Drift Indicators

The Drift Indicators service collection provides operations for monitoring and investigating container drift activity. Retrieve drift indicator counts by date, query total counts over time, search and read drift indicator entities by criteria, fetch entities by ID, and query for matching indicator IDs.

Language	Last Update
Python	v1.4.2
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

Operation	Description
GetDriftIndicatorsValuesByDate `get_drift_indicators_by_date`	Returns the count of Drift Indicators by the date. by default it’s for 7 days.
ReadDriftIndicatorsCount `read_drift_indicator_counts`	Returns the total count of Drift indicators over a time period
SearchAndReadDriftIndicatorEntities `search_and_read_drift_indicators`	Retrieve Drift Indicators by the provided search criteria
ReadDriftIndicatorEntities `read_drift_indicator_entities`	Retrieve Drift Indicator entities identified by the provided IDs
SearchDriftIndicators `search_drift_indicators`	Retrieve all drift indicators that match the given query

GetDriftIndicatorsValuesByDate

Returns the count of Drift Indicators by the date. by default it’s for 7 days.

GET /container-security/aggregates/drift-indicators/count-by-date/v1

Scope Drift Indicators: READ Consumes · Produces application/json

PEP 8 get_drift_indicators_by_date

Parameters

Name	Type	Data type	Description
filter	query	string	Filter drift indicators using a query in Falcon Query Language (FQL). Supported filters: cid,cloud_name,command_line,container_id,file_name,file_sha256,host_id,indicator_process_id,namespace,occurred_at,parent_process_id,pod_name,prevented,scheduler_name,severity,worker_node_name
limit	query	integer	The upper-bound on the number of records to retrieve.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import DriftIndicators

falcon = DriftIndicators(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_drift_indicators_by_date(filter="string", limit=integer)
print(response)

from falconpy import DriftIndicators

falcon = DriftIndicators(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.GetDriftIndicatorsValuesByDate(filter="string", limit=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetDriftIndicatorsValuesByDate",
                          filter="string",
                          limit=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/drift_indicators"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)

  response, err := client.DriftIndicators.GetDriftIndicatorsValuesByDate(
    &drift_indicators.GetDriftIndicatorsValuesByDateParams{
      Filter: &filter,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.driftIndicators.getDriftIndicatorsValuesByDate(
  "string",  // filter
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::drift_indicators_api::get_drift_indicators_values_by_date;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_drift_indicators_values_by_date(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DriftIndicators.new

response = api.get_drift_indicators_values_by_date(filter: 'string',
                                                   limit: integer)

puts response

ReadDriftIndicatorsCount

Returns the total count of Drift indicators over a time period

GET /container-security/aggregates/drift-indicators/count/v1

Scope Drift Indicators: READ Consumes · Produces application/json

PEP 8 read_drift_indicator_counts

Parameters

Name	Type	Data type	Description
filter	query	string	Filter images using a query in Falcon Query Language (FQL). Supported filters: cid,cloud_name,command_line,container_id,file_name,file_sha256,host_id,indicator_process_id,namespace,occurred_at,parent_process_id,pod_name,prevented,scheduler_name,severity,worker_node_name
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import DriftIndicators

falcon = DriftIndicators(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.read_drift_indicator_counts(filter="string")
print(response)

from falconpy import DriftIndicators

falcon = DriftIndicators(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.ReadDriftIndicatorsCount(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadDriftIndicatorsCount",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/drift_indicators"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.DriftIndicators.ReadDriftIndicatorsCount(
    &drift_indicators.ReadDriftIndicatorsCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.driftIndicators.readDriftIndicatorsCount("string");  // filter

console.log(response);

use rusty_falcon::apis::drift_indicators_api::read_drift_indicators_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_drift_indicators_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DriftIndicators.new

response = api.read_drift_indicators_count(filter: 'string')

puts response

SearchAndReadDriftIndicatorEntities

Retrieve Drift Indicators by the provided search criteria

GET /container-security/combined/drift-indicators/v1

Scope Drift Indicators: READ Consumes · Produces application/json

PEP 8 search_and_read_drift_indicators

Parameters

Name	Type	Data type	Description
filter	query	string	Filter Drift Indicators using a query in Falcon Query Language (FQL). Supported filters: cid, cloud_name, command_line, container_id, file_name, file_sha256, host_id, indicator_process_id, namespace, occurred_at, parent_process_id, pod_name, prevented, scheduler_name, severity, worker_node_name
limit	query	integer	The upper-bound on the number of records to retrieve.
offset	query	integer	The offset from where to begin.
parameters	query	dictionary	Full query string parameters payload in JSON format.
sort	query	string	The fields to sort the records on.

Code Examples

from falconpy import DriftIndicators

falcon = DriftIndicators(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.search_and_read_drift_indicators(filter="string",
                                                   limit=integer,
                                                   offset=integer,
                                                   sort="string")
print(response)

from falconpy import DriftIndicators

falcon = DriftIndicators(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.SearchAndReadDriftIndicatorEntities(filter="string",
                                                      limit=integer,
                                                      offset=integer,
                                                      sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("SearchAndReadDriftIndicatorEntities",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

Get-FalconContainerDriftIndicator -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/drift_indicators"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.DriftIndicators.SearchAndReadDriftIndicatorEntities(
    &drift_indicators.SearchAndReadDriftIndicatorEntitiesParams{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.driftIndicators.searchAndReadDriftIndicatorEntities(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::drift_indicators_api::search_and_read_drift_indicator_entities;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = search_and_read_drift_indicator_entities(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DriftIndicators.new

response = api.search_and_read_drift_indicator_entities(filter: 'string',
                                                        sort: 'string',
                                                        limit: integer,
                                                        offset: integer)

puts response

ReadDriftIndicatorEntities

Retrieve Drift Indicator entities identified by the provided IDs

GET /container-security/entities/drift-indicators/v1

Consumes · Produces application/json

PEP 8 read_drift_indicator_entities

Parameters

Name	Type	Data type	Description
ids	query	array (string)	Search Drift Indicators by ids - The maximum amount is 100 IDs
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import DriftIndicators

falcon = DriftIndicators(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.read_drift_indicator_entities(ids=id_list)
print(response)

from falconpy import DriftIndicators

falcon = DriftIndicators(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ReadDriftIndicatorEntities(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ReadDriftIndicatorEntities",
                          ids=id_list)
print(response)

Get-FalconContainerDriftIndicator -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/drift_indicators"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DriftIndicators.ReadDriftIndicatorEntities(
    &drift_indicators.ReadDriftIndicatorEntitiesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.driftIndicators.readDriftIndicatorEntities(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::drift_indicators_api::read_drift_indicator_entities;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_drift_indicator_entities(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DriftIndicators.new

response = api.read_drift_indicator_entities(ids: ['ID1', 'ID2', 'ID3'])

puts response

SearchDriftIndicators

Retrieve all drift indicators that match the given query

GET /container-security/queries/drift-indicators/v1

Scope Drift Indicators: READ Consumes · Produces application/json

PEP 8 search_drift_indicators

Parameters

Name	Type	Data type	Description
filter	query	string	Filter Drift Indicators using a query in Falcon Query Language (FQL). Supported filters: cid, cloud_name, command_line, container_id, file_name, file_sha256, host_id, indicator_process_id, namespace, occurred_at, parent_process_id, pod_name, prevented, scheduler_name, severity, worker_node_name
limit	query	integer	The upper-bound on the number of records to retrieve.
offset	query	integer	The offset from where to begin.
parameters	query	dictionary	Full query string parameters payload in JSON format.
sort	query	string	The fields to sort the records on.

Code Examples

from falconpy import DriftIndicators

falcon = DriftIndicators(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.search_drift_indicators(filter="string",
                                          limit=integer,
                                          offset=integer,
                                          sort="string")
print(response)

from falconpy import DriftIndicators

falcon = DriftIndicators(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.SearchDriftIndicators(filter="string",
                                        limit=integer,
                                        offset=integer,
                                        sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("SearchDriftIndicators",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

Get-FalconContainerDriftIndicator -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/drift_indicators"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.DriftIndicators.SearchDriftIndicators(
    &drift_indicators.SearchDriftIndicatorsParams{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.driftIndicators.searchDriftIndicators(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::drift_indicators_api::search_drift_indicators;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = search_drift_indicators(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DriftIndicators.new

response = api.search_drift_indicators(filter: 'string',
                                       sort: 'string',
                                       limit: integer,
                                       offset: integer)

puts response

Drift Indicators

Table of Contents

GetDriftIndicatorsValuesByDate

Parameters

Code Examples

ReadDriftIndicatorsCount

Parameters

Code Examples

SearchAndReadDriftIndicatorEntities

Parameters

Code Examples

ReadDriftIndicatorEntities

Parameters

Code Examples

SearchDriftIndicators

Parameters

Code Examples