Drift Indicators

The Drift Indicators service collection provides operations for monitoring and investigating container drift activity. Retrieve drift indicator counts by date, query total counts over time, search and read drift indicator entities by criteria, fetch entities by ID, and query for matching indicator IDs.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
GetDriftIndicatorsValuesByDate get_drift_indicators_by_date	Returns the count of Drift Indicators by the date. by default it’s for 7 days.
ReadDriftIndicatorEntities read_drift_indicator_entities	Retrieve Drift Indicator entities identified by the provided IDs
ReadDriftIndicatorsCount read_drift_indicator_counts	Returns the total count of Drift indicators over a time period
SearchAndReadDriftIndicatorEntities search_and_read_drift_indicators	Retrieve Drift Indicators by the provided search criteria
SearchDriftIndicators search_drift_indicators	Retrieve all drift indicators that match the given query

---

GetDriftIndicatorsValuesByDate

Returns the count of Drift Indicators by the date. by default it’s for 7 days.

Method GET

Route /container-security/aggregates/drift-indicators/count-by-date/v1

Scope Falcon Container Image: READ

PEP 8 get_drift_indicators_by_date

Parameters

filter query · string

Filter Drift Indicators using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (16)

cid	cloud_name	command_line
container_id	file_name	file_sha256
host_id	indicator_process_id	namespace
occurred_at	parent_process_id	pod_name
prevented	scheduler_name	severity
worker_node_name

limit query · integer

The upper-bound on the number of records to retrieve.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DriftIndicators

falcon = DriftIndicators(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_drift_indicators_by_date(filter="string", limit=integer)
print(response)

Operation ID

from falconpy import DriftIndicators

falcon = DriftIndicators(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.GetDriftIndicatorsValuesByDate(filter="string", limit=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetDriftIndicatorsValuesByDate",
                          filter="string",
                          limit=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/drift_indicators"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)

  response, err := client.DriftIndicators.GetDriftIndicatorsValuesByDate(
    &drift_indicators.GetDriftIndicatorsValuesByDateParams{
      Filter: &filter,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.driftIndicators.getDriftIndicatorsValuesByDate(
  "string",  // filter
  integer  // limit
);

console.log(response);

Rust

use rusty_falcon::apis::drift_indicators_api::get_drift_indicators_values_by_date;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_drift_indicators_values_by_date(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DriftIndicators.new

response = api.get_drift_indicators_values_by_date(filter: 'string',
                                                   limit: integer)

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "name": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadDriftIndicatorEntities

Retrieve Drift Indicator entities identified by the provided IDs

Method GET

Route /container-security/entities/drift-indicators/v1

Scope Falcon Container Image: READ

PEP 8 read_drift_indicator_entities

Parameters

ids query · string or list of strings

Search Drift Indicators by ids - The maximum amount is 100 IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DriftIndicators

falcon = DriftIndicators(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.read_drift_indicator_entities(ids=id_list)
print(response)

Operation ID

from falconpy import DriftIndicators

falcon = DriftIndicators(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ReadDriftIndicatorEntities(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ReadDriftIndicatorEntities",
                          ids=id_list)
print(response)

PowerShell

Get-FalconContainerDriftIndicator -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/drift_indicators"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DriftIndicators.ReadDriftIndicatorEntities(
    &drift_indicators.ReadDriftIndicatorEntitiesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.driftIndicators.readDriftIndicatorEntities(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::drift_indicators_api::read_drift_indicator_entities;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_drift_indicator_entities(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DriftIndicators.new

response = api.read_drift_indicator_entities(ids: ['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "agent_id": "string",
    "aid": "string",
    "cid": "string",
    "cloud_name": "string",
    "command_line": "string",
    "computer_name": "string",
    "container_id": "string",
    "detection_description": "string",
    "detection_id": "string",
    "detection_name": "string",
    "file_name": "string",
    "host_id": "string",
    "indicator_process_id": "string",
    "namespace": "string",
    "occurred_at": "string",
    "parent_process_id": "string",
    "pod_id": "string",
    "pod_name": "string",
    "prevented": false,
    "prevention_status": [],
    "prevention_status_string": "string",
    "scheduler_name": "string",
    "severity": "string",
    "sha256": "string",
    "timestamp": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadDriftIndicatorsCount

Returns the total count of Drift indicators over a time period

Method GET

Route /container-security/aggregates/drift-indicators/count/v1

Scope Falcon Container Image: READ

PEP 8 read_drift_indicator_counts

Parameters

filter query · string

Filter Drift Indicators using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (16)

cid	cloud_name	command_line
container_id	file_name	file_sha256
host_id	indicator_process_id	namespace
occurred_at	parent_process_id	pod_name
prevented	scheduler_name	severity
worker_node_name

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DriftIndicators

falcon = DriftIndicators(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.read_drift_indicator_counts(filter="string")
print(response)

Operation ID

from falconpy import DriftIndicators

falcon = DriftIndicators(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.ReadDriftIndicatorsCount(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadDriftIndicatorsCount",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/drift_indicators"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.DriftIndicators.ReadDriftIndicatorsCount(
    &drift_indicators.ReadDriftIndicatorsCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.driftIndicators.readDriftIndicatorsCount("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::drift_indicators_api::read_drift_indicators_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_drift_indicators_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DriftIndicators.new

response = api.read_drift_indicators_count(filter: 'string')

puts response

Responses

200 OK

[
  {
    "count": 0,
    "label": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

SearchAndReadDriftIndicatorEntities

Retrieve Drift Indicators by the provided search criteria

Method GET

Route /container-security/combined/drift-indicators/v1

Scope Falcon Container Image: READ

PEP 8 search_and_read_drift_indicators

Parameters

filter query · string

Filter Drift Indicators using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (16)

cid	cloud_name	command_line
container_id	file_name	file_sha256
host_id	indicator_process_id	namespace
occurred_at	parent_process_id	pod_name
prevented	scheduler_name	severity
worker_node_name

sort query · string

The fields to sort the records on.

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 100.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DriftIndicators

falcon = DriftIndicators(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.search_and_read_drift_indicators(filter="string",
                                                   limit=integer,
                                                   offset=integer,
                                                   sort="string")
print(response)

Operation ID

from falconpy import DriftIndicators

falcon = DriftIndicators(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.SearchAndReadDriftIndicatorEntities(filter="string",
                                                      limit=integer,
                                                      offset=integer,
                                                      sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("SearchAndReadDriftIndicatorEntities",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconContainerDriftIndicator -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/drift_indicators"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.DriftIndicators.SearchAndReadDriftIndicatorEntities(
    &drift_indicators.SearchAndReadDriftIndicatorEntitiesParams{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.driftIndicators.searchAndReadDriftIndicatorEntities(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::drift_indicators_api::search_and_read_drift_indicator_entities;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = search_and_read_drift_indicator_entities(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DriftIndicators.new

response = api.search_and_read_drift_indicator_entities(filter: 'string',
                                                        sort: 'string',
                                                        limit: integer,
                                                        offset: integer)

puts response

Responses

200 OK

[
  {
    "agent_id": "string",
    "aid": "string",
    "cid": "string",
    "cloud_name": "string",
    "command_line": "string",
    "computer_name": "string",
    "container_id": "string",
    "detection_description": "string",
    "detection_id": "string",
    "detection_name": "string",
    "file_name": "string",
    "host_id": "string",
    "indicator_process_id": "string",
    "namespace": "string",
    "occurred_at": "string",
    "parent_process_id": "string",
    "pod_id": "string",
    "pod_name": "string",
    "prevented": false,
    "prevention_status": [],
    "prevention_status_string": "string",
    "scheduler_name": "string",
    "severity": "string",
    "sha256": "string",
    "timestamp": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

SearchDriftIndicators

Retrieve all drift indicators that match the given query

Method GET

Route /container-security/queries/drift-indicators/v1

Scope Falcon Container Image: READ

PEP 8 search_drift_indicators

Parameters

filter query · string

Filter Drift Indicators using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (16)

cid	cloud_name	command_line
container_id	file_name	file_sha256
host_id	indicator_process_id	namespace
occurred_at	parent_process_id	pod_name
prevented	scheduler_name	severity
worker_node_name

sort query · string

The fields to sort the records on.

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 100.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import DriftIndicators

falcon = DriftIndicators(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.search_drift_indicators(filter="string",
                                          limit=integer,
                                          offset=integer,
                                          sort="string")
print(response)

Operation ID

from falconpy import DriftIndicators

falcon = DriftIndicators(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.SearchDriftIndicators(filter="string",
                                        limit=integer,
                                        offset=integer,
                                        sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("SearchDriftIndicators",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconContainerDriftIndicator -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/drift_indicators"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.DriftIndicators.SearchDriftIndicators(
    &drift_indicators.SearchDriftIndicatorsParams{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.driftIndicators.searchDriftIndicators(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::drift_indicators_api::search_drift_indicators;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = search_drift_indicators(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DriftIndicators.new

response = api.search_drift_indicators(filter: 'string',
                                       sort: 'string',
                                       limit: integer,
                                       offset: integer)

puts response

Responses

200 OK

[
  "string"
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}