Skip to content
CrowdStrike Developer Center

Falcon Complete Dashboard

The Falcon Complete Dashboard service collection provides operations for retrieving aggregate and query data from the Falcon Complete managed detection and response service.

LanguageLast Update
Pythonv1.6.5
PowerShellv2.2.9
Gov0.22.0
TypeScriptv0.6.0
Rustv0.7.1
Rubyv1.4.0

Table of Contents

Section titled “Table of Contents”
OperationDescription
AggregateAlerts
aggregate_alerts		Retrieve aggregate epp alerts values based on the matched filter
AggregateAllowList
aggregate_allow_list		Retrieve aggregate allowlist ticket values based on the matched filter
AggregateBlockList
aggregate_block_list		Retrieve aggregate blocklist ticket values based on the matched filter
AggregateDeviceCountCollection
aggregate_device_count_collection		Retrieve aggregate host/devices count based on the matched filter
AggregateEscalations
aggregate_escalations		Retrieve aggregate escalation ticket values based on the matched filter
AggregatePreventionPolicy
aggregate_prevention_policy		Retrieve prevention policies aggregate values based on the matched filter
AggregateRemediations
aggregate_remediations		Retrieve aggregate remediation ticket values based on the matched filter
AggregateSensorUpdatePolicy
aggregate_sensor_update_policy		Retrieve sensor update policies aggregate values
AggregateSupportIssues
aggregate_support_issues		Retrieve aggregate support issue ticket values based on the matched filter
AggregateTotalDeviceCounts
aggregate_total_device_counts		Retrieve aggregate total host/devices based on the matched filter
GetDeviceCountCollectionQueriesByFilter
get_device_count_collection_queries_by_filter		Retrieve device count collection Ids that match the provided FQL filter, criteria with scrolling enabled
QueryAlertIdsByFilter
query_alert_ids_by_filter_v1		Retrieve Alerts Ids for epp that match the provided FQL filter criteria with scrolling enabled
QueryAlertIdsByFilterV2
query_alert_ids_by_filter		Retrieve Alerts Ids for epp, idp and ngsiem that match the provided FQL filter criteria with scrolling enabled
QueryAllowListFilter
query_allow_list_filter		Retrieve allowlist tickets that match the provided filter criteria with scrolling enabled
QueryBlockListFilter
query_block_list_filter		Retrieve block listtickets that match the provided filter criteria with scrolling enabled
QueryEscalationsFilter
query_escalations_filter		Retrieve escalation tickets that match the provided filter criteria with scrolling enabled
QueryRemediationsFilter
query_remediations_filter		Retrieve remediation tickets that match the provided filter criteria with scrolling enabled

AggregateAlerts

Section titled “AggregateAlerts”

Retrieve aggregate epp alerts values based on the matched filter

Method POST
Route /falcon-complete-dashboards/aggregates/alerts/GET/v1
Scope Falcon Complete Dashboard: READ
PEP 8 aggregate_alerts

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
If peforming a date range query specify the from and to date ranges. These can be in common date formats like 2019-07-18 or now.
exclude body · string
extended_bounds body · object
field body · string
Term you want to aggregate on. If doing a date_range query, this is the date field you want to apply the date ranges to.
filter body · string
Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
filters_spec body · object
from body · integer
include body · string
interval body · string
Available values (6)
yearmonthweek
dayhourminute
max_doc_count body · integer
min_doc_count body · integer
Minimum number of documents required to match.
missing body · string
name body · string
Name of the aggregation.
percents body · array
q body · string
FQL syntax.
ranges body · array
size body · integer
Size limit to apply to the queries.
sort body · string
FQL syntax.
Available values (2)
_count
sort by document count
_term
sort by the string value alphabetically
sub_aggregates body · array
time_zone body · string
type body · string
String. This method does not support body payload validation.
Available values (10)
date_histogram
Aggregates counts on a specified time interval. Requires use of “interval” field.
date_range
Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
terms
Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
range
Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.
cardinality
Returns the count of distinct values in a specified field.
max
Returns the maximum value of a specified field.
min
Returns the minimum value of a specified field.
avg
Returns the average value of the specified field.
sum
Returns the total sum of all values for the specified field.
percentiles
Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.
Code Examples
from falconpy import CompleteDashboard


falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )


date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]


ranges = [
    {
        "From": 0,
        "To": 0
    }
]


response = falcon.aggregate_alerts(date_ranges=date_ranges,
                                   field="string",
                                   filter="string",
                                   interval="string",
                                   min_doc_count=integer,
                                   missing="string",
                                   name="string",
                                   q="string",
                                   ranges=ranges,
                                   size=integer,
                                   sort="string",
                                   sub_aggregates=["string"],
                                   time_zone="string",
                                   type="string")
print(response)
Responses
[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

AggregateAllowList

Section titled “AggregateAllowList”

Retrieve aggregate allowlist ticket values based on the matched filter

Method POST
Route /falcon-complete-dashboards/aggregates/allowlist/GET/v1
Scope Falcon Complete Dashboard: READ
PEP 8 aggregate_allow_list

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
If peforming a date range query specify the from and to date ranges. These can be in common date formats like 2019-07-18 or now.
exclude body · string
extended_bounds body · object
field body · string
Term you want to aggregate on. If doing a date_range query, this is the date field you want to apply the date ranges to.
filter body · string
Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
filters_spec body · object
from body · integer
include body · string
interval body · string
Available values (6)
yearmonthweek
dayhourminute
max_doc_count body · integer
min_doc_count body · integer
Minimum number of documents required to match.
missing body · string
name body · string
Name of the aggregation.
percents body · array
q body · string
FQL syntax.
ranges body · array
size body · integer
Size limit to apply to the queries.
sort body · string
FQL syntax.
Available values (2)
_count
sort by document count
_term
sort by the string value alphabetically
sub_aggregates body · array
time_zone body · string
type body · string
String. This method does not support body payload validation.
Available values (10)
date_histogram
Aggregates counts on a specified time interval. Requires use of “interval” field.
date_range
Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
terms
Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
range
Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.
cardinality
Returns the count of distinct values in a specified field.
max
Returns the maximum value of a specified field.
min
Returns the minimum value of a specified field.
avg
Returns the average value of the specified field.
sum
Returns the total sum of all values for the specified field.
percentiles
Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.
Code Examples
from falconpy import CompleteDashboard


falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )


date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]


ranges = [
    {
        "From": 0,
        "To": 0
    }
]


response = falcon.aggregate_allow_list(date_ranges=date_ranges,
                                       field="string",
                                       filter="string",
                                       interval="string",
                                       min_doc_count=integer,
                                       missing="string",
                                       name="string",
                                       q="string",
                                       ranges=ranges,
                                       size=integer,
                                       sort="string",
                                       sub_aggregates=["string"],
                                       time_zone="string",
                                       type="string")
print(response)
Responses
[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

AggregateBlockList

Section titled “AggregateBlockList”

Retrieve aggregate blocklist ticket values based on the matched filter

Method POST
Route /falcon-complete-dashboards/aggregates/blocklist/GET/v1
Scope Falcon Complete Dashboard: READ
PEP 8 aggregate_block_list

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
If peforming a date range query specify the from and to date ranges. These can be in common date formats like 2019-07-18 or now.
exclude body · string
Fields to exclude.
extended_bounds body · object
field body · string
Term you want to aggregate on. If doing a date_range query, this is the date field you want to apply the date ranges to.
filter body · string
Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
filters_spec body · object
from body · integer
include body · string
Fields to include.
interval body · string
Available values (6)
yearmonthweek
dayhourminute
max_doc_count body · integer
Maximum number of documents.
min_doc_count body · integer
Minimum number of documents.
missing body · string
name body · string
Scan name.
percents body · array
q body · string
FQL syntax.
ranges body · array
size body · integer
sort body · string
FQL syntax.
Available values (2)
_count
sort by document count
_term
sort by the string value alphabetically
sub_aggregates body · array
time_zone body · string
type body · string
String. This method does not support body payload validation.
Available values (10)
date_histogram
Aggregates counts on a specified time interval. Requires use of “interval” field.
date_range
Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
terms
Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
range
Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.
cardinality
Returns the count of distinct values in a specified field.
max
Returns the maximum value of a specified field.
min
Returns the minimum value of a specified field.
avg
Returns the average value of the specified field.
sum
Returns the total sum of all values for the specified field.
percentiles
Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.
Code Examples
from falconpy import CompleteDashboard


falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )


date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]


ranges = [
    {
        "From": 0,
        "To": 0
    }
]


response = falcon.aggregate_block_list(date_ranges=date_ranges,
                                       exclude="string",
                                       field="string",
                                       filter="string",
                                       from=integer,
                                       include="string",
                                       interval="string",
                                       max_doc_count=integer,
                                       min_doc_count=integer,
                                       missing="string",
                                       name="string",
                                       q="string",
                                       ranges=ranges,
                                       size=integer,
                                       sort="string",
                                       sub_aggregates=["string"],
                                       time_zone="string",
                                       type="string")
print(response)
Responses
[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

AggregateDeviceCountCollection

Section titled “AggregateDeviceCountCollection”

Retrieve aggregate host/devices count based on the matched filter

Method POST
Route /falcon-complete-dashboards/aggregates/devicecount-collections/GET/v1
Scope Falcon Complete Dashboard: READ
PEP 8 aggregate_device_count_collection

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
If peforming a date range query specify the from and to date ranges. These can be in common date formats like 2019-07-18 or now.
exclude body · string
Fields to exclude.
extended_bounds body · object
field body · string
Term you want to aggregate on. If doing a date_range query, this is the date field you want to apply the date ranges to.
filter body · string
Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
filters_spec body · object
from body · integer
include body · string
Fields to include.
interval body · string
Available values (6)
yearmonthweek
dayhourminute
max_doc_count body · integer
Maximum number of documents.
min_doc_count body · integer
Minimum number of documents.
missing body · string
name body · string
Scan name.
percents body · array
q body · string
FQL syntax.
ranges body · array
size body · integer
sort body · string
FQL syntax.
Available values (2)
_count
sort by document count
_term
sort by the string value alphabetically
sub_aggregates body · array
time_zone body · string
type body · string
String. This method does not support body payload validation.
Available values (10)
date_histogram
Aggregates counts on a specified time interval. Requires use of “interval” field.
date_range
Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
terms
Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
range
Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.
cardinality
Returns the count of distinct values in a specified field.
max
Returns the maximum value of a specified field.
min
Returns the minimum value of a specified field.
avg
Returns the average value of the specified field.
sum
Returns the total sum of all values for the specified field.
percentiles
Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.
Code Examples
from falconpy import CompleteDashboard


falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )


date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]


ranges = [
    {
        "From": 0,
        "To": 0
    }
]


response = falcon.aggregate_device_count_collection(date_ranges=date_ranges,
                                                    exclude="string",
                                                    field="string",
                                                    filter="string",
                                                    from=integer,
                                                    include="string",
                                                    interval="string",
                                                    max_doc_count=integer,
                                                    min_doc_count=integer,
                                                    missing="string",
                                                    name="string",
                                                    q="string",
                                                    ranges=ranges,
                                                    size=integer,
                                                    sort="string",
                                                    sub_aggregates=["string"],
                                                    time_zone="string",
                                                    type="string")
print(response)
Responses
[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

AggregateEscalations

Section titled “AggregateEscalations”

Retrieve aggregate escalation ticket values based on the matched filter

Method POST
Route /falcon-complete-dashboards/aggregates/escalations/GET/v1
Scope Falcon Complete Dashboard: READ
PEP 8 aggregate_escalations

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
If peforming a date range query specify the from and to date ranges. These can be in common date formats like 2019-07-18 or now.
exclude body · string
Fields to exclude.
extended_bounds body · object
field body · string
Term you want to aggregate on. If doing a date_range query, this is the date field you want to apply the date ranges to.
filter body · string
Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
filters_spec body · object
from body · integer
include body · string
Fields to include.
interval body · string
Available values (6)
yearmonthweek
dayhourminute
max_doc_count body · integer
Maximum number of documents.
min_doc_count body · integer
Minimum number of documents.
missing body · string
name body · string
Scan name.
percents body · array
q body · string
FQL syntax.
ranges body · array
size body · integer
sort body · string
FQL syntax.
Available values (2)
_count
sort by document count
_term
sort by the string value alphabetically
sub_aggregates body · array
time_zone body · string
type body · string
String. This method does not support body payload validation.
Available values (10)
date_histogram
Aggregates counts on a specified time interval. Requires use of “interval” field.
date_range
Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
terms
Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
range
Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.
cardinality
Returns the count of distinct values in a specified field.
max
Returns the maximum value of a specified field.
min
Returns the minimum value of a specified field.
avg
Returns the average value of the specified field.
sum
Returns the total sum of all values for the specified field.
percentiles
Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.
Code Examples
from falconpy import CompleteDashboard


falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )


date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]


ranges = [
    {
        "From": 0,
        "To": 0
    }
]


response = falcon.aggregate_escalations(date_ranges=date_ranges,
                                        exclude="string",
                                        field="string",
                                        filter="string",
                                        from=integer,
                                        include="string",
                                        interval="string",
                                        max_doc_count=integer,
                                        min_doc_count=integer,
                                        missing="string",
                                        name="string",
                                        q="string",
                                        ranges=ranges,
                                        size=integer,
                                        sort="string",
                                        sub_aggregates=["string"],
                                        time_zone="string",
                                        type="string")
print(response)
Responses
[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

AggregatePreventionPolicy

Section titled “AggregatePreventionPolicy”

Retrieve prevention policies aggregate values based on the matched filter

Method POST
Route /falcon-complete-dashboards/aggregates/prevention-policies/v1
Scope Falcon Complete Dashboard: READ
PEP 8 aggregate_prevention_policy

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
If peforming a date range query specify the from and to date ranges. These can be in common date formats like 2019-07-18 or now.
exclude body · string
Fields to exclude.
extended_bounds body · object
field body · string
Term you want to aggregate on. If doing a date_range query, this is the date field you want to apply the date ranges to.
filter body · string
Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
filters_spec body · object
from body · integer
include body · string
Fields to include.
interval body · string
Available values (6)
yearmonthweek
dayhourminute
max_doc_count body · integer
Maximum number of documents.
min_doc_count body · integer
Minimum number of documents.
missing body · string
name body · string
Scan name.
percents body · array
q body · string
FQL syntax.
ranges body · array
size body · integer
sort body · string
FQL syntax.
Available values (2)
_count
sort by document count
_term
sort by the string value alphabetically
sub_aggregates body · array
time_zone body · string
type body · string
String. This method does not support body payload validation.
Available values (10)
date_histogram
Aggregates counts on a specified time interval. Requires use of “interval” field.
date_range
Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
terms
Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
range
Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.
cardinality
Returns the count of distinct values in a specified field.
max
Returns the maximum value of a specified field.
min
Returns the minimum value of a specified field.
avg
Returns the average value of the specified field.
sum
Returns the total sum of all values for the specified field.
percentiles
Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.
Code Examples
from falconpy import CompleteDashboard


falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )


date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]


ranges = [
    {
        "From": 0,
        "To": 0
    }
]


response = falcon.aggregate_prevention_policy(date_ranges=date_ranges,
                                              exclude="string",
                                              field="string",
                                              filter="string",
                                              from=integer,
                                              include="string",
                                              interval="string",
                                              max_doc_count=integer,
                                              min_doc_count=integer,
                                              missing="string",
                                              name="string",
                                              q="string",
                                              ranges=ranges,
                                              size=integer,
                                              sort="string",
                                              sub_aggregates=["string"],
                                              time_zone="string",
                                              type="string")
print(response)
Responses
[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

AggregateRemediations

Section titled “AggregateRemediations”

Retrieve aggregate remediation ticket values based on the matched filter

Method POST
Route /falcon-complete-dashboards/aggregates/remediations/GET/v1
Scope Falcon Complete Dashboard: READ
PEP 8 aggregate_remediations

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
If peforming a date range query specify the from and to date ranges. These can be in common date formats like 2019-07-18 or now.
exclude body · string
Fields to exclude.
extended_bounds body · object
field body · string
Term you want to aggregate on. If doing a date_range query, this is the date field you want to apply the date ranges to.
filter body · string
Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
filters_spec body · object
from body · integer
include body · string
Fields to include.
interval body · string
Available values (6)
yearmonthweek
dayhourminute
max_doc_count body · integer
Maximum number of documents.
min_doc_count body · integer
Minimum number of documents.
missing body · string
name body · string
Scan name.
percents body · array
q body · string
FQL syntax.
ranges body · array
size body · integer
sort body · string
FQL syntax.
Available values (2)
_count
sort by document count
_term
sort by the string value alphabetically
sub_aggregates body · array
time_zone body · string
type body · string
String. This method does not support body payload validation.
Available values (10)
date_histogram
Aggregates counts on a specified time interval. Requires use of “interval” field.
date_range
Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
terms
Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
range
Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.
cardinality
Returns the count of distinct values in a specified field.
max
Returns the maximum value of a specified field.
min
Returns the minimum value of a specified field.
avg
Returns the average value of the specified field.
sum
Returns the total sum of all values for the specified field.
percentiles
Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.
Code Examples
from falconpy import CompleteDashboard


falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )


date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]


ranges = [
    {
        "From": 0,
        "To": 0
    }
]


response = falcon.aggregate_remediations(date_ranges=date_ranges,
                                         exclude="string",
                                         field="string",
                                         filter="string",
                                         from=integer,
                                         include="string",
                                         interval="string",
                                         max_doc_count=integer,
                                         min_doc_count=integer,
                                         missing="string",
                                         name="string",
                                         q="string",
                                         ranges=ranges,
                                         size=integer,
                                         sort="string",
                                         sub_aggregates=["string"],
                                         time_zone="string",
                                         type="string")
print(response)
Responses
[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

AggregateSensorUpdatePolicy

Section titled “AggregateSensorUpdatePolicy”

Retrieve sensor update policies aggregate values

Method POST
Route /falcon-complete-dashboards/aggregates/sensor-update-policies/v1
Scope Falcon Complete Dashboard: READ
PEP 8 aggregate_sensor_update_policy

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
If peforming a date range query specify the from and to date ranges. These can be in common date formats like 2019-07-18 or now.
exclude body · string
Fields to exclude.
extended_bounds body · object
field body · string
Term you want to aggregate on. If doing a date_range query, this is the date field you want to apply the date ranges to.
filter body · string
Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
filters_spec body · object
from body · integer
include body · string
Fields to include.
interval body · string
Available values (6)
yearmonthweek
dayhourminute
max_doc_count body · integer
Maximum number of documents.
min_doc_count body · integer
Minimum number of documents.
missing body · string
name body · string
Scan name.
percents body · array
q body · string
FQL syntax.
ranges body · array
size body · integer
sort body · string
FQL syntax.
Available values (2)
_count
sort by document count
_term
sort by the string value alphabetically
sub_aggregates body · array
time_zone body · string
type body · string
String. This method does not support body payload validation.
Available values (10)
date_histogram
Aggregates counts on a specified time interval. Requires use of “interval” field.
date_range
Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
terms
Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
range
Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.
cardinality
Returns the count of distinct values in a specified field.
max
Returns the maximum value of a specified field.
min
Returns the minimum value of a specified field.
avg
Returns the average value of the specified field.
sum
Returns the total sum of all values for the specified field.
percentiles
Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.
Code Examples
from falconpy import CompleteDashboard


falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )


date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]


ranges = [
    {
        "From": 0,
        "To": 0
    }
]


response = falcon.aggregate_sensor_update_policy(date_ranges=date_ranges,
                                                 exclude="string",
                                                 field="string",
                                                 filter="string",
                                                 from=integer,
                                                 include="string",
                                                 interval="string",
                                                 max_doc_count=integer,
                                                 min_doc_count=integer,
                                                 missing="string",
                                                 name="string",
                                                 q="string",
                                                 ranges=ranges,
                                                 size=integer,
                                                 sort="string",
                                                 sub_aggregates=["string"],
                                                 time_zone="string",
                                                 type="string")
print(response)
Responses
[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

AggregateSupportIssues

Section titled “AggregateSupportIssues”

Retrieve aggregate support issue ticket values based on the matched filter

Method POST
Route /falcon-complete-dashboards/aggregates/support-issues/v1
Scope Falcon Complete Dashboard: READ
PEP 8 aggregate_support_issues

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
If peforming a date range query specify the from and to date ranges. These can be in common date formats like 2019-07-18 or now.
exclude body · string
Fields to exclude.
extended_bounds body · object
field body · string
Term you want to aggregate on. If doing a date_range query, this is the date field you want to apply the date ranges to.
filter body · string
Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
filters_spec body · object
from body · integer
include body · string
Fields to include.
interval body · string
Available values (6)
yearmonthweek
dayhourminute
max_doc_count body · integer
Maximum number of documents.
min_doc_count body · integer
Minimum number of documents.
missing body · string
name body · string
Scan name.
percents body · array
q body · string
FQL syntax.
ranges body · array
size body · integer
sort body · string
FQL syntax.
Available values (2)
_count
sort by document count
_term
sort by the string value alphabetically
sub_aggregates body · array
time_zone body · string
type body · string
String. This method does not support body payload validation.
Available values (10)
date_histogram
Aggregates counts on a specified time interval. Requires use of “interval” field.
date_range
Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
terms
Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
range
Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.
cardinality
Returns the count of distinct values in a specified field.
max
Returns the maximum value of a specified field.
min
Returns the minimum value of a specified field.
avg
Returns the average value of the specified field.
sum
Returns the total sum of all values for the specified field.
percentiles
Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.
Code Examples
from falconpy import CompleteDashboard


falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )


date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]


ranges = [
    {
        "From": 0,
        "To": 0
    }
]


response = falcon.aggregate_support_issues(date_ranges=date_ranges,
                                           exclude="string",
                                           field="string",
                                           filter="string",
                                           from=integer,
                                           include="string",
                                           interval="string",
                                           max_doc_count=integer,
                                           min_doc_count=integer,
                                           missing="string",
                                           name="string",
                                           q="string",
                                           ranges=ranges,
                                           size=integer,
                                           sort="string",
                                           sub_aggregates=["string"],
                                           time_zone="string",
                                           type="string")
print(response)
Responses
[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

AggregateTotalDeviceCounts

Section titled “AggregateTotalDeviceCounts”

Retrieve aggregate total host/devices based on the matched filter

Method POST
Route /falcon-complete-dashboards/aggregates/total-device-counts/v1
Scope Falcon Complete Dashboard: READ
PEP 8 aggregate_total_device_counts

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
If peforming a date range query specify the from and to date ranges. These can be in common date formats like 2019-07-18 or now.
exclude body · string
Fields to exclude.
extended_bounds body · object
field body · string
Term you want to aggregate on. If doing a date_range query, this is the date field you want to apply the date ranges to.
filter body · string
Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
filters_spec body · object
from body · integer
include body · string
Fields to include.
interval body · string
Available values (6)
yearmonthweek
dayhourminute
max_doc_count body · integer
Maximum number of documents.
min_doc_count body · integer
Minimum number of documents.
missing body · string
name body · string
Scan name.
percents body · array
q body · string
FQL syntax.
ranges body · array
size body · integer
sort body · string
FQL syntax.
Available values (2)
_count
sort by document count
_term
sort by the string value alphabetically
sub_aggregates body · array
time_zone body · string
type body · string
String. This method does not support body payload validation.
Available values (10)
date_histogram
Aggregates counts on a specified time interval. Requires use of “interval” field.
date_range
Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
terms
Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
range
Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.
cardinality
Returns the count of distinct values in a specified field.
max
Returns the maximum value of a specified field.
min
Returns the minimum value of a specified field.
avg
Returns the average value of the specified field.
sum
Returns the total sum of all values for the specified field.
percentiles
Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.
Code Examples
from falconpy import CompleteDashboard


falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )


date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]


ranges = [
    {
        "From": 0,
        "To": 0
    }
]


response = falcon.aggregate_total_device_counts(date_ranges=date_ranges,
                                                exclude="string",
                                                field="string",
                                                filter="string",
                                                from=integer,
                                                include="string",
                                                interval="string",
                                                max_doc_count=integer,
                                                min_doc_count=integer,
                                                missing="string",
                                                name="string",
                                                q="string",
                                                ranges=ranges,
                                                size=integer,
                                                sort="string",
                                                sub_aggregates=["string"],
                                                time_zone="string",
                                                type="string")
print(response)
Responses
[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

GetDeviceCountCollectionQueriesByFilter

Section titled “GetDeviceCountCollectionQueriesByFilter”

Retrieve device count collection Ids that match the provided FQL filter, criteria with scrolling enabled

Method GET
Route /falcon-complete-dashboards/queries/devicecount-collections/v1
Scope Falcon Complete Dashboard: READ
PEP 8 get_device_count_collection_queries_by_filter

Parameters

Section titled “Parameters”
limit query · integer
The maximum records to return. [1-500]
sort query · string
The property to sort on, followed by a dot (.), followed by the sort direction, either asc or desc.
filter query · string
Optional filter and sort criteria in the form of an FQL query.
offset query · string
Starting index of overall result set from which to return ids.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import CompleteDashboard


falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )


response = falcon.get_device_count_collection_queries_by_filter(filter="string",
                                                                limit=integer,
                                                                offset="string",
                                                                sort="string")
print(response)
Responses
[
  "string"
]

QueryAlertIdsByFilter

Section titled “QueryAlertIdsByFilter”

Retrieve Alerts Ids for epp that match the provided FQL filter criteria with scrolling enabled

Method GET
Route /falcon-complete-dashboards/queries/alerts/v1
Scope Falcon Complete Dashboard: READ
PEP 8 query_alert_ids_by_filter_v1

Parameters

Section titled “Parameters”
limit query · integer
The maximum records to return. [1-500]
sort query · string
The property to sort on, followed by a dot (.), followed by the sort direction, either asc or desc.
filter query · string
Optional filter and sort criteria in the form of an FQL query.
offset query · string
Starting index of overall result set from which to return ids.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import CompleteDashboard


falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )


response = falcon.query_alert_ids_by_filter_v1(filter="string",
                                               limit=integer,
                                               offset="string",
                                               sort="string")
print(response)
Responses
[
  "string"
]

QueryAlertIdsByFilterV2

Section titled “QueryAlertIdsByFilterV2”

Retrieve Alerts Ids for epp, idp and ngsiem that match the provided FQL filter criteria with scrolling enabled

Method GET
Route /falcon-complete-dashboards/queries/alerts/v2
Scope Falcon Complete Dashboard: READ
PEP 8 query_alert_ids_by_filter

Parameters

Section titled “Parameters”
limit query · integer
The maximum records to return. [1-500]
sort query · string
The property to sort on, followed by a dot (.), followed by the sort direction, either asc or desc.
filter query · string
Optional filter and sort criteria in the form of an FQL query.
offset query · string
Starting index of overall result set from which to return ids.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import CompleteDashboard


falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )


response = falcon.query_alert_ids_by_filter(filter="string",
                                            limit=integer,
                                            offset="string",
                                            sort="string")
print(response)
Responses
[
  "string"
]

QueryAllowListFilter

Section titled “QueryAllowListFilter”

Retrieve allowlist tickets that match the provided filter criteria with scrolling enabled

Method GET
Route /falcon-complete-dashboards/queries/allowlist/v1
Scope Falcon Complete Dashboard: READ
PEP 8 query_allow_list_filter

Parameters

Section titled “Parameters”
limit query · integer
The maximum records to return. [1-500]
sort query · string
The property to sort on, followed by a dot (.), followed by the sort direction, either asc or desc.
filter query · string
Optional filter and sort criteria in the form of an FQL query.
offset query · string
Starting index of overall result set from which to return ids.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import CompleteDashboard


falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )


response = falcon.query_allow_list_filter(filter="string",
                                          limit=integer,
                                          offset="string",
                                          sort="string")
print(response)
Responses
[
  "string"
]

QueryBlockListFilter

Section titled “QueryBlockListFilter”

Retrieve block listtickets that match the provided filter criteria with scrolling enabled

Method GET
Route /falcon-complete-dashboards/queries/blocklist/v1
Scope Falcon Complete Dashboard: READ
PEP 8 query_block_list_filter

Parameters

Section titled “Parameters”
limit query · integer
The maximum records to return. [1-500]
sort query · string
The property to sort on, followed by a dot (.), followed by the sort direction, either asc or desc.
filter query · string
Optional filter and sort criteria in the form of an FQL query.
offset query · string
Starting index of overall result set from which to return ids.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import CompleteDashboard


falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )


response = falcon.query_block_list_filter(filter="string",
                                          limit=integer,
                                          offset="string",
                                          sort="string")
print(response)
Responses
[
  "string"
]

QueryEscalationsFilter

Section titled “QueryEscalationsFilter”

Retrieve escalation tickets that match the provided filter criteria with scrolling enabled

Method GET
Route /falcon-complete-dashboards/queries/escalations/v1
Scope Falcon Complete Dashboard: READ
PEP 8 query_escalations_filter

Parameters

Section titled “Parameters”
limit query · integer
The maximum records to return. [1-500]
sort query · string
The property to sort on, followed by a dot (.), followed by the sort direction, either asc or desc.
filter query · string
Optional filter and sort criteria in the form of an FQL query.
offset query · string
Starting index of overall result set from which to return ids.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import CompleteDashboard


falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )


response = falcon.query_escalations_filter(filter="string",
                                           limit=integer,
                                           offset="string",
                                           sort="string")
print(response)
Responses
[
  "string"
]

QueryRemediationsFilter

Section titled “QueryRemediationsFilter”

Retrieve remediation tickets that match the provided filter criteria with scrolling enabled

Method GET
Route /falcon-complete-dashboards/queries/remediations/v1
Scope Falcon Complete Dashboard: READ
PEP 8 query_remediations_filter

Parameters

Section titled “Parameters”
limit query · integer
The maximum records to return. [1-500]
sort query · string
The property to sort on, followed by a dot (.), followed by the sort direction, either asc or desc.
filter query · string
Optional filter and sort criteria in the form of an FQL query.
offset query · string
Starting index of overall result set from which to return ids.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import CompleteDashboard


falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )


response = falcon.query_remediations_filter(filter="string",
                                            limit=integer,
                                            offset="string",
                                            sort="string")
print(response)
Responses
[
  "string"
]
© 2026 CrowdStrike, Inc. All rights reserved. Privacy Notice Cookie Notice Terms of Use