
  ids: [],
  platform_name: 'string'
)

response = api.set_device_control_policies_precedence(body)

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

updateDefaultDeviceControlPolicies

Update the configuration for a Default Device Control Policy

Method PATCH

Route /policy/entities/default-device-control/v1

Scope Device control policies: WRITE

PEP 8 update_default_policies

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

custom_notifications body · object

blocked_notification body · string

dictionary containing the custom message and enablement status for the blocked notification.

blocked_custom_message body · string

Message to use for blocked notifications. Using this keyword will automatically generate the necessary blocked_notification.

restricted_custom_message body · string

message to use for restricted notifications. Using this keyword will automatically generate the necessary restricted_notification.

restricted_notification body · string

dictionary containing the custom message and enablement status for the restricted notification.

Code Examples

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.update_default_policies(blocked_notification="string",
                                          blocked_custom_message="string",
                                          restricted_custom_message="string",
                                          restricted_notification="string")
print(response)

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.updateDefaultDeviceControlPolicies(blocked_notification="string",
                                                     blocked_custom_message="string",
                                                     restricted_custom_message="string",
                                                     restricted_notification="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "custom_notifications": {
        "blocked_notification": {
            "custom_message": "string",
            "use_custom": boolean
        },
        "restricted_notification": {
            "custom_message": "string",
            "use_custom": boolean
        }
    }
}

response = falcon.command("updateDefaultDeviceControlPolicies", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/device_control_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DeviceControlPolicies.UpdateDefaultDeviceControlPolicies(
    &device_control_policies.UpdateDefaultDeviceControlPoliciesParams{
      Body: &models.DeviceControlReqUpdateDefaultDCPolicyV1{
        CustomNotifications: &struct{}{},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.deviceControlPolicies.updateDefaultDeviceControlPolicies(
  {
    customNotifications: {
      blockedNotification: {
        customMessage: "string",
        useCustom: boolean
      },
      restrictedNotification: {
        customMessage: "string",
        useCustom: boolean
      }
    }
}  // body
);

console.log(response);

use rusty_falcon::apis::device_control_policies_api::update_default_device_control_policies;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DeviceControlReqUpdateDefaultDcPolicyV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DeviceControlReqUpdateDefaultDcPolicyV1 {
        ..Default::default()
    };

    let response = update_default_device_control_policies(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DeviceControlPolicies.new

body = Falcon::DeviceControlReqUpdateDefaultDCPolicyV1.new(
  custom_notifications: {
    blocked_notification: {
      custom_message: 'string',
      use_custom: boolean
    },
    restricted_notification: {
      custom_message: 'string',
      use_custom: boolean
    }
  }
)

response = api.update_default_device_control_policies(body)

puts response

Responses

[
  {
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform_name": "string",
    "settings": {}
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

updateDefaultDeviceControlSettings

Update the configuration for Default Device Control Settings

Method PATCH

Route /policy/entities/device-control-default-settings/v1

Scope Device control policies: WRITE

PEP 8 update_default_settings

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

bluetooth_custom_notifications body · object

Custom bluetooth notifications.

usb_custom_notifications body · object

Custom USB notifications.

usb_exceptions body · list of dictionaries

USB exceptions.

Code Examples

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

bluetooth_custom_notifications = {
    "blocked_notification": {
        "custom_message": "string",
        "use_custom": "boolean"
    }
}

usb_custom_notifications = {
    "blocked_notification": {
        "custom_message": "string",
        "use_custom": "boolean"
    },
    "restricted_notification": {
        "custom_message": "string",
        "use_custom": "boolean"
    }
}

usb_exceptions = [
    {
        "delete_exceptions": [
            "string"
        ],
        "platform_name": "string",
        "upsert_exceptions": [
            {
                "action": "string",
                "class": "string",
                "combined_id": "string",
                "description": "string",
                "id": "string",
                "product_id": "string",
                "product_name": "string",
                "serial_number": "string",
                "vendor_id": "string",
                "vendor_name": "string"
            }
        ]
    }
]

response = falcon.update_default_settings(bluetooth_custom_notifications=bluetooth_custom_notifications,
                                          usb_custom_notifications=usb_custom_notifications,
                                          usb_exceptions=usb_exceptions)
print(response)

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

bluetooth_custom_notifications = {
    "blocked_notification": {
        "custom_message": "string",
        "use_custom": "boolean"
    }
}

usb_custom_notifications = {
    "blocked_notification": {
        "custom_message": "string",
        "use_custom": "boolean"
    },
    "restricted_notification": {
        "custom_message": "string",
        "use_custom": "boolean"
    }
}

usb_exceptions = [
    {
        "delete_exceptions": [
            "string"
        ],
        "platform_name": "string",
        "upsert_exceptions": [
            {
                "action": "string",
                "class": "string",
                "combined_id": "string",
                "description": "string",
                "id": "string",
                "product_id": "string",
                "product_name": "string",
                "serial_number": "string",
                "vendor_id": "string",
                "vendor_name": "string"
            }
        ]
    }
]

response = falcon.updateDefaultDeviceControlSettings(bluetooth_custom_notifications=bluetooth_custom_notifications,
                                                     usb_custom_notifications=usb_custom_notifications,
                                                     usb_exceptions=usb_exceptions)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "bluetooth_custom_notifications": {
        "blocked_notification": {
            "custom_message": "string",
            "use_custom": boolean
        }
    },
    "usb_custom_notifications": {
        "blocked_notification": {
            "custom_message": "string",
            "use_custom": boolean
        },
        "restricted_notification": {
            "custom_message": "string",
            "use_custom": boolean
        }
    }
}

response = falcon.command("updateDefaultDeviceControlSettings", body=body_payload)
print(response)

Edit-FalconDeviceControlNotification -Bluetooth @{} -Usb @{}

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/device_control_with_bluetooth"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DeviceControlWithBluetooth.UpdateDefaultDeviceControlSettings(
    &device_control_with_bluetooth.UpdateDefaultDeviceControlSettingsParams{
      Body: &models.DeviceControlReqUpdateDefaultSettingsV1{
        BluetoothCustomNotifications: &struct{}{},
        UsbCustomNotifications: &struct{}{},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.deviceControlWithBluetooth.updateDefaultDeviceControlSettings(
  {
    bluetoothCustomNotifications: {
      blockedNotification: {
        customMessage: "string",
        useCustom: boolean
      }
    },
    usbCustomNotifications: {
      blockedNotification: {
        customMessage: "string",
        useCustom: boolean
      },
      restrictedNotification: {
        customMessage: "string",
        useCustom: boolean
      }
    }
}  // body
);

console.log(response);

use rusty_falcon::apis::device_control_with_bluetooth_api::update_default_device_control_settings;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DeviceControlReqUpdateDefaultSettingsV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DeviceControlReqUpdateDefaultSettingsV1 {
        ..Default::default()
    };

    let response = update_default_device_control_settings(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DeviceControlWithBluetooth.new

body = Falcon::DeviceControlReqUpdateDefaultSettingsV1.new(
  bluetooth_custom_notifications: {
    blocked_notification: {
      custom_message: 'string',
      use_custom: boolean
    }
  },
  usb_custom_notifications: {
    blocked_notification: {
      custom_message: 'string',
      use_custom: boolean
    },
    restricted_notification: {
      custom_message: 'string',
      use_custom: boolean
    }
  }
)

response = api.update_default_device_control_settings(body)

puts response

Responses

[
  {
    "bluetooth_custom_notifications": {},
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "usb_custom_notifications": {}
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

updateDeviceControlPolicies

Update Device Control Policies by specifying the ID of the policy and details to update

Method PATCH

Route /policy/entities/device-control/v1

Scope Device control policies: WRITE

PEP 8 update_policies

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

List of policies to update. Maximum batch size: 1000.

id body · string

ID of the Device Control Policy to update.

description body · string

Device Control Policy description.

name body · string

Device Control Policy name.

settings body · dictionary

Device Control policy specific settings. See above for JSON dictionary format example.

Code Examples

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

settings = {
    "classes": [
        {
            "action": "FULL_ACCESS",
            "exceptions": [
                {
                    "action": "string",
                    "combined_id": "string",
                    "description": "string",
                    "expiration_time": "2023-06-08T06:10:39.965Z",
                    "id": "string",
                    "product_id": "string",
                    "product_id_decimal": "string",
                    "product_name": "string",
                    "serial_number": "string",
                    "use_wildcard": True,
                    "vendor_id": "string",
                    "vendor_id_decimal": "string",
                    "vendor_name": "string"
                }
            ],
            "id": "string"
        }
    ],
    "custom_notifications": {
        "blocked_notification": {
            "custom_message": "string",
            "use_custom": True
        },
        "restricted_notification": {
            "custom_message": "string",
            "use_custom": True
        }
    },
    "delete_exceptions": [
        "string"
    ],
    "end_user_notification": "SILENT",
    "enforcement_mode": "MONITOR_ONLY",
    "enhanced_file_metadata": True
}

response = falcon.update_policies(id="string",
                                  description="string",
                                  name="string",
                                  settings=settings)
print(response)

from falconpy import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

settings = {
    "classes": [
        {
            "action": "FULL_ACCESS",
            "exceptions": [
                {
                    "action": "string",
                    "combined_id": "string",
                    "description": "string",
                    "expiration_time": "2023-06-08T06:10:39.965Z",
                    "id": "string",
                    "product_id": "string",
                    "product_id_decimal": "string",
                    "product_name": "string",
                    "serial_number": "string",
                    "use_wildcard": True,
                    "vendor_id": "string",
                    "vendor_id_decimal": "string",
                    "vendor_name": "string"
                }
            ],
            "id": "string"
        }
    ],
    "custom_notifications": {
        "blocked_notification": {
            "custom_message": "string",
            "use_custom": True
        },
        "restricted_notification": {
            "custom_message": "string",
            "use_custom": True
        }
    },
    "delete_exceptions": [
        "string"
    ],
    "end_user_notification": "SILENT",
    "enforcement_mode": "MONITOR_ONLY",
    "enhanced_file_metadata": True
}

response = falcon.updateDeviceControlPolicies(id="string",
                                              description="string",
                                              name="string",
                                              settings=settings)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "description": "string",
            "id": "string",
            "name": "string",
            "settings": {
                "classes": ["string"],
                "custom_notifications": {},
                "delete_exceptions": ["string"],
                "end_user_notification": "string",
                "enforcement_mode": "string",
                "enhanced_file_metadata": boolean
            }
        }
    ]
}

response = falcon.command("updateDeviceControlPolicies", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/device_control_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  id := "string"
  name := "string"

  response, err := client.DeviceControlPolicies.UpdateDeviceControlPolicies(
    &device_control_policies.UpdateDeviceControlPoliciesParams{
      Body: &models.DeviceControlUpdatePoliciesReqV1{
        Resources: []interface{}{
          {
          Description: &description,
          ID: &id,
          Name: &name,
          Settings: &struct{}{},
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.deviceControlPolicies.updateDeviceControlPolicies(
  {
    resources: [{
        description: "string",
        id: "string",
        name: "string",
        settings: {
          classes: [],
          customNotifications: {},
          deleteExceptions: [],
          endUserNotification: "string",
          enforcementMode: "string",
          enhancedFileMetadata: boolean
        }
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::device_control_policies_api::update_device_control_policies;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DeviceControlUpdatePoliciesReqV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DeviceControlUpdatePoliciesReqV1 {
        resources: vec![UpdatePolicyReqV1 {
            id: Some("string".to_string()),
            settings: Default::default(),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = update_device_control_policies(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DeviceControlPolicies.new

body = Falcon::DeviceControlUpdatePoliciesReqV1.new(
  resources: [{
      description: 'string',
      id: 'string',
      name: 'string',
      settings: {
        classes: [],
        custom_notifications: {},
        delete_exceptions: [],
        end_user_notification: 'string',
        enforcement_mode: 'string',
        enhanced_file_metadata: boolean
      }
    }]
)

response = api.update_device_control_policies(body)

puts response

Responses

[
  {
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform_name": "string",
    "settings": {}
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": {}
    }
  ]
}

Device Control Policies

Table of Contents

createDeviceControlPolicies

Parameters

deleteDeviceControlPolicies

Parameters

getDefaultDeviceControlPolicies

getDefaultDeviceControlSettings

getDeviceControlPolicies

Parameters

getDeviceControlPoliciesV2

Parameters

patchDeviceControlPoliciesClassesV1

Parameters

patchDeviceControlPoliciesV2

Parameters

performDeviceControlPoliciesAction

Parameters

postDeviceControlPoliciesV2

Parameters

queryCombinedDeviceControlPolicies

Parameters

queryCombinedDeviceControlPolicyMembers

Parameters

queryDeviceControlPolicies

Parameters

queryDeviceControlPolicyMembers

Parameters

setDeviceControlPoliciesPrecedence

Parameters

updateDefaultDeviceControlPolicies

Parameters

updateDefaultDeviceControlSettings

Parameters

updateDeviceControlPolicies

Parameters