FDR

The Falcon Data Replicator (FDR) service collection provides operations for accessing event and field schema data. Fetch combined schemas, retrieve event or field entities by ID, and query event or field IDs using FQL filter criteria.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

Operation	Description
fdrschema.combined.event.get `get_event_combined`	Fetch combined schema
fdrschema.entities.event.get `get_event_entities`	Fetch event schema by ID
fdrschema.entities.field.get `get_field_entities`	Fetch field schema by ID
fdrschema.queries.event.get `query_event_entities`	Get list of event IDs given a particular query.
fdrschema.queries.field.get `query_field_entities`	Get list of field IDs given a particular query.

fdrschema.combined.event.get

Fetch combined schema

Method GET

Route /fdr/combined/schema-members/v1

Scope Falcon Data Replicator: READ

PEP 8 get_event_combined

Code Examples

from falconpy import FDR

falcon = FDR(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.get_event_combined()
print(response)

from falconpy import FDR

falcon = FDR(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.fdrschema_combined_event_get()
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("fdrschema_combined_event_get")
print(response)

Get-FalconReplicatorSchema

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/event_schema"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.EventSchema.FdrschemaCombinedEventGet(
    &event_schema.FdrschemaCombinedEventGetParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.eventSchema.fdrschemaCombinedEventGet();

console.log(response);

use rusty_falcon::apis::event_schema_api::fdrschema_combined_event_get;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = fdrschema_combined_event_get(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::EventSchema.new

response = api.fdrschema_combined_event_get

puts response

Responses

[
  {
    "base_id": "string",
    "description": "string",
    "fields": [],
    "id": "string",
    "name": "string",
    "platform": "string",
    "version": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

fdrschema.entities.event.get

Fetch event schema by ID

Method GET

Route /fdr/entities/schema-events/v1

Scope Falcon Data Replicator: READ

PEP 8 get_event_entities

Parameters

ids query · string or list of strings

Specify feed IDs to fetch

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FDR

falcon = FDR(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_event_entities(ids=id_list)
print(response)

from falconpy import FDR

falcon = FDR(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.fdrschema_entities_event_get(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("fdrschema_entities_event_get",
                          ids=id_list)
print(response)

Get-FalconReplicatorEvent -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/event_schema"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.EventSchema.FdrschemaEntitiesEventGet(
    &event_schema.FdrschemaEntitiesEventGetParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.eventSchema.fdrschemaEntitiesEventGet(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::event_schema_api::fdrschema_entities_event_get;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = fdrschema_entities_event_get(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::EventSchema.new

response = api.fdrschema_entities_event_get(ids: ['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "base_id": "string",
    "description": "string",
    "fields": [],
    "id": "string",
    "name": "string",
    "platform": "string",
    "version": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

fdrschema.entities.field.get

Fetch field schema by ID

Method GET

Route /fdr/entities/schema-fields/v1

Scope Falcon Data Replicator: READ

PEP 8 get_field_entities

Parameters

ids query · string or list of strings

Specify feed IDs to fetch

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FDR

falcon = FDR(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_field_entities(ids=id_list)
print(response)

from falconpy import FDR

falcon = FDR(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.fdrschema_entities_field_get(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("fdrschema_entities_field_get",
                          ids=id_list)
print(response)

Get-FalconReplicatorField -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/field_schema"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.FieldSchema.FdrschemaEntitiesFieldGet(
    &field_schema.FdrschemaEntitiesFieldGetParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.fieldSchema.fdrschemaEntitiesFieldGet(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::field_schema_api::fdrschema_entities_field_get;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = fdrschema_entities_field_get(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FieldSchema.new

response = api.fdrschema_entities_field_get(ids: ['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "description": "string",
    "id": "string",
    "name": "string",
    "type": "string",
    "universal": false,
    "values": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

fdrschema.queries.event.get

Get list of event IDs given a particular query.

Method GET

Route /fdr/queries/schema-events/v1

Scope Falcon Data Replicator: READ

PEP 8 query_event_entities

Parameters

limit query · integer

Limit of the data

offset query · integer

Offset into the data

filter query · string

The FQL filter expression that should be used to limit the results.

sort query · string

FQL formatted sort directive.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FDR

falcon = FDR(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.query_event_entities(filter="string",
                                       limit=integer,
                                       offset=integer,
                                       sort="string")
print(response)

from falconpy import FDR

falcon = FDR(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.fdrschema_queries_event_get(filter="string",
                                              limit=integer,
                                              offset=integer,
                                              sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("fdrschema_queries_event_get",
                          limit=integer,
                          offset=integer,
                          filter="string",
                          sort="string")
print(response)

Get-FalconReplicatorEvent -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/event_schema"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)
  filter := "string"
  sort := "string"

  response, err := client.EventSchema.FdrschemaQueriesEventGet(
    &event_schema.FdrschemaQueriesEventGetParams{
      Limit: &limit,
      Offset: &offset,
      Filter: &filter,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.eventSchema.fdrschemaQueriesEventGet(
  integer,  // limit
  integer,  // offset
  "string",  // filter
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::event_schema_api::fdrschema_queries_event_get;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = fdrschema_queries_event_get(
        &falcon.cfg,  // configuration
        Some(integer),  // limit
        Some(integer),  // offset
        Some("string"),  // filter
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::EventSchema.new

response = api.fdrschema_queries_event_get(limit: integer,
                                           offset: integer,
                                           filter: 'string',
                                           sort: 'string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

fdrschema.queries.field.get

Get list of field IDs given a particular query.

Method GET

Route /fdr/queries/schema-fields/v1

Scope Falcon Data Replicator: READ

PEP 8 query_field_entities

Parameters

limit query · integer

Limit of the data

offset query · integer

Offset into the data

filter query · string

The FQL filter expression that should be used to limit the results.

sort query · string

FQL formatted sort directive.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FDR

falcon = FDR(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.query_field_entities(filter="string",
                                       limit=integer,
                                       offset=integer,
                                       sort="string")
print(response)

from falconpy import FDR

falcon = FDR(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.fdrschema_queries_field_get(filter="string",
                                              limit=integer,
                                              offset=integer,
                                              sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("fdrschema_queries_field_get",
                          limit=integer,
                          offset=integer,
                          filter="string",
                          sort="string")
print(response)

Get-FalconReplicatorField -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/field_schema"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)
  filter := "string"
  sort := "string"

  response, err := client.FieldSchema.FdrschemaQueriesFieldGet(
    &field_schema.FdrschemaQueriesFieldGetParams{
      Limit: &limit,
      Offset: &offset,
      Filter: &filter,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.fieldSchema.fdrschemaQueriesFieldGet(
  integer,  // limit
  integer,  // offset
  "string",  // filter
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::field_schema_api::fdrschema_queries_field_get;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = fdrschema_queries_field_get(
        &falcon.cfg,  // configuration
        Some(integer),  // limit
        Some(integer),  // offset
        Some("string"),  // filter
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FieldSchema.new

response = api.fdrschema_queries_field_get(limit: integer,
                                           offset: integer,
                                           filter: 'string',
                                           sort: 'string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

FDR

Table of Contents

fdrschema.combined.event.get

fdrschema.entities.event.get

Parameters

fdrschema.entities.field.get

Parameters

fdrschema.queries.event.get

Parameters

fdrschema.queries.field.get

Parameters