Skip to content
CrowdStrike Developer Center

Exposure Management

The Exposure Management service collection provides operations for managing external assets and ecosystem subsidiaries. Aggregate external asset data, retrieve and update assets, manage ecosystem subsidiaries, download asset blobs, and query assets using FQL filters.

LanguageLast Update
Pythonv1.6.5
PowerShellv2.2.9
Gov0.22.0
TypeScriptv0.6.0
Rustv0.7.1
Rubyv1.4.0

This service collection has code examples posted to the repository.

Table of Contents

Section titled “Table of Contents”
OperationDescription
aggregate-external-assets
aggregate_assets		Returns external assets aggregates.
blob-download-external-assets
download_assets		Download the entire contents of the blob.
blob-preview-external-assets
preview_assets		Download a preview of the blob.
combined-ecosystem-subsidiaries
query_combined_ecosystem_subsidiaries		Retrieves a list of ecosystem subsidiaries with their detailed information.
delete-external-assets
delete_assets		Delete multiple external assets.
get-ecosystem-subsidiaries
get_ecosystem_subsidiaries		Retrieves detailed information about ecosystem subsidiaries by ID.
get-external-assets
get_assets		Get details on external assets by providing one or more IDs.
patch-external-assets
update_assets		Update the details of external assets.
post-external-assets-inventory-v1
add_assets		Add external assets for external asset scanning.
query-ecosystem-subsidiaries
query_ecosystem_subsidiaries		Retrieves a list of IDs for ecosystem subsidiaries.
query-external-assets
query_assets		Get a list of external asset IDs that match the provided filter conditions.
query-external-assets-v2
query_assets		Get a list of external asset IDs that match the provided filter conditions.

aggregate-external-assets

Section titled “aggregate-external-assets”

Returns external assets aggregates.

Method POST
Route /fem/aggregates/external-assets/v1
Scope Assets: READ
PEP 8 aggregate_assets

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
If peforming a date range query specify the from and to date ranges. These can be in common date formats like 2019-07-18 or now.
exclude body · string
Fields to exclude.
extended_bounds body · object
field body · string
Term you want to aggregate on. If doing a date_range query, this is the date field you want to apply the date ranges to.
filter body · string
Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
filters_spec body · object
from body · integer
include body · string
Fields to include.
interval body · string
Available values (6)
yearmonthweek
dayhourminute
max_doc_count body · integer
Maximum number of documents.
min_doc_count body · integer
Minimum number of documents.
missing body · string
name body · string
Scan name.
percents body · array
q body · string
FQL syntax.
ranges body · array
size body · integer
sort body · string
FQL syntax.
Available values (2)
_count
sort by document count
_term
sort by the string value alphabetically
sub_aggregates body · array
time_zone body · string
type body · string
Available values (10)
date_histogram
Aggregates counts on a specified time interval. Requires use of “interval” field.
date_range
Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
terms
Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
range
Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.
cardinality
Returns the count of distinct values in a specified field.
max
Returns the maximum value of a specified field.
min
Returns the minimum value of a specified field.
avg
Returns the average value of the specified field.
sum
Returns the total sum of all values for the specified field.
percentiles
Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.
Code Examples
from falconpy import ExposureManagement


falcon = ExposureManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]


ranges = [
    {
        "From": 0,
        "To": 0
    }
]


response = falcon.aggregate_assets(date_ranges=date_ranges,
                                   exclude="string",
                                   field="string",
                                   filter="string",
                                   from=integer,
                                   include="string",
                                   interval="string",
                                   max_doc_count=integer,
                                   min_doc_count=integer,
                                   missing="string",
                                   name="string",
                                   q="string",
                                   ranges=ranges,
                                   size=integer,
                                   sort="string",
                                   sub_aggregates=["string"],
                                   time_zone="string",
                                   type="string")
print(response)
Responses
[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

blob-download-external-assets

Section titled “blob-download-external-assets”

Download the entire contents of the blob.

Method GET
Route /fem/entities/blobs-download/v1
Scope Assets: READ
PEP 8 download_assets

Parameters

Section titled “Parameters”
assetId query · string
The Asset ID
hash query · string
The File Hash
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import ExposureManagement


falcon = ExposureManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


with open("output_file", "wb") as save_file:
    response = falcon.download_assets(assetId="string",
                                      hash="string",
                                      stream=boolean)
    save_file.write(response)
Responses
{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

blob-preview-external-assets

Section titled “blob-preview-external-assets”

Download a preview of the blob.

Method GET
Route /fem/entities/blobs-preview/v1
Scope Assets: READ
PEP 8 preview_assets

Parameters

Section titled “Parameters”
assetId query · string
The Asset ID
hash query · string
The File Hash
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import ExposureManagement


falcon = ExposureManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


response = falcon.preview_assets(assetId="string", hash="string")
print(response)
Responses
[
  "string"
]

combined-ecosystem-subsidiaries

Section titled “combined-ecosystem-subsidiaries”

Retrieves a list of ecosystem subsidiaries with their detailed information.

Method GET
Route /fem/combined/ecosystem-subsidiaries/v1
Scope Assets: READ
PEP 8 query_combined_ecosystem_subsidiaries

Parameters

Section titled “Parameters”
offset query · integer
Starting index of result set from which to return subsidiaries
limit query · integer
The maximum number of subsidiaries to return in the response.
filter query · string
Filter ecosystem subsidiaries
sort query · string
desc”).
version_id query · string
The version ID of the ecosystem subsidiaries data, represented as a hash string. This parameter is required to ensure data consistency and prevent stale data. If a new version of the ecosystem subsidiaries data is written, the version ID will be updated. By including this parameter in the request, the client can ensure that the response will be invalidated if a new version is written.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import ExposureManagement


falcon = ExposureManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


response = falcon.query_combined_ecosystem_subsidiaries(offset=integer,
                                                        limit=integer,
                                                        sort="string",
                                                        filter="string",
                                                        version_id="string")
print(response)
Responses
[
  {
    "asset_count": 0,
    "children_count": 0,
    "cid": "string",
    "discovery": {},
    "id": "string",
    "name": "string",
    "parent_id": "string",
    "primary_domain": "string",
    "risk_score": 0.0
  }
]

delete-external-assets

Section titled “delete-external-assets”

Delete multiple external assets.

Method DELETE
Route /fem/entities/external-assets/v1
Scope Assets: WRITE
PEP 8 delete_assets

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
description body · string
Some description that the user attached to the delete
ids query · string or list of strings
One or more asset IDs (max: 100).
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import ExposureManagement


falcon = ExposureManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.delete_assets(description="string", ids=id_list)
print(response)
Responses
[
  "string"
]

get-ecosystem-subsidiaries

Section titled “get-ecosystem-subsidiaries”

Retrieves detailed information about ecosystem subsidiaries by ID.

Method GET
Route /fem/entities/ecosystem-subsidiaries/v1
Scope Assets: READ
PEP 8 get_ecosystem_subsidiaries

Parameters

Section titled “Parameters”
ids query · string or list of strings
One or more asset IDs (max: 100). Find ecosystem subsidiary IDs with GET /fem/entities/ecosystem-subsidiaries/v1
version_id query · string
The version ID of the ecosystem subsidiaries data, represented as a hash string. This parameter is required to ensure data consistency and prevent stale data. If a new version of the ecosystem subsidiaries data is written, the version ID will be updated. By including this parameter in the request, the client can ensure that the response will be invalidated if a new version is written.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import ExposureManagement


falcon = ExposureManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_ecosystem_subsidiaries(ids=id_list, version_id="string")
print(response)
Responses
[
  {
    "asset_count": 0,
    "children_count": 0,
    "cid": "string",
    "discovery": {},
    "id": "string",
    "name": "string",
    "parent_id": "string",
    "primary_domain": "string",
    "risk_score": 0.0
  }
]

get-external-assets

Section titled “get-external-assets”

Get details on external assets by providing one or more IDs.

Method GET
Route /fem/entities/external-assets/v1
Scope Assets: READ
PEP 8 get_assets

Parameters

Section titled “Parameters”
ids query · string or list of strings
One or more asset IDs (max: 100). Find asset IDs with GET /fem/queries/external-assets/v1
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import ExposureManagement


falcon = ExposureManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_assets(ids=id_list)
print(response)
Responses
[
  {
    "applicable_actions": [],
    "asset_type": "string",
    "cid": "string",
    "confidence": 0,
    "criticality": "string",
    "criticality_description": "string",
    "criticality_timestamp": "string",
    "criticality_username": "string",
    "data_providers": [],
    "discovered_by": "string",
    "discovery": {},
    "dns_domain": {},
    "entity_type": "string",
    "first_seen": "string",
    "id": "string",
    "internet_exposure": "string",
    "ip": {},
    "last_seen": "string",
    "manual": false,
    "perimeter": "string",
    "status": "string",
    "subsidiaries": [],
    "triage": {}
  }
]

patch-external-assets

Section titled “patch-external-assets”

Update the details of external assets.

Method PATCH
Route /fem/entities/external-assets/v1
Scope Assets: WRITE
PEP 8 update_assets

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
assets body · array
List of asset patches
action body · string
The asset triage action.
assigned_to body · string
The user assigned to triage the asset.
cid body · string
Falcon Customer ID.
criticality body · string
The criticality level manually assigned to this asset.
criticality_description body · string
The criticality description assigned to this asset.
description body · string
The asset triage description.
id body · string
The unique ID of the asset.
status body · string
The asset trriage status.
Code Examples
from falconpy import ExposureManagement


falcon = ExposureManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


response = falcon.update_assets(action="string",
                                assigned_to="string",
                                cid="string",
                                criticality="string",
                                criticality_description="string",
                                description="string",
                                id="string",
                                status="string")
print(response)
Responses
[
  {
    "applicable_actions": [],
    "asset_type": "string",
    "cid": "string",
    "confidence": 0,
    "criticality": "string",
    "criticality_description": "string",
    "criticality_timestamp": "string",
    "criticality_username": "string",
    "data_providers": [],
    "discovered_by": "string",
    "discovery": {},
    "dns_domain": {},
    "entity_type": "string",
    "first_seen": "string",
    "id": "string",
    "internet_exposure": "string",
    "ip": {},
    "last_seen": "string",
    "manual": false,
    "perimeter": "string",
    "status": "string",
    "subsidiaries": [],
    "triage": {}
  }
]

post-external-assets-inventory-v1

Section titled “post-external-assets-inventory-v1”

Add external assets for external asset scanning.

Method POST
Route /fem/entities/external-asset-inventory/v1
Scope Assets: WRITE
PEP 8 add_assets

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
data body · array
Data is the list of assets to be added
assets body · list of dictionaries
List of assets to be added.
id body · string
Asset ID to be added.
subsidiary_id body · string
Subsidiary ID of the asset to be added.
value body · string
Asset value.
Code Examples
from falconpy import ExposureManagement


falcon = ExposureManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


assets = [
    {
        "id": "string",
        "value": "string"
    }
]


response = falcon.add_assets(assets=assets,
                             id="string",
                             subsidiary_id="string",
                             value="string")
print(response)
Responses
[
  {
    "asset_type": "string",
    "current_subsidiary": {},
    "error": {},
    "id": "string",
    "index": 0,
    "raw_value": "string",
    "subsidiary": {},
    "value": "string"
  }
]

query-ecosystem-subsidiaries

Section titled “query-ecosystem-subsidiaries”

Retrieves a list of IDs for ecosystem subsidiaries.

Method GET
Route /fem/queries/ecosystem-subsidiaries/v1
Scope Assets: READ
PEP 8 query_ecosystem_subsidiaries

Parameters

Section titled “Parameters”
offset query · integer
Starting index of result set from which to return subsidiaries
limit query · integer
The maximum number of IDs to return in the response.
filter query · string
Filter ecosystem subsidiaries
sort query · string
desc”).
version_id query · string
The version ID of the ecosystem subsidiaries data, represented as a hash string. This parameter is required to ensure data consistency and prevent stale data. If a new version of the ecosystem subsidiaries data is written, the version ID will be updated. By including this parameter in the request, the client can ensure that the response will be invalidated if a new version is written.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import ExposureManagement


falcon = ExposureManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


response = falcon.query_ecosystem_subsidiaries(offset=integer,
                                               limit=integer,
                                               sort="string",
                                               filter="string",
                                               version_id="string")
print(response)
Responses
[
  "string"
]

query-external-assets

Section titled “query-external-assets”

Get a list of external asset IDs that match the provided filter conditions.

Method GET
Route /fem/queries/external-assets/v1
Scope Assets: READ
PEP 8 query_assets

Parameters

Section titled “Parameters”
offset query · string
Starting index of result set from which to return IDs.
limit query · integer
Number of IDs to return.
sort query · string
Order by fields.
filter query · string
Filter assets using an FQL query. Common filter options include: </br>Available filter fields that support exact match: asset_id, asset_type, confidence, connectivity_status, criticality, criticality_description, criticality_timestamp, criticality_username, data_providers, discovered_by, dns_domain.fqdn, dns_domain.isps, dns_domain.parent_domain, dns_domain.resolved_ips, dns_domain.services.applications.category, dns_domain.services.applications.cpe, dns_domain.services.applications.name, dns_domain.services.applications.vendor, dns_domain.services.applications.version, dns_domain.services.cloud_provider, dns_domain.services.cpes, dns_domain.services.hosting_provider, dns_domain.services.last_seen, dns_domain.services.platform_name, dns_domain.services.port, dns_domain.services.protocol, dns_domain.services.protocol_port, dns_domain.services.status, dns_domain.services.status_code, dns_domain.services.transport, dns_domain.type, first_seen, id, internet_exposure, ip.asn, ip.cloud_provider, ip.cloud_vm.description, ip.cloud_vm.instance_id, ip.cloud_vm.lifecycle, ip.cloud_vm.mac_address, ip.cloud_vm.owner_id, ip.cloud_vm.platform, ip.cloud_vm.private_ip, ip.cloud_vm.public_ip, ip.cloud_vm.region, ip.cloud_vm.security_groups, ip.cloud_vm.source, ip.cloud_vm.status, ip.fqdns, ip.ip_address, ip.isp, ip.location.area_code, ip.location.city, ip.location.country_code, ip.location.country_name, ip.location.postal_code, ip.location.region_code, ip.location.region_name, ip.location.timezone, ip.ptr, ip.aid, ip.services.applications.category, ip.services.applications.cpe, ip.services.applications.name, ip.services.applications.vendor, ip.services.applications.version, ip.services.cloud_provider, ip.services.cpes, ip.services.first_seen, ip.services.last_seen, ip.services.platform_name, ip.services.port, ip.services.protocol, ip.services.protocol_port, ip.services.status, ip.services.status_code, ip.services.transport, last_seen, manual, perimeter, subsidiaries.id, subsidiaries.name, triage.action, triage.assigned_to, triage.status, triage.updated_by, triage.updated_timestamp </br>Available filter fields that supports wildcard (*): asset_id, asset_type, confidence, connectivity_status, criticality, criticality_username, data_providers, discovered_by, dns_domain.fqdn, dns_domain.isps, dns_domain.parent_domain, dns_domain.resolved_ips, dns_domain.services.applications.category, dns_domain.services.applications.cpe, dns_domain.services.applications.name, dns_domain.services.applications.vendor, dns_domain.services.applications.version, dns_domain.services.cloud_provider, dns_domain.services.cpes, dns_domain.services.hosting_provider, dns_domain.services.id, dns_domain.services.platform_name, dns_domain.services.port, dns_domain.services.protocol, dns_domain.services.protocol_port, dns_domain.services.status, dns_domain.services.status_code, dns_domain.services.transport, dns_domain.type, id, internet_exposure, ip.asn, ip.cloud_vm.instance_id, ip.cloud_vm.lifecycle, ip.cloud_vm.mac_address, ip.cloud_vm.owner_id, ip.cloud_vm.platform, ip.cloud_vm.private_ip, ip.cloud_vm.public_ip, ip.cloud_vm.region, ip.cloud_vm.security_groups, ip.cloud_vm.source, ip.cloud_vm.status, ip.fqdns, ip.ip_address, ip.isp, ip.location.area_code, ip.location.city, ip.location.country_code, ip.location.country_name, ip.location.postal_code, ip.location.region_code, ip.location.region_name, ip.location.timezone, ip.ptr, ip.aid, ip.services.applications.category, ip.services.applications.cpe, ip.services.applications.name, ip.services.applications.vendor, ip.services.applications.version, ip.services.cloud_provider, ip.services.cpes, ip.services.platform_name, ip.services.port, ip.services.protocol, ip.services.protocol_port, ip.services.status, ip.services.status_code, ip.services.transport, manual, perimeter, subsidiaries.id, subsidiaries.name, triage.action, triage.assigned_to, triage.status, triage.updated_by </br>Available filter fields that supports in ([v1, v2]): asset_id, asset_type, confidence, connectivity_status, criticality, criticality_username, data_providers, discovered_by, dns_domain.fqdn, dns_domain.isps, dns_domain.parent_domain, dns_domain.services.applications.category, dns_domain.services.applications.cpe, dns_domain.services.applications.name, dns_domain.services.applications.vendor, dns_domain.services.applications.version, dns_domain.services.cloud_provider, dns_domain.services.cpes, dns_domain.services.id, dns_domain.services.platform_name, dns_domain.services.port, dns_domain.services.protocol, dns_domain.services.protocol_port, dns_domain.services.status, dns_domain.services.status_code, dns_domain.services.transport, dns_domain.type, id, internet_exposure, ip.asn, ip.cloud_vm.instance_id, ip.cloud_vm.lifecycle, ip.cloud_vm.mac_address, ip.cloud_vm.owner_id, ip.cloud_vm.platform, ip.cloud_vm.region, ip.cloud_vm.security_groups, ip.cloud_vm.source, ip.cloud_vm.status, ip.fqdns, ip.isp, ip.location.area_code, ip.location.city, ip.location.country_code, ip.location.country_name, ip.location.postal_code, ip.location.region_code, ip.location.region_name, ip.location.timezone, ip.ptr, ip.aid, ip.services.applications.category, ip.services.applications.cpe, ip.services.applications.name, ip.services.applications.vendor, ip.services.applications.version, ip.services.cloud_provider, ip.services.cpes, ip.services.platform_name, ip.services.port, ip.services.protocol, ip.services.protocol_port, ip.services.status, ip.services.status_code, ip.services.transport, manual, perimeter, subsidiaries.id, subsidiaries.name, triage.action, triage.assigned_to, triage.status, triage.updated_by </br>Available filter fields that supports range comparisons (>, <, >=, <=): criticality_timestamp, dns_domain.resolved_ips, dns_domain.services.first_seen, dns_domain.services.last_seen, dns_domain.services.port, dns_domain.services.status_code, first_seen, ip.cloud_vm.private_ip, ip.cloud_vm.public_ip, ip.ip_address, ip.services.first_seen, ip.services.last_seen, ip.services.port, ip.services.status_code, last_seen, triage.updated_timestamp </br>All filter fields and operations supports negation (!).
Available values (87)
asset_idasset_typeconfidence
connectivity_statuscriticalitycriticality_description
criticality_timestampcriticality_usernamedata_providers
discovered_bydns_domain.fqdndns_domain.isps
dns_domain.parent_domaindns_domain.resolved_ipsdns_domain.services.applications.category
dns_domain.services.applications.cpedns_domain.services.applications.namedns_domain.services.applications.vendor
dns_domain.services.applications.versiondns_domain.services.cloud_providerdns_domain.services.cpes
dns_domain.services.hosting_providerdns_domain.services.last_seendns_domain.services.platform_name
dns_domain.services.portdns_domain.services.protocoldns_domain.services.protocol_port
dns_domain.services.statusdns_domain.services.status_codedns_domain.services.transport
dns_domain.typefirst_seenid
internet_exposureip.asnip.cloud_provider
ip.cloud_vm.descriptionip.cloud_vm.instance_idip.cloud_vm.lifecycle
ip.cloud_vm.mac_addressip.cloud_vm.owner_idip.cloud_vm.platform
ip.cloud_vm.private_ipip.cloud_vm.public_ipip.cloud_vm.region
ip.cloud_vm.security_groupsip.cloud_vm.sourceip.cloud_vm.status
ip.fqdnsip.ip_addressip.isp
ip.location.area_codeip.location.cityip.location.country_code
ip.location.country_nameip.location.postal_codeip.location.region_code
ip.location.region_nameip.location.timezoneip.ptr
ip.aidip.services.applications.categoryip.services.applications.cpe
ip.services.applications.nameip.services.applications.vendorip.services.applications.version
ip.services.cloud_providerip.services.cpesip.services.first_seen
ip.services.last_seenip.services.platform_nameip.services.port
ip.services.protocolip.services.protocol_portip.services.status
ip.services.status_codeip.services.transportlast_seen
manualperimetersubsidiaries.id
subsidiaries.nametriage.actiontriage.assigned_to
triage.statustriage.updated_bytriage.updated_timestamp
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import ExposureManagement


falcon = ExposureManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


response = falcon.query_assets(offset=integer,
                               limit=integer,
                               sort="string",
                               filter="string")
print(response)
Responses
[
  "string"
]

query-external-assets-v2

Section titled “query-external-assets-v2”

Get a list of external asset IDs that match the provided filter conditions.

Method GET
Route /fem/queries/external-assets/v2
Scope Assets: READ
PEP 8 query_assets

Parameters

Section titled “Parameters”
after query · string
A pagination token used with the limit parameter to manage pagination of results. On your first request, don’t provide an after token. On subsequent requests, provide the after token from the previous response to continue from that place in the results.
limit query · integer
number of IDs to return.
sort query · string
Order by fields.
filter query · string
Filter assets using an FQL query.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
offset body · integer
Starting index of result set from which to return IDs.
Code Examples
from falconpy import ExposureManagement


falcon = ExposureManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


response = falcon.query_assets(offset=integer,
                               limit=integer,
                               sort="string",
                               filter="string")
print(response)
Responses
[
  "string"
]
© 2026 CrowdStrike, Inc. All rights reserved. Privacy Notice Cookie Notice Terms of Use