Discover

The Discover service collection provides operations for searching and retrieving asset data across your environment. Search and retrieve details for applications, hosts, IoT hosts, accounts, and logins using FQL filters.

Language	Last Update
Python	v1.4.6
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

This service collection has code examples posted to the repository.

Operation	Description
combined_applications `query_combined_applications`	Search for applications in your environment by providing a FQL (Falcon Query Language) filter and paging details. Returns details on applications which match the filter criteria.
combined_hosts `query_combined_hosts`	Search for assets in your environment by providing a FQL (Falcon Query Language) filter and paging details. Returns details on assets which match the filter criteria.
get_accounts `get_accounts`	Get details on accounts by providing one or more IDs.
get_applications `get_applications`	Get details on applications by providing one or more IDs.
get_hosts `get_hosts`	Get details on assets by providing one or more IDs.
get_iot_hosts `get_iot_hosts`	Get details on IoT assets by providing one or more IDs.
get_logins `get_logins`	Get details on logins by providing one or more IDs.
query_accounts `query_accounts`	Search for accounts in your environment by providing a FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.
query_applications `query_applications`	Search for applications in your environment by providing a FQL (Falcon Query Language) filter and paging details. Returns a set of application IDs which match the filter criteria.
query_hosts `query_hosts`	Search for assets in your environment by providing a FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.
query_iot_hosts `query_iot_hosts`	Search for IoT assets in your environment by providing a FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.
query_iot_hostsV2 `query_iot_hosts_v2`	Search for IoT assets in your environment by providing a FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.
query_logins `query_logins`	Search for logins in your environment by providing a FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.

combined_applications

Search for applications in your environment by providing a FQL (Falcon Query Language) filter and paging details. Returns details on applications which match the filter criteria.

GET /discover/combined/applications/v1

Scope Discover: READ Produces application/json

PEP 8 query_combined_applications

Parameters

Name	Type	Data type	Description
facet	query	string	Select various details blocks to be returned for each application entity. Supported values: `browser_extension`, `host_info`, `install_usage`, `package`, `ide_extension`
filter	query	string	Filter applications using a FQL query. A list of available filters can be found in the Available filters section below.
limit	query	integer	The number of account IDs to return in this response (Max: 1000, Default: 100). Use with the `after` parameter to manage pagination of results.
after	query	string	A pagination token used with the limit parameter to manage pagination of results. On your first request, don’t provide an after token. On subsequent requests, provide the after token from the previous response to continue from that place in the results.
parameters	query	dictionary	Full query string parameters payload in JSON format.
sort	query	string	Sort accounts by their properties. A single sort field is allowed. Common sort options include: `username\|asc`, `last_failed_login_timestamp\|desc`

Available filters

Name	Description
`id`	Unique ID of the application. Each application ID represents a particular instance of an application on a particular asset. Example: `id:'a89xxxxxxxxxxxxxxxxxxxxxxxxx08e_137xxxxxxxxxxxx191'`
`cid`	The application’s customer ID.
`name`	Name of the application. Example: `name:'Chrome'`
`vendor`	Name of the application vendor.
`version`	Application version.
`name_vendor`	The app name and vendor name for all application IDs with this application name, this field can be used to group results by application.
`name_vendor_version`	The app name, vendor name, and vendor version for all application IDs with this application name, this field can be used to group results by application version.
`versioning_scheme`	Versioning scheme of the application.
`groups`	All application groups the application is assigned to.
`category`	Category the application is in.
`architectures`	Application architecture.
`installation_paths`	File paths of the application or executable file to the folder on the asset.
`installation_timestamp`	Date and time the application was installed, if available.
`first_seen_timestamp`	Date and time the application was first seen.
`last_updated_timestamp`	Date and time the installation fields of the application instance most recently changed.
`last_used_user_sid`	For Windows and macOS: Security identifier of the account that most recently used the application.
`last_used_user_name`	For Windows and macOS: Username of the account that most recently used the application.
`last_used_file_name`	For Windows and macOS: Most recent file name used for the application.
`last_used_file_hash`	For Windows and macOS: Most recent file hash used for the application.
`last_used_timestamp`	For Windows and macOS: Date and time the application was most recently used.
`is_normalized`	For Windows: Whether the application name is normalized (true or false).
`is_suspicious`	Whether the application is suspicious based on how often it’s been seen in a detection on that asset (true or false).
`host.id`	Unique ID of the asset the application is on.
`host.aid`	ID of the Falcon sensor installed on the asset the application is on.
`host.country`	Name of the country where the asset the application is on is located.
`host.platform_name`	The platform name of the asset the application is on (Windows, Mac, Linux).
`host.os_version`	OS version of the asset the application is on.
`host.kernel_version`	For Linux and Mac: The major version, minor version, and patch version of the kernel for the asset the application is on. For Windows: the build number of the asset the application is on.
`host.product_type_desc`	The product type of the asset the application is on (Workstation, Domain Controller, Server).
`host.tags`	Sensor and cloud tags of the asset the application is on.
`host.groups`	Host management groups the asset the application is on is part of.
`host.agent_version`	Version of the Falcon sensor that’s installed on the asset the application is on.
`host.system_manufacturer`	System manufacturer of the asset the application is on.
`host.ou`	Organizational unit of the asset the application is on.
`host.machine_domain`	Domain name the asset the application is on is currently joined to.
`host.site_name`	Site name of the domain the asset the asset the application is on is joined to (applies only to Windows hosts).
`host.external_ip`	External IPv4 address of the asset the application is on.
`host.hostname`	Hostname of the asset the application is on.
`host.current_network_prefix`	Most recent network prefix of the asset the application is on.
`host.internet_exposure`	Whether the asset the application is on is exposed to the internet (Yes or Unknown).
`host.current_mac_address`	Most recent MAC address of the asset the application is on.

Code Examples

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_combined_applications(after="string",
                                              facet="string",
                                              filter="string",
                                              limit="string",
                                              sort="string")
print(response)

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.combined_applications(after="string",
                                        facet="string",
                                        filter="string",
                                        limit="string",
                                        sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("combined_applications",
                          after="string",
                          limit=integer,
                          sort="string",
                          filter="string",
                          facet=id_list)
print(response)

Get-FalconAsset -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Application $boolean

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/discover"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  after := "string"
  limit := int64(0)
  sort := "string"

  response, err := client.Discover.CombinedApplications(
    &discover.CombinedApplicationsParams{
      After: &after,
      Limit: &limit,
      Sort: &sort,
      Filter: "string",
      Facet: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.discover.combinedApplications(
  "string",  // filter
  "string",  // after
  integer,  // limit
  "string",  // sort
  ["ID1", "ID2", "ID3"]  // facet
);

console.log(response);

use rusty_falcon::apis::discover_api::combined_applications;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = combined_applications(
        &falcon.cfg,  // configuration
        "string",  // filter
        Some("string"),  // after
        Some(integer),  // limit
        Some("string"),  // sort
        Some(vec!["string".to_string()]),  // facet
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Discover.new

response = api.combined_applications('string')

puts response

combined_hosts

Search for assets in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns details on assets which match the filter criteria.

GET /discover/combined/hosts/v1

Scope Discover: READ Produces application/json

PEP 8 query_combined_hosts

Parameters

Name	Type	Data type	Description
facet	query	string	Select various details blocks to be returned for each host entity. Supported values: system_insights, third_party, risk_factors.
filter	query	string	Filter assets using a FQL query. A complete list of available filters can be found in the Available FQL Filters section below.
limit	query	integer	The number of asset IDs to return in this response (Max: 1000, Default: 100). Use with the `after` parameter to manage pagination of results.
after	query	string	A pagination token used with the limit parameter to manage pagination of results. On your first request, don’t provide an after token. On subsequent requests, provide the after token from the previous response to continue from that place in the results.
parameters	query	dictionary	Full query string parameters payload in JSON format.
sort	query	string	Sort assets by their properties. A single sort field is allowed. Common sort options include: `hostname\|asc`, `product_type_desc\|desc`

Available FQL Filters

Available filter fields that support exact match: id, aid, entity_type, country, city, platform_name, os_version, kernel_version, product_type_desc, tags, groups, agent_version, system_product_name, system_manufacturer, system_serial_number, bios_manufacturer, bios_version, ou, machine_domain, site_name, external_ip, hostname, local_ips_count, network_interfaces.local_ip, network_interfaces.mac_address, network_interfaces.interface_alias, network_interfaces.interface_description, network_interfaces.network_prefix, last_discoverer_aid, discoverer_count, discoverer_aids, discoverer_tags, discoverer_platform_names, discoverer_product_type_descs, confidence, internet_exposure, os_is_eol, data_providers, data_providers_count, mac_addresses, local_ip_addresses, reduced_functionality_mode, number_of_disk_drives, processor_package_count, physical_core_count, logical_core_count, total_disk_space, disk_sizes.disk_name, disk_sizes.disk_space, cpu_processor_name, total_memory, encryption_status, encrypted_drives, encrypted_drives_count, unencrypted_drives, unencrypted_drives_count, os_security.secure_boot_requested_status, os_security.device_guard_status, os_security.system_guard_status, os_security.credential_guard_status, os_security.iommu_protection_status, os_security.secure_boot_enabled_status, os_security.uefi_memory_protection_status, os_security.virtualization_based_security_status, os_security.kernel_dma_protection_status, total_bios_files, bios_hashes_data.sha256_hash, bios_hashes_data.measurement_type, bios_id, average_processor_usage, average_memory_usage, average_memory_usage_pct, max_processor_usage, max_memory_usage, max_memory_usage_pct, used_disk_space, used_disk_space_pct, available_disk_space, available_disk_space_pct, mount_storage_info.mount_path, mount_storage_info.used_space, mount_storage_info.available_space, form_factor, servicenow_id, owned_by, managed_by, assigned_to, department, fqdn, used_for, object_guid, object_sid, ad_user_account_control, account_enabled, creation_timestamp, email, os_service_pack, location, state, cpu_manufacturer, discovering_by, scan_details.scan_id, scan_details.schedule_id

Available filter fields that support range comparisons (>, <, >=, <=): first_seen_timestamp, last_seen_timestamp, local_ips_count, discoverer_count, confidence, number_of_disk_drives, processor_package_count, physical_core_count, data_providers_count, logical_core_count, total_disk_space, disk_sizes.disk_space, total_memory, encrypted_drives_count, unencrypted_drives_count, total_bios_files, average_processor_usage, average_memory_usage, average_memory_usage_pct, max_processor_usage, max_memory_usage, max_memory_usage_pct, used_disk_space, used_disk_space_pct, available_disk_space, available_disk_space_pct, mount_storage_info.used_space, mount_storage_info.available_space, ad_user_account_control, creation_timestamp, scan_details.scan_date, vulnerability_assessment_date

All filter fields and operations supports negation (!).

Code Examples

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_combined_hosts(facet="string",
                                       filter="string",
                                       limit="string",
                                       offset="string",
                                       sort="string")
print(response)

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.combined_hosts(facet="string",
                                 filter="string",
                                 limit="string",
                                 offset="string",
                                 sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("combined_hosts",
                          after="string",
                          limit=integer,
                          sort="string",
                          filter="string",
                          facet=id_list)
print(response)

Get-FalconAsset -Filter "string" `
  -Sort "string" `
  -Limit integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/discover"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  after := "string"
  limit := int64(0)
  sort := "string"

  response, err := client.Discover.CombinedHosts(
    &discover.CombinedHostsParams{
      After: &after,
      Limit: &limit,
      Sort: &sort,
      Filter: "string",
      Facet: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.discover.combinedHosts(
  "string",  // filter
  "string",  // after
  integer,  // limit
  "string",  // sort
  ["ID1", "ID2", "ID3"]  // facet
);

console.log(response);

use rusty_falcon::apis::discover_api::combined_hosts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = combined_hosts(
        &falcon.cfg,  // configuration
        "string",  // filter
        Some("string"),  // after
        Some(integer),  // limit
        Some("string"),  // sort
        Some(vec!["string".to_string()]),  // facet
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Discover.new

response = api.combined_hosts('string')

puts response

get_accounts

Get details on assets by providing one or more IDs.

GET /discover/entities/accounts/v1

Scope Discover: READ Produces application/json

PEP 8 get_accounts

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	One or more account IDs. (Max: 100) Find account IDs with `query_accounts`.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_accounts(ids=id_list)
print(response)

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_accounts(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_accounts",
                          ids=id_list)
print(response)

Get-FalconAsset -Id @("ID1", "ID2") -Account $boolean

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/discover"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Discover.GetAccounts(
    &discover.GetAccountsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.discover.getAccounts(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::discover_api::get_accounts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_accounts(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Discover.new

response = api.get_accounts(['ID1', 'ID2', 'ID3'])

puts response

get_applications

Get details on applications by providing one or more IDs.

GET /discover/entities/applications/v1

Scope Discover: READ Produces application/json

PEP 8 get_applications

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	One or more account IDs. (Max: 100) Find account IDs with `query_accounts`.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_applications(ids=id_list)
print(response)

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_applications(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_applications",
                          ids=id_list)
print(response)

Get-FalconAsset -Id @("ID1", "ID2") -Application $boolean

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/discover"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Discover.GetApplications(
    &discover.GetApplicationsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.discover.getApplications(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::discover_api::get_applications;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_applications(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Discover.new

response = api.get_applications(['ID1', 'ID2', 'ID3'])

puts response

get_hosts

Get details on assets by providing one or more IDs.

GET /discover/entities/hosts/v1

Scope Discover: READ Produces application/json

PEP 8 get_hosts

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	One or more asset IDs. (Max: 100) Find asset IDs with `query_hosts`.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_hosts(ids=id_list)
print(response)

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_hosts(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_hosts",
                          ids=id_list)
print(response)

Get-FalconAsset -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/discover"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Discover.GetHosts(
    &discover.GetHostsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.discover.getHosts(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::discover_api::get_hosts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_hosts(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Discover.new

response = api.get_hosts(['ID1', 'ID2', 'ID3'])

puts response

get_iot_hosts

Get details on IoT assets by providing one or more IDs.

GET /discover/entities/iot-hosts/v1

Scope Discover IoT: READ Produces application/json

PEP 8 get_iot_hosts

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	One or more IoT asset IDs. (Max: 100) Find asset IDs with `query_iot_hosts`.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_iot_hosts(ids=id_list)
print(response)

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_iot_hosts(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_iot_hosts",
                          ids=id_list)
print(response)

Get-FalconAsset -Id @("ID1", "ID2") -IoT $boolean

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/discover_iot"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DiscoverIot.GetIotHosts(
    &discover_iot.GetIotHostsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.discoverIot.getIotHosts(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::discover_iot_api::get_iot_hosts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_iot_hosts(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DiscoverIot.new

response = api.get_iot_hosts(['ID1', 'ID2', 'ID3'])

puts response

get_logins

Get details on assets by providing one or more IDs.

GET /discover/entities/logins/v1

Scope Discover: READ Produces application/json

PEP 8 get_logins

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	One or more login IDs. (Max: 100) Find login IDs with `query_logins`.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_logins(ids=id_list)
print(response)

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_logins(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_logins",
                          ids=id_list)
print(response)

Get-FalconAsset -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/discover"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Discover.GetLogins(
    &discover.GetLoginsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.discover.getLogins(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::discover_api::get_logins;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_logins(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Discover.new

response = api.get_logins(['ID1', 'ID2', 'ID3'])

puts response

query_accounts

Search for accounts in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.

GET /discover/queries/accounts/v1

Scope Discover: READ Produces application/json

PEP 8 query_accounts

Parameters

Name	Type	Data type	Description
filter	query	string	Filter accounts using a FQL query. A complete list of available filters can be found in the Available FQL Filters section below.
limit	query	integer	The number of account IDs to return in this response (Max: 100, Default: 100). Use with the `offset` parameter to manage pagination of results.
offset	query	string	An offset used with the `limit` parameter to manage pagination of results. On your first request, don’t provide an `offset`. On subsequent requests, provide the `offset` from the previous response to continue from that place in the results.
parameters	query	dictionary	Full query string parameters payload in JSON format.
sort	query	string	Sort accounts by their properties. A single sort field is allowed. Common sort options include: `username\|asc`, `last_failed_login_timestamp\|desc`

Available FQL Filters

Common filters include:

account_type:'Local'
admin_privileges:'Yes'
first_seen_timestamp:<'now-7d'
last_successful_login_type:'Terminal server'


id	last_successful_login_timestamp
cid	last_successful_login_hostname
user_sid	last_successful_login_remote_ip
login_domain	last_successful_login_host_country
account_name	last_successful_login_host_city
username	last_failed_login_type
account_type	last_failed_login_timestamp
admin_privileges	last_failed_login_hostname
first_seen_timestamp	password_last_set_timestamp
last_successful_login_type

Code Examples

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_accounts(filter="string",
                                 limit="string",
                                 offset="string",
                                 sort="string")
print(response)

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_accounts(filter="string",
                                 limit="string",
                                 offset="string",
                                 sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("query_accounts",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string")
print(response)

Get-FalconAsset -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer `
  -Account $boolean

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/discover"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.Discover.QueryAccounts(
    &discover.QueryAccountsParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.discover.queryAccounts(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string"  // filter
);

console.log(response);

use rusty_falcon::apis::discover_api::query_accounts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_accounts(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Discover.new

response = api.query_accounts(offset: integer,
                              limit: integer,
                              sort: 'string',
                              filter: 'string')

puts response

query_applications

Search for applications in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of application IDs which match the filter criteria.

GET /discover/queries/applications/v1

Scope Discover: READ Produces application/json

PEP 8 query_applications

Parameters

Name	Type	Data type	Description
filter	query	string	Filter applications using a FQL query. A list of available filters can be found in the Available filters section below.
limit	query	integer	The number of account IDs to return in this response (Max: 100, Default: 100). Use with the `offset` parameter to manage pagination of results.
offset	query	string	An offset used with the `limit` parameter to manage pagination of results. On your first request, don’t provide an `offset`. On subsequent requests, provide the `offset` from the previous response to continue from that place in the results.
parameters	query	dictionary	Full query string parameters payload in JSON format.
sort	query	string	Sort accounts by their properties. A single sort field is allowed. Common sort options include: `username\|asc`, `last_failed_login_timestamp\|desc`

Available filters

Same filter set as combined_applications.

Code Examples

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_applications(filter="string",
                                     limit="string",
                                     offset="string",
                                     sort="string")
print(response)

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_applications(filter="string",
                                     limit="string",
                                     offset="string",
                                     sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("query_applications",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string")
print(response)

Get-FalconAsset -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer `
  -Application $boolean

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/discover"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.Discover.QueryApplications(
    &discover.QueryApplicationsParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.discover.queryApplications(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string"  // filter
);

console.log(response);

use rusty_falcon::apis::discover_api::query_applications;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_applications(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Discover.new

response = api.query_applications(offset: integer,
                                  limit: integer,
                                  sort: 'string',
                                  filter: 'string')

puts response

query_hosts

Search for assets in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.

GET /discover/queries/hosts/v1

Scope Discover: READ Produces application/json

PEP 8 query_hosts

Parameters

Name	Type	Data type	Description
filter	query	string	Filter assets using a FQL query. A complete list of available filters can be found in the Available FQL Filters section below.
limit	query	integer	The number of asset IDs to return in this response (Max: 100, Default: 100). Use with the `offset` parameter to manage pagination of results.
offset	query	string	An offset used with the `limit` parameter to manage pagination of results. On your first request, don’t provide an `offset`. On subsequent requests, provide the `offset` from the previous response to continue from that place in the results.
parameters	query	dictionary	Full query string parameters payload in JSON format.
sort	query	string	Sort assets by their properties. A single sort field is allowed. Common sort options include: `hostname\|asc`, `product_type_desc\|desc`

Available FQL Filters


agent_version	kernel_version
aid	last_discoverer_aid
bios_manufacturer	last_seen_timestamp
bios_version	local_ips_count
cid	machine_domain
city	network_interfaces
confidence	network_interfaces.interface_alias
country	network_interfaces.interface_description
current_local_ip	network_interfaces.local_ip
discoverer_aids	network_interfaces.mac_address
discoverer_count	network_interfaces.network_prefix
discoverer_platform_names	os_version
discoverer_product_type_descs	ou
discoverer_tags	platform_name
entity_type	product_type
external_ip	product_type_desc
first_discoverer_aid	site_name
first_discoverer_ip	system_manufacturer
first_seen_timestamp	system_product_name
groups	system_serial_number
hostname	tags
id	scan_details.scan_id
scan_details.schedule_id

Code Examples

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_hosts(filter="string",
                              limit="string",
                              offset="string",
                              sort="string")
print(response)

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_hosts(filter="string",
                              limit="string",
                              offset="string",
                              sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("query_hosts",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string")
print(response)

Get-FalconAsset -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/discover"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.Discover.QueryHosts(
    &discover.QueryHostsParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.discover.queryHosts(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string"  // filter
);

console.log(response);

use rusty_falcon::apis::discover_api::query_hosts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_hosts(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Discover.new

response = api.query_hosts(offset: integer,
                           limit: integer,
                           sort: 'string',
                           filter: 'string')

puts response

query_iot_hosts

Search for IoT assets in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.

GET /discover/queries/iot-hosts/v1

Scope Discover IoT: READ Produces application/json

PEP 8 query_iot_hosts

Parameters

Name	Type	Data type	Description
filter	query	string	Filter assets using a FQL query. A complete list of available filters can be found in the Available FQL Filters section below.
limit	query	integer	The number of IoT asset IDs to return in this response (Max: 100, Default: 100). Use with the `offset` parameter to manage pagination of results.
offset	query	string	An offset used with the `limit` parameter to manage pagination of results. On your first request, don’t provide an `offset`. On subsequent requests, provide the `offset` from the previous response to continue from that place in the results.
parameters	query	dictionary	Full query string parameters payload in JSON format.
sort	query	string	Sort IoT assets by their properties. A single sort field is allowed. Common sort options include: `hostname\|asc`, `product_type_desc\|desc`

Available FQL Filters


agent_version	local_ips_count
aid	mac_addresses
bios_manufacturer	machine_domain
bios_version	network_id
business_criticality	network_interfaces
cid	network_interfaces.interface_alias
city	network_interfaces.interface_description
claroty_id	network_interfaces.local_ip
confidence	network_interfaces.mac_address
country	network_interfaces.network_prefix
current_local_ip	number_of_disk_drives
data_providers	os_is_eol
data_providers_count	os_version
device_class	ou
device_family	physical_core_count
device_type	platform_name
discoverer_count	processor_package_count
discoverer_product_type_descs	product_type_desc
discoverer_tags	protocols
entity_type	purdue_level
external_ip	reduced_functionality_mode
first_seen_timestamp	site_name
groups	subnet
hostname	system_manufacturer
ics_id	system_product_name
id	system_serial_number
internet_exposure	tags
kernel_version	virtual_zone
last_seen_timestamp	vlan
local_ip_addresses

Code Examples

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_iot_hosts(filter="string",
                                  limit="string",
                                  offset="string",
                                  sort="string")
print(response)

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_iot_hosts(filter="string",
                                  limit="string",
                                  offset="string",
                                  sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("query_iot_hosts",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/discover_iot"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.DiscoverIot.QueryIotHosts(
    &discover_iot.QueryIotHostsParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.discoverIot.queryIotHosts(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string"  // filter
);

console.log(response);

use rusty_falcon::apis::discover_iot_api::query_iot_hosts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_iot_hosts(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DiscoverIot.new

response = api.query_iot_hosts(offset: integer,
                               limit: integer,
                               sort: 'string',
                               filter: 'string')

puts response

query_logins

Search for accounts in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.

GET /discover/queries/logins/v1

Scope Discover: READ Produces application/json

PEP 8 query_logins

Parameters

Name	Type	Data type	Description
filter	query	string	Filter logins using a FQL query. A complete list of available filters can be found in the Available FQL Filters section below.
limit	query	integer	The number of login IDs to return in this response (Max: 100, Default: 100). Use with the `offset` parameter to manage pagination of results.
offset	query	string	An offset used with the `limit` parameter to manage pagination of results. On your first request, don’t provide an `offset`. On subsequent requests, provide the `offset` from the previous response to continue from that place in the results.
parameters	query	dictionary	Full query string parameters payload in JSON format.
sort	query	string	Sort logins by their properties. A single sort field is allowed. Common sort options include: `account_name\|asc`, `login_timestamp\|desc`

Available FQL Filters

Common filters include:

account_type:'Local'
login_type:'Interactive'
first_seen_timestamp:<'now-7d'
admin_privileges:'No'


id	login_timestamp
cid	login_domain
login_status	admin_privileges
account_id	local_ip
host_id	remote_ip
user_sid	host_country
aid	host_city
account_name	is_suspicious
username	failure_description
hostname	login_event_count
account_type	aggregation_time_interval
login_type

Code Examples

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_logins(filter="string",
                               limit="string",
                               offset="string",
                               sort="string")
print(response)

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_logins(filter="string",
                               limit="string",
                               offset="string",
                               sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("query_logins",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string")
print(response)

Get-FalconAsset -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/discover"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.Discover.QueryLogins(
    &discover.QueryLoginsParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.discover.queryLogins(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string"  // filter
);

console.log(response);

use rusty_falcon::apis::discover_api::query_logins;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_logins(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Discover.new

response = api.query_logins(offset: integer,
                            limit: integer,
                            sort: 'string',
                            filter: 'string')

puts response

query_iot_hostsV2

Search for IoT assets in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.

GET /discover/queries/iot-hosts/v2

Scope Discover IoT: READ Produces application/json

PEP 8 query_iot_hosts_v2

Parameters

Name	Type	Data type	Description
filter	query	string	Filter assets using a FQL query. A complete list of available filters can be found in the Available FQL Filters section below.
limit	query	integer	The number of IoT asset IDs to return in this response (Max: 100, Default: 100). Use with the `offset` parameter to manage pagination of results.
offset	query	string	An offset used with the `limit` parameter to manage pagination of results. On your first request, don’t provide an `offset`. On subsequent requests, provide the `offset` from the previous response to continue from that place in the results.
parameters	query	dictionary	Full query string parameters payload in JSON format.
sort	query	string	Sort IoT assets by their properties. A single sort field is allowed. Common sort options include: `hostname\|asc`, `product_type_desc\|desc`

Available FQL Filters

Same filter set as query_iot_hosts.

Code Examples

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_iot_hosts_v2(filter="string",
                                     limit="string",
                                     offset="string",
                                     sort="string")
print(response)

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_iot_hostsV2(filter="string",
                                    limit="string",
                                    offset="string",
                                    sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("query_iot_hostsV2",
                          after="string",
                          limit=integer,
                          sort="string",
                          filter="string")
print(response)

Get-FalconAsset -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -IoT $boolean

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/discover_iot"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  after := "string"
  limit := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.DiscoverIot.QueryIotHostsV2(
    &discover_iot.QueryIotHostsV2Params{
      After: &after,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.discoverIot.queryIotHostsV2(
  "string",  // after
  integer,  // limit
  "string",  // sort
  "string"  // filter
);

console.log(response);

use rusty_falcon::apis::discover_iot_api::query_iot_hosts_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_iot_hosts_v2(
        &falcon.cfg,  // configuration
        Some("string"),  // after
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DiscoverIot.new

response = api.query_iot_hosts_v2(after: 'string',
                                  limit: integer,
                                  sort: 'string',
                                  filter: 'string')

puts response

Discover

Table of Contents

combined_applications

Parameters

Available filters

Code Examples

combined_hosts

Parameters

Available FQL Filters

Code Examples

get_accounts

Parameters

Code Examples

get_applications

Parameters

Code Examples

get_hosts

Parameters

Code Examples

get_iot_hosts

Parameters

Code Examples

get_logins

Parameters

Code Examples

query_accounts

Parameters

Available FQL Filters

Code Examples

query_applications

Parameters

Available filters

Code Examples

query_hosts

Parameters

Available FQL Filters

Code Examples

query_iot_hosts

Parameters

Available FQL Filters

Code Examples

query_logins

Parameters

Available FQL Filters

Code Examples

query_iot_hostsV2

Parameters

Available FQL Filters

Code Examples