Discover

The Discover service collection provides operations for searching and retrieving asset data across your environment. Search and retrieve details for applications, hosts, IoT hosts, accounts, and logins using FQL filters.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

This service collection has code examples posted to the repository.

---

---

Table of Contents

Operation	Description
combined-applications query_combined_applications	Search for applications in your environment by providing an FQL filter and paging details.
combined-hosts query_combined_hosts	Search for assets in your environment by providing an FQL (Falcon Query Language) filter and paging details.
get-accounts get_accounts	Get details on accounts by providing one or more IDs.
get-applications get_applications	Get details on applications by providing one or more IDs.
get-hosts get_hosts	Get details on assets by providing one or more IDs.
get-iot-hosts get_iot_hosts	Get details on IoT assets by providing one or more IDs.
get-logins get_logins	Get details on logins by providing one or more IDs.
query-accounts query_accounts	Search for accounts in your environment by providing an FQL (Falcon Query Language) filter and paging details.
query-applications query_applications	Search for applications in your environment by providing an FQL filter and paging details. returns a set of application IDs which match the filter criteria.
query-hosts query_hosts	Search for assets in your environment by providing an FQL (Falcon Query Language) filter and paging details.
query-iot-hosts query_iot_hosts	Search for IoT assets in your environment by providing an FQL (Falcon Query Language) filter and paging details.
query-iot-hostsV2 query_iot_hosts_v2	Search for IoT assets in your environment by providing an FQL (Falcon Query Language) filter and paging details.
query-logins query_logins	Search for logins in your environment by providing an FQL (Falcon Query Language) filter and paging details.

---

combined-applications

Search for applications in your environment by providing an FQL filter and paging details.

Method GET

Route /discover/combined/applications/v1

Scope Assets: READ

PEP 8 query_combined_applications

Parameters

after query · string

A pagination token used with the limit parameter to manage pagination of results. On your first request, don’t provide an after token. On subsequent requests, provide the after token from the previous response to continue from that place in the results.

limit query · integer

The number of application ids to return in this response (Min: 1, Max: 1000, Default: 100). Use with the after parameter to manage pagination of results.

sort query · string

Sort accounts by their properties. A single sort field is allowed.

filter query · string

Search for applications in your environment by providing an FQL filter. Available filter fields that support exact match:

Available values (70)

name	version	vendor
name_vendor	name_vendor_version	first_seen_timestamp
installation_timestamp	architectures	installation_paths
versioning_scheme	groups	is_normalized
last_used_user_sid	last_used_user_name	last_used_file_name
last_used_file_hash	last_used_timestamp	last_updated_timestamp
is_suspicious	category	host.id
host.platform_name	host.hostname	cid
host.os_version	host.machine_domain	host.ou
host.site_name	host.country	host.current_mac_address
host.current_network_prefix	host.tags	host.groups
host.product_type_desc	host.kernel_version	host.system_manufacturer
host.internet_exposure	host.agent_version	host.external_ip
version	vendor	name_vendor
name_vendor_version	architectures	installation_paths
groups	last_used_user_sid	last_used_user_name
last_used_file_name	last_used_file_hash	host.platform_name
host.hostname	cid	host.os_version
host.machine_domain	host.ou	host.site_name
host.country	host.current_mac_address	host.current_network_prefix
host.tags	host.groups	host.product_type_desc
host.kernel_version	host.system_manufacturer	host.internet_exposure
host.agent_version	host.external_ip	installation_timestamp
last_used_timestamp

facet query · string or list of strings

Select various details blocks to be returned for each application entity. Supported values:

Available values (5)

browser_extension	host_info	install_usage
dev_package	ide_extension

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.query_combined_applications(after="string",
                                              facet=id_list,
                                              filter="string",
                                              limit=integer,
                                              sort="string")
print(response)

Operation ID

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.combined_applications(after="string",
                                        facet=id_list,
                                        filter="string",
                                        limit=integer,
                                        sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("combined_applications",
                          after="string",
                          limit=integer,
                          sort="string",
                          filter="string",
                          facet=id_list)
print(response)

PowerShell

Get-FalconAsset -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Application $boolean

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/discover"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  after := "string"
  limit := int64(0)
  sort := "string"

  response, err := client.Discover.CombinedApplications(
    &discover.CombinedApplicationsParams{
      After: &after,
      Limit: &limit,
      Sort: &sort,
      Filter: "string",
      Facet: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.discover.combinedApplications(
  "string",  // filter
  "string",  // after
  integer,  // limit
  "string",  // sort
  ["ID1", "ID2", "ID3"]  // facet
);

console.log(response);

Rust

use rusty_falcon::apis::discover_api::combined_applications;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = combined_applications(
        &falcon.cfg,  // configuration
        "string",  // filter
        Some("string"),  // after
        Some(integer),  // limit
        Some("string"),  // sort
        Some(vec!["string".to_string()]),  // facet
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Discover.new

response = api.combined_applications('string')

puts response

Responses

200 OK

[
  {
    "account_name": "string",
    "account_type": "string",
    "admin_privileges": "string",
    "architectures": [],
    "browser_extension": {},
    "category": "string",
    "cid": "string",
    "dev_package": {},
    "discovery_methods": [],
    "extension_id": "string",
    "first_seen_timestamp": "string",
    "groups": [],
    "homepage": "string",
    "host": {},
    "host_application": "string",
    "id": "string",
    "ide_extension": {},
    "installation_paths": [],
    "installation_timestamp": "string",
    "is_normalized": false,
    "is_suspicious": false,
    "last_published": "string",
    "last_updated_timestamp": "string",
    "last_used_file_hash": "string",
    "last_used_file_name": "string",
    "last_used_timestamp": "string",
    "last_used_user_name": "string",
    "last_used_user_sid": "string",
    "local_admin_privileges": "string",
    "name": "string",
    "name_vendor": "string",
    "name_vendor_version": "string",
    "software_type": "string",
    "store_listing": "string",
    "store_listing_status": "string",
    "suspicious_indicators": [],
    "vendor": "string",
    "version": "string",
    "versioning_scheme": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

combined-hosts

Search for assets in your environment by providing an FQL (Falcon Query Language) filter and paging details.

Method GET

Route /discover/combined/hosts/v1

Scope Assets: READ

PEP 8 query_combined_hosts

Parameters

after query · string

A pagination token used with the limit parameter to manage pagination of results. On your first request, don’t provide an after token. On subsequent requests, provide the after token from the previous response to continue from that place in the results.

limit query · integer

The number of asset IDs to return in this response (min: 1, max: 1000, default: 100). Use with the after parameter to manage pagination of results.

sort query · string

Sort assets by their properties. A single sort field is allowed.

filter query · string

Filter assets using a FQL query. A complete list of available filters can be found here.

facet query · string or list of strings

Select various details blocks to be returned for each host entity. Supported values:

Available values (3)

system_insights

third_party

risk_factors

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

offset body · string

An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide an offset. On subsequent requests, provide the offset from the previous response to continue from that place in the results.

Code Examples

Python

PEP 8

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.query_combined_hosts(facet=id_list,
                                       filter="string",
                                       limit=integer,
                                       offset="string",
                                       sort="string")
print(response)

Operation ID

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.combined_hosts(facet=id_list,
                                 filter="string",
                                 limit=integer,
                                 offset="string",
                                 sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("combined_hosts",
                          after="string",
                          limit=integer,
                          sort="string",
                          filter="string",
                          facet=id_list)
print(response)

PowerShell

Get-FalconAsset -Filter "string" `
  -Sort "string" `
  -Limit integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/discover"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  after := "string"
  limit := int64(0)
  sort := "string"

  response, err := client.Discover.CombinedHosts(
    &discover.CombinedHostsParams{
      After: &after,
      Limit: &limit,
      Sort: &sort,
      Filter: "string",
      Facet: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.discover.combinedHosts(
  "string",  // filter
  "string",  // after
  integer,  // limit
  "string",  // sort
  ["ID1", "ID2", "ID3"]  // facet
);

console.log(response);

Rust

use rusty_falcon::apis::discover_api::combined_hosts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = combined_hosts(
        &falcon.cfg,  // configuration
        "string",  // filter
        Some("string"),  // after
        Some(integer),  // limit
        Some("string"),  // sort
        Some(vec!["string".to_string()]),  // facet
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Discover.new

response = api.combined_hosts('string')

puts response

Responses

200 OK

[
  {
    "account_enabled": "string",
    "active_discovery": {},
    "ad_user_account_control": 0,
    "ad_virtual_server": "string",
    "agent_version": "string",
    "aid": "string",
    "all_subnets": [],
    "asset_roles": [],
    "assigned_to": "string",
    "available_disk_space": 0,
    "available_disk_space_pct": 0,
    "average_memory_usage": 0,
    "average_memory_usage_pct": 0,
    "average_processor_usage": 0,
    "bios_hashes_data": [],
    "bios_id": "string",
    "bios_manufacturer": "string",
    "bios_version": "string",
    "business_criticality": "string",
    "cid": "string",
    "city": "string",
    "claroty_id": "string",
    "classification": "string",
    "cloud_account_id": "string",
    "cloud_instance_id": "string",
    "cloud_provider": "string",
    "cloud_region": "string",
    "cloud_registered": false,
    "cloud_resource_id": "string",
    "composite_internet_exposure": "string",
    "computed_asset_roles": [],
    "computed_internet_exposure": "string",
    "computed_internet_exposure_external_ip": "string",
    "computed_internet_exposure_last_seen": "string",
    "confidence": 0,
    "country": "string",
    "cpu_manufacturer": "string",
    "cpu_processor_name": "string",
    "creation_timestamp": "string",
    "criticality": "string",
    "criticality_description": "string",
    "criticality_rule_id": "string",
    "criticality_timestamp": "string",
    "criticality_username": "string",
    "current_local_ip": "string",
    "current_network_prefix": "string",
    "data_providers": [],
    "data_providers_count": 0,
    "department": "string",
    "deployment_type": "string",
    "descriptions": [],
    "device_class": "string",
    "device_family": "string",
    "device_mode": "string",
    "device_slots": [],
    "device_type": "string",
    "discoverer_aids": [],
    "discoverer_count": 0,
    "discoverer_criticalities": [],
    "discoverer_hostnames": [],
    "discoverer_ics_collector_ids": [],
    "discoverer_platform_names": [],
    "discoverer_product_type_descs": [],
    "discoverer_tags": [],
    "discovering_by": [],
    "disk_sizes": [],
    "dragos_id": "string",
    "email": "string",
    "encrypted_drives": [],
    "encrypted_drives_count": 0,
    "encryption_status": "string",
    "entity_type": "string",
    "external_ip": "string",
    "field_metadata": {},
    "first_discoverer_aid": "string",
    "first_seen_timestamp": "string",
    "form_factor": "string",
    "fqdn": "string",
    "groups": [],
    "hostname": "string",
    "ics_id": "string",
    "id": "string",
    "imported_host_id": "string",
    "internet_exposure": "string",
    "internet_exposure_description": "string",
    "internet_exposure_timestamp": "string",
    "internet_exposure_username": "string",
    "iot_imported": {},
    "iot_tags": [],
    "kernel_version": "string",
    "last_authenticated_scan_date": "string",
    "last_discoverer_aid": "string",
    "last_discoverer_hostname": "string",
    "last_discoverer_ics_collector_id": "string",
    "last_seen_timestamp": "string",
    "last_unauthenticated_scan_date": "string",
    "linux_sensor_mode": "string",
    "local_ip_addresses": [],
    "local_ips_count": 0,
    "location": "string",
    "logical_core_count": 0,
    "mac_addresses": [],
    "machine_domain": "string",
    "managed_by": "string",
    "max_memory_usage": 0,
    "max_memory_usage_pct": 0,
    "max_processor_usage": 0,
    "memory_total": 0,
    "mount_storage_info": [],
    "multi_nic_ip_addresses": [],
    "network_id": "string",
    "network_interfaces": [],
    "network_scanned_ids": [],
    "nozomi_id": "string",
    "number_of_disk_drives": 0,
    "object_guid": "string",
    "object_sid": "string",
    "os_is_eol": "string",
    "os_security": {},
    "os_service_pack": "string",
    "os_version": "string",
    "ot_information_sources": [],
    "ot_network_ids": [],
    "ot_platform": "string",
    "ot_platform_version": "string",
    "ot_serial_numbers": [],
    "ou": "string",
    "ous": [],
    "override_asset_roles": false,
    "override_criticality_rules": false,
    "override_internet_exposure": false,
    "owned_by": "string",
    "physical_core_count": 0,
    "platform_name": "string",
    "processor_package_count": 0,
    "product_type": "string",
    "product_type_desc": "string",
    "protocols": [],
    "purdue_level": "string",
    "qualys_id": "string",
    "qualys_network_id": "string",
    "reduced_functionality_mode": "string",
    "scan_details": [],
    "servicenow_id": "string",
    "site_name": "string",
    "state": "string",
    "subnet": "string",
    "subnet_history": [],
    "system_manufacturer": "string",
    "system_product_name": "string",
    "system_serial_number": "string",
    "tags": [],
    "tenableio_id": "string",
    "total_bios_files": 0,
    "total_disk_space": 0,
    "total_memory": 0,
    "triage": {},
    "unencrypted_drives": [],
    "unencrypted_drives_count": 0,
    "used_disk_space": 0,
    "used_disk_space_pct": 0,
    "used_for": "string",
    "user_asset_roles": [],
    "user_internet_exposure": "string",
    "virtual_zone": "string",
    "vlan": [],
    "vulnerability_assessment_date": "string",
    "xdome_id": "string",
    "xiot_discoverer_hostnames": [],
    "xiot_discoverer_tags": [],
    "xiot_last_discoverer_hostname": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

get-accounts

Get details on accounts by providing one or more IDs.

Method GET

Route /discover/entities/accounts/v1

Scope Assets: READ

PEP 8 get_accounts

Parameters

ids query · string or list of strings

One or more account IDs (max: 100). Find account IDs with GET /discover/queries/accounts/v1

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_accounts(ids=id_list)
print(response)

Operation ID

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_accounts(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_accounts",
                          ids=id_list)
print(response)

PowerShell

Get-FalconAsset -Id @("ID1", "ID2") -Account $boolean

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/discover"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Discover.GetAccounts(
    &discover.GetAccountsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.discover.getAccounts(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::discover_api::get_accounts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_accounts(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Discover.new

response = api.get_accounts(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "account_name": "string",
    "account_type": "string",
    "admin_privileges": "string",
    "cid": "string",
    "first_seen_timestamp": "string",
    "id": "string",
    "last_failed_login_hostname": "string",
    "last_failed_login_timestamp": "string",
    "last_failed_login_type": "string",
    "last_successful_login_host_city": "string",
    "last_successful_login_host_country": "string",
    "last_successful_login_hostname": "string",
    "last_successful_login_remote_ip": "string",
    "last_successful_login_timestamp": "string",
    "last_successful_login_type": "string",
    "local_admin_privileges": "string",
    "login_domain": "string",
    "password_last_set_timestamp": "string",
    "user_sid": "string",
    "username": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

get-applications

Get details on applications by providing one or more IDs.

Method GET

Route /discover/entities/applications/v1

Scope Assets: READ

PEP 8 get_applications

Parameters

ids query · string or list of strings

The IDs of applications to retrieve. (Min: 1, Max: 100)

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_applications(ids=id_list)
print(response)

Operation ID

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_applications(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_applications",
                          ids=id_list)
print(response)

PowerShell

Get-FalconAsset -Id @("ID1", "ID2") -Application $boolean

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/discover"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Discover.GetApplications(
    &discover.GetApplicationsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.discover.getApplications(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::discover_api::get_applications;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_applications(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Discover.new

response = api.get_applications(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "account_name": "string",
    "account_type": "string",
    "admin_privileges": "string",
    "architectures": [],
    "browser_extension": {},
    "category": "string",
    "cid": "string",
    "dev_package": {},
    "discovery_methods": [],
    "extension_id": "string",
    "first_seen_timestamp": "string",
    "groups": [],
    "homepage": "string",
    "host": {},
    "host_application": "string",
    "id": "string",
    "ide_extension": {},
    "installation_paths": [],
    "installation_timestamp": "string",
    "is_normalized": false,
    "is_suspicious": false,
    "last_published": "string",
    "last_updated_timestamp": "string",
    "last_used_file_hash": "string",
    "last_used_file_name": "string",
    "last_used_timestamp": "string",
    "last_used_user_name": "string",
    "last_used_user_sid": "string",
    "local_admin_privileges": "string",
    "name": "string",
    "name_vendor": "string",
    "name_vendor_version": "string",
    "software_type": "string",
    "store_listing": "string",
    "store_listing_status": "string",
    "suspicious_indicators": [],
    "vendor": "string",
    "version": "string",
    "versioning_scheme": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

get-hosts

Get details on assets by providing one or more IDs.

Method GET

Route /discover/entities/hosts/v1

Scope Assets: READ

PEP 8 get_hosts

Parameters

ids query · string or list of strings

One or more asset IDs (max: 100). Find asset IDs with GET /discover/queries/hosts/v1

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_hosts(ids=id_list)
print(response)

Operation ID

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_hosts(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_hosts",
                          ids=id_list)
print(response)

PowerShell

Get-FalconAsset -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/discover"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Discover.GetHosts(
    &discover.GetHostsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.discover.getHosts(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::discover_api::get_hosts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_hosts(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Discover.new

response = api.get_hosts(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "account_enabled": "string",
    "active_discovery": {},
    "ad_user_account_control": 0,
    "ad_virtual_server": "string",
    "agent_version": "string",
    "aid": "string",
    "all_subnets": [],
    "asset_roles": [],
    "assigned_to": "string",
    "available_disk_space": 0,
    "available_disk_space_pct": 0,
    "average_memory_usage": 0,
    "average_memory_usage_pct": 0,
    "average_processor_usage": 0,
    "bios_hashes_data": [],
    "bios_id": "string",
    "bios_manufacturer": "string",
    "bios_version": "string",
    "business_criticality": "string",
    "cid": "string",
    "city": "string",
    "claroty_id": "string",
    "classification": "string",
    "cloud_account_id": "string",
    "cloud_instance_id": "string",
    "cloud_provider": "string",
    "cloud_region": "string",
    "cloud_registered": false,
    "cloud_resource_id": "string",
    "composite_internet_exposure": "string",
    "computed_asset_roles": [],
    "computed_internet_exposure": "string",
    "computed_internet_exposure_external_ip": "string",
    "computed_internet_exposure_last_seen": "string",
    "confidence": 0,
    "country": "string",
    "cpu_manufacturer": "string",
    "cpu_processor_name": "string",
    "creation_timestamp": "string",
    "criticality": "string",
    "criticality_description": "string",
    "criticality_rule_id": "string",
    "criticality_timestamp": "string",
    "criticality_username": "string",
    "current_local_ip": "string",
    "current_network_prefix": "string",
    "data_providers": [],
    "data_providers_count": 0,
    "department": "string",
    "deployment_type": "string",
    "descriptions": [],
    "device_class": "string",
    "device_family": "string",
    "device_mode": "string",
    "device_slots": [],
    "device_type": "string",
    "discoverer_aids": [],
    "discoverer_count": 0,
    "discoverer_criticalities": [],
    "discoverer_hostnames": [],
    "discoverer_ics_collector_ids": [],
    "discoverer_platform_names": [],
    "discoverer_product_type_descs": [],
    "discoverer_tags": [],
    "discovering_by": [],
    "disk_sizes": [],
    "dragos_id": "string",
    "email": "string",
    "encrypted_drives": [],
    "encrypted_drives_count": 0,
    "encryption_status": "string",
    "entity_type": "string",
    "external_ip": "string",
    "field_metadata": {},
    "first_discoverer_aid": "string",
    "first_seen_timestamp": "string",
    "form_factor": "string",
    "fqdn": "string",
    "groups": [],
    "hostname": "string",
    "ics_id": "string",
    "id": "string",
    "imported_host_id": "string",
    "internet_exposure": "string",
    "internet_exposure_description": "string",
    "internet_exposure_timestamp": "string",
    "internet_exposure_username": "string",
    "iot_imported": {},
    "iot_tags": [],
    "kernel_version": "string",
    "last_authenticated_scan_date": "string",
    "last_discoverer_aid": "string",
    "last_discoverer_hostname": "string",
    "last_discoverer_ics_collector_id": "string",
    "last_seen_timestamp": "string",
    "last_unauthenticated_scan_date": "string",
    "linux_sensor_mode": "string",
    "local_ip_addresses": [],
    "local_ips_count": 0,
    "location": "string",
    "logical_core_count": 0,
    "mac_addresses": [],
    "machine_domain": "string",
    "managed_by": "string",
    "max_memory_usage": 0,
    "max_memory_usage_pct": 0,
    "max_processor_usage": 0,
    "memory_total": 0,
    "mount_storage_info": [],
    "multi_nic_ip_addresses": [],
    "network_id": "string",
    "network_interfaces": [],
    "network_scanned_ids": [],
    "nozomi_id": "string",
    "number_of_disk_drives": 0,
    "object_guid": "string",
    "object_sid": "string",
    "os_is_eol": "string",
    "os_security": {},
    "os_service_pack": "string",
    "os_version": "string",
    "ot_information_sources": [],
    "ot_network_ids": [],
    "ot_platform": "string",
    "ot_platform_version": "string",
    "ot_serial_numbers": [],
    "ou": "string",
    "ous": [],
    "override_asset_roles": false,
    "override_criticality_rules": false,
    "override_internet_exposure": false,
    "owned_by": "string",
    "physical_core_count": 0,
    "platform_name": "string",
    "processor_package_count": 0,
    "product_type": "string",
    "product_type_desc": "string",
    "protocols": [],
    "purdue_level": "string",
    "qualys_id": "string",
    "qualys_network_id": "string",
    "reduced_functionality_mode": "string",
    "scan_details": [],
    "servicenow_id": "string",
    "site_name": "string",
    "state": "string",
    "subnet": "string",
    "subnet_history": [],
    "system_manufacturer": "string",
    "system_product_name": "string",
    "system_serial_number": "string",
    "tags": [],
    "tenableio_id": "string",
    "total_bios_files": 0,
    "total_disk_space": 0,
    "total_memory": 0,
    "triage": {},
    "unencrypted_drives": [],
    "unencrypted_drives_count": 0,
    "used_disk_space": 0,
    "used_disk_space_pct": 0,
    "used_for": "string",
    "user_asset_roles": [],
    "user_internet_exposure": "string",
    "virtual_zone": "string",
    "vlan": [],
    "vulnerability_assessment_date": "string",
    "xdome_id": "string",
    "xiot_discoverer_hostnames": [],
    "xiot_discoverer_tags": [],
    "xiot_last_discoverer_hostname": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

get-iot-hosts

Get details on IoT assets by providing one or more IDs.

Method GET

Route /discover/entities/iot-hosts/v1

Scope Falcon Discover IoT: READ

PEP 8 get_iot_hosts

Parameters

ids query · string or list of strings

One or more asset IDs (max: 100). Find asset IDs with GET /discover/queries/iot-hosts/v1

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_iot_hosts(ids=id_list)
print(response)

Operation ID

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_iot_hosts(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_iot_hosts",
                          ids=id_list)
print(response)

PowerShell

Get-FalconAsset -Id @("ID1", "ID2") -IoT $boolean

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/discover_iot"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DiscoverIot.GetIotHosts(
    &discover_iot.GetIotHostsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.discoverIot.getIotHosts(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::discover_iot_api::get_iot_hosts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_iot_hosts(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DiscoverIot.new

response = api.get_iot_hosts(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "account_enabled": "string",
    "ad_user_account_control": 0,
    "ad_virtual_server": "string",
    "agent_version": "string",
    "aid": "string",
    "all_subnets": [],
    "asset_roles": [],
    "assigned_to": "string",
    "available_disk_space": 0,
    "available_disk_space_pct": 0,
    "average_memory_usage": 0,
    "average_memory_usage_pct": 0,
    "average_processor_usage": 0,
    "bios_hashes_data": [],
    "bios_id": "string",
    "bios_manufacturer": "string",
    "bios_version": "string",
    "business_criticality": "string",
    "cid": "string",
    "city": "string",
    "claroty_id": "string",
    "classification": "string",
    "composite_internet_exposure": "string",
    "computed_asset_roles": [],
    "computed_internet_exposure": "string",
    "computed_internet_exposure_external_ip": "string",
    "computed_internet_exposure_last_seen": "string",
    "confidence": 0,
    "country": "string",
    "cpu_manufacturer": "string",
    "cpu_processor_name": "string",
    "creation_timestamp": "string",
    "criticality": "string",
    "criticality_description": "string",
    "criticality_rule_id": "string",
    "criticality_timestamp": "string",
    "criticality_username": "string",
    "current_local_ip": "string",
    "current_network_prefix": "string",
    "data_providers": [],
    "data_providers_count": 0,
    "department": "string",
    "deployment_type": "string",
    "descriptions": [],
    "device_class": "string",
    "device_family": "string",
    "device_mode": "string",
    "device_slots": [],
    "device_type": "string",
    "discoverer_aids": [],
    "discoverer_count": 0,
    "discoverer_criticalities": [],
    "discoverer_hostnames": [],
    "discoverer_ics_collector_ids": [],
    "discoverer_platform_names": [],
    "discoverer_product_type_descs": [],
    "discoverer_tags": [],
    "discovering_by": [],
    "disk_sizes": [],
    "dragos_id": "string",
    "email": "string",
    "encrypted_drives": [],
    "encrypted_drives_count": 0,
    "encryption_status": "string",
    "entity_type": "string",
    "external_ip": "string",
    "field_metadata": {},
    "first_discoverer_aid": "string",
    "first_seen_timestamp": "string",
    "form_factor": "string",
    "fqdn": "string",
    "groups": [],
    "hostname": "string",
    "ics_id": "string",
    "id": "string",
    "imported_host_id": "string",
    "internet_exposure": "string",
    "internet_exposure_description": "string",
    "internet_exposure_timestamp": "string",
    "internet_exposure_username": "string",
    "iot_imported": {},
    "iot_tags": [],
    "kernel_version": "string",
    "last_discoverer_aid": "string",
    "last_discoverer_hostname": "string",
    "last_discoverer_ics_collector_id": "string",
    "last_seen_timestamp": "string",
    "linux_sensor_mode": "string",
    "local_ip_addresses": [],
    "local_ips_count": 0,
    "location": "string",
    "logical_core_count": 0,
    "mac_addresses": [],
    "machine_domain": "string",
    "managed_by": "string",
    "max_memory_usage": 0,
    "max_memory_usage_pct": 0,
    "max_processor_usage": 0,
    "memory_total": 0,
    "mount_storage_info": [],
    "multi_nic_ip_addresses": [],
    "network_id": "string",
    "network_interfaces": [],
    "nozomi_id": "string",
    "number_of_disk_drives": 0,
    "object_guid": "string",
    "object_sid": "string",
    "os_is_eol": "string",
    "os_security": {},
    "os_service_pack": "string",
    "os_version": "string",
    "ot_information_sources": [],
    "ot_network_ids": [],
    "ot_platform": "string",
    "ot_platform_version": "string",
    "ot_serial_numbers": [],
    "ou": "string",
    "ous": [],
    "override_asset_roles": false,
    "override_criticality_rules": false,
    "override_internet_exposure": false,
    "owned_by": "string",
    "physical_core_count": 0,
    "platform_name": "string",
    "processor_package_count": 0,
    "product_type": "string",
    "product_type_desc": "string",
    "protocols": [],
    "purdue_level": "string",
    "reduced_functionality_mode": "string",
    "servicenow_id": "string",
    "site_name": "string",
    "state": "string",
    "subnet": "string",
    "subnet_history": [],
    "system_manufacturer": "string",
    "system_product_name": "string",
    "system_serial_number": "string",
    "tags": [],
    "total_bios_files": 0,
    "total_disk_space": 0,
    "total_memory": 0,
    "triage": {},
    "unencrypted_drives": [],
    "unencrypted_drives_count": 0,
    "used_disk_space": 0,
    "used_disk_space_pct": 0,
    "used_for": "string",
    "user_asset_roles": [],
    "user_internet_exposure": "string",
    "virtual_zone": "string",
    "vlan": [],
    "xdome_id": "string",
    "xiot_discoverer_hostnames": [],
    "xiot_discoverer_tags": [],
    "xiot_last_discoverer_hostname": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

get-logins

Get details on logins by providing one or more IDs.

Method GET

Route /discover/entities/logins/v1

Scope Assets: READ

PEP 8 get_logins

Parameters

ids query · string or list of strings

One or more login IDs (max: 100). Find login IDs with GET /discover/queries/logins/v1

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_logins(ids=id_list)
print(response)

Operation ID

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_logins(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_logins",
                          ids=id_list)
print(response)

PowerShell

Get-FalconAsset -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/discover"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Discover.GetLogins(
    &discover.GetLoginsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.discover.getLogins(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::discover_api::get_logins;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_logins(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Discover.new

response = api.get_logins(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "account_id": "string",
    "account_name": "string",
    "account_type": "string",
    "admin_privileges": "string",
    "aggregation_time_interval": "string",
    "aid": "string",
    "cid": "string",
    "failure_description": "string",
    "host_city": "string",
    "host_country": "string",
    "host_id": "string",
    "hostname": "string",
    "id": "string",
    "is_suspicious": false,
    "local_admin_privileges": "string",
    "local_ip": "string",
    "login_domain": "string",
    "login_event_count": 0,
    "login_status": "string",
    "login_timestamp": "string",
    "login_type": "string",
    "remote_ip": "string",
    "user_sid": "string",
    "username": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

query-accounts

Search for accounts in your environment by providing an FQL (Falcon Query Language) filter and paging details.

Method GET

Route /discover/queries/accounts/v1

Scope Assets: READ

PEP 8 query_accounts

Parameters

offset query · integer

An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide an offset. On subsequent requests, add previous offset with the previous limit to continue from that place in the results.

limit query · integer

The number of account IDs to return in this response (min: 1, max: 100, default: 100). Use with the offset parameter to manage pagination of results.

sort query · string

Sort accounts by their properties. A single sort field is allowed.

filter query · string

Filter accounts using a FQL query. A complete list of available filters can be found here.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_accounts(filter="string",
                                 limit=integer,
                                 offset=integer,
                                 sort="string")
print(response)

Operation ID

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_accounts(filter="string",
                                 limit=integer,
                                 offset=integer,
                                 sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("query_accounts",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string")
print(response)

PowerShell

Get-FalconAsset -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer `
  -Account $boolean

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/discover"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.Discover.QueryAccounts(
    &discover.QueryAccountsParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.discover.queryAccounts(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string"  // filter
);

console.log(response);

Rust

use rusty_falcon::apis::discover_api::query_accounts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_accounts(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Discover.new

response = api.query_accounts(offset: integer,
                              limit: integer,
                              sort: 'string',
                              filter: 'string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

query-applications

Search for applications in your environment by providing an FQL filter and paging details. returns a set of application IDs which match the filter criteria.

Method GET

Route /discover/queries/applications/v1

Scope Assets: READ

PEP 8 query_applications

Parameters

offset query · integer

An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide an offset. On subsequent requests, add previous offset with the previous limit to continue from that place in the results.

limit query · integer

The number of application ids to return in this response (Min: 1, Max: 100, Default: 100).

sort query · string

Sort accounts by their properties. A single sort field is allowed.

filter query · string

Search for applications in your environment by providing an FQL filter. Available filter fields that support exact match:

Available values (70)

name	version	vendor
name_vendor	name_vendor_version	first_seen_timestamp
installation_timestamp	architectures	installation_paths
versioning_scheme	groups	is_normalized
last_used_user_sid	last_used_user_name	last_used_file_name
last_used_file_hash	last_used_timestamp	last_updated_timestamp
is_suspicious	category	host.id
host.platform_name	host.hostname	cid
host.os_version	host.machine_domain	host.ou
host.site_name	host.country	host.current_mac_address
host.current_network_prefix	host.tags	host.groups
host.product_type_desc	host.kernel_version	host.system_manufacturer
host.internet_exposure	host.agent_version	host.external_ip
version	vendor	name_vendor
name_vendor_version	architectures	installation_paths
groups	last_used_user_sid	last_used_user_name
last_used_file_name	last_used_file_hash	host.platform_name
host.hostname	cid	host.os_version
host.machine_domain	host.ou	host.site_name
host.country	host.current_mac_address	host.current_network_prefix
host.tags	host.groups	host.product_type_desc
host.kernel_version	host.system_manufacturer	host.internet_exposure
host.agent_version	host.external_ip	installation_timestamp
last_used_timestamp

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_applications(filter="string",
                                     limit=integer,
                                     offset=integer,
                                     sort="string")
print(response)

Operation ID

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_applications(filter="string",
                                     limit=integer,
                                     offset=integer,
                                     sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("query_applications",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string")
print(response)

PowerShell

Get-FalconAsset -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer `
  -Application $boolean

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/discover"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.Discover.QueryApplications(
    &discover.QueryApplicationsParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.discover.queryApplications(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string"  // filter
);

console.log(response);

Rust

use rusty_falcon::apis::discover_api::query_applications;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_applications(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Discover.new

response = api.query_applications(offset: integer,
                                  limit: integer,
                                  sort: 'string',
                                  filter: 'string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

query-hosts

Search for assets in your environment by providing an FQL (Falcon Query Language) filter and paging details.

Method GET

Route /discover/queries/hosts/v1

Scope Assets: READ

PEP 8 query_hosts

Parameters

offset query · integer

An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide an offset. On subsequent requests, add previous offset with the previous limit to continue from that place in the results.

limit query · integer

The number of asset IDs to return in this response (min: 1, max: 100, default: 100). Use with the offset parameter to manage pagination of results.

sort query · string

Sort assets by their properties. A single sort field is allowed.

filter query · string

Filter assets using a FQL query. A complete list of available filters can be found here.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_hosts(filter="string",
                              limit=integer,
                              offset=integer,
                              sort="string")
print(response)

Operation ID

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_hosts(filter="string",
                              limit=integer,
                              offset=integer,
                              sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("query_hosts",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string")
print(response)

PowerShell

Get-FalconAsset -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/discover"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.Discover.QueryHosts(
    &discover.QueryHostsParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.discover.queryHosts(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string"  // filter
);

console.log(response);

Rust

use rusty_falcon::apis::discover_api::query_hosts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_hosts(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Discover.new

response = api.query_hosts(offset: integer,
                           limit: integer,
                           sort: 'string',
                           filter: 'string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

query-iot-hosts

Search for IoT assets in your environment by providing an FQL (Falcon Query Language) filter and paging details.

Method GET

Route /discover/queries/iot-hosts/v1

Scope Falcon Discover IoT: READ

PEP 8 query_iot_hosts

Parameters

offset query · integer

An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide an offset. On subsequent requests, add previous offset with the previous limit to continue from that place in the results.

limit query · integer

The number of asset IDs to return in this response (min: 1, max: 100, default: 100). Use with the offset parameter to manage pagination of results.

sort query · string

Sort IoT assets by their properties. A single sort field is allowed.

filter query · string

Filter assets using a FQL query. A complete list of available filters can be found here.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_iot_hosts(filter="string",
                                  limit=integer,
                                  offset=integer,
                                  sort="string")
print(response)

Operation ID

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_iot_hosts(filter="string",
                                  limit=integer,
                                  offset=integer,
                                  sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("query_iot_hosts",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/discover_iot"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.DiscoverIot.QueryIotHosts(
    &discover_iot.QueryIotHostsParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.discoverIot.queryIotHosts(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string"  // filter
);

console.log(response);

Rust

use rusty_falcon::apis::discover_iot_api::query_iot_hosts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_iot_hosts(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

Examples coming soon.

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

query-iot-hostsV2

Search for IoT assets in your environment by providing an FQL (Falcon Query Language) filter and paging details.

Method GET

Route /discover/queries/iot-hosts/v2

Scope Falcon Discover IoT: READ

PEP 8 query_iot_hosts_v2

Parameters

after query · string

A pagination token used with the limit parameter to manage pagination of results. On your first request, don’t provide an after token. On subsequent requests, provide the after token from the previous response to continue from that place in the results.

limit query · integer

The number of asset IDs to return in this response (min: 1, max: 100, default: 100). Use with the after parameter to manage pagination of results.

sort query · string

Sort IoT assets by their properties. A single sort field is allowed.

filter query · string

Filter assets using a FQL query. A complete list of available filters can be found here.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

offset body · string

An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide an offset. On subsequent requests, provide the offset from the previous response to continue from that place in the results.

Code Examples

Python

PEP 8

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_iot_hosts_v2(filter="string",
                                     limit=integer,
                                     offset="string",
                                     sort="string")
print(response)

Operation ID

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_iot_hostsV2(filter="string",
                                    limit=integer,
                                    offset="string",
                                    sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("query_iot_hostsV2",
                          after="string",
                          limit=integer,
                          sort="string",
                          filter="string")
print(response)

PowerShell

Get-FalconAsset -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -IoT $boolean

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/discover_iot"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  after := "string"
  limit := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.DiscoverIot.QueryIotHostsV2(
    &discover_iot.QueryIotHostsV2Params{
      After: &after,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.discoverIot.queryIotHostsV2(
  "string",  // after
  integer,  // limit
  "string",  // sort
  "string"  // filter
);

console.log(response);

Rust

use rusty_falcon::apis::discover_iot_api::query_iot_hosts_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_iot_hosts_v2(
        &falcon.cfg,  // configuration
        Some("string"),  // after
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

Examples coming soon.

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

query-logins

Search for logins in your environment by providing an FQL (Falcon Query Language) filter and paging details.

Method GET

Route /discover/queries/logins/v1

Scope Assets: READ

PEP 8 query_logins

Parameters

offset query · integer

An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide an offset. On subsequent requests, add previous offset with the previous limit to continue from that place in the results.

limit query · integer

The number of login IDs to return in this response (min: 1, max: 100, default: 100). Use with the offset parameter to manage pagination of results.

sort query · string

Sort logins by their properties. A single sort field is allowed.

filter query · string

Filter logins using a FQL query. A complete list of available filters can be found here.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_logins(filter="string",
                               limit=integer,
                               offset=integer,
                               sort="string")
print(response)

Operation ID

from falconpy import Discover

falcon = Discover(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.query_logins(filter="string",
                               limit=integer,
                               offset=integer,
                               sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("query_logins",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string")
print(response)

PowerShell

Get-FalconAsset -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/discover"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.Discover.QueryLogins(
    &discover.QueryLoginsParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.discover.queryLogins(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string"  // filter
);

console.log(response);

Rust

use rusty_falcon::apis::discover_api::query_logins;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_logins(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Discover.new

response = api.query_logins(offset: integer,
                            limit: integer,
                            sort: 'string',
                            filter: 'string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}