FileVantage

The FileVantage service collection provides operations for managing CrowdStrike Falcon FileVantage configurations. Monitor and detect changes to files, directories, and registry settings. Manage policies, scheduled exclusions, rule groups, and rules. Retrieve and initiate actions on changes, get file change content, initiate workflows for change IDs, and query action, change, policy, scheduled exclusion, and rule group IDs.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

Operation	Description
createPolicies `create_policy`	Creates a new policy of the specified type.
createRuleGroups `create_rule_group`	Creates a new rule group of the specified type.
createRules `create_rule`	Creates a new rule configuration within the specified rule group.
createScheduledExclusions `create_scheduled_exclusions`	Creates a new scheduled exclusion configuration for the provided policy id.
deletePolicies `delete_policies`	Deletes 1 or more policies.
deleteRuleGroups `delete_rule_groups`	Deletes 1 or more rule groups
deleteRules `delete_rules`	Deletes 1 or more rules from the specified rule group.
deleteScheduledExclusions `delete_scheduled_exclusions`	Deletes 1 or more scheduled exclusions from the provided policy id.
getActionsMixin0 `get_actions`	Retrieves the processing results for 1 or more actions.
getChanges `get_changes`	Retrieve information on changes
getContents `get_contents`	Retrieves the content captured for the provided change id
getPolicies `get_policies`	Retrieves the configuration for 1 or more policies.
getRuleGroups `get_rule_groups`	Retrieves the rule group details for 1 or more rule groups.
getRules `get_rules`	Retrieves the configuration for 1 or more rules.
getScheduledExclusions `get_scheduled_exclusions`	Retrieves the configuration of 1 or more scheduled exclusions from the provided policy id.
highVolumeQueryChanges `query_changes_scroll`	Returns 1 or more change ids
queryActionsMixin0 `query_actions`	Returns one or more action ids
queryChanges `query_changes`	Returns 1 or more change ids
queryPolicies `query_policies`	Retrieve the ids of all policies that are assigned the provided policy type.
queryRuleGroups `query_rule_groups`	Retrieve the ids of all rule groups that are of the provided rule group type.
queryScheduledExclusions `query_scheduled_exclusions`	Retrieve the ids of all scheduled exclusions contained within the provided policy id.
signalChangesExternal `signal_changes`	Initiates workflows for the provided change ids
startActions `start_actions`	Initiates the specified action on the provided change ids
updatePolicies `update_policies`	Updates the general information of the provided policy.
updatePolicyHostGroups `update_policy_host_groups`	Manage host groups assigned to a policy.
updatePolicyPrecedence `update_policy_precedence`	Updates the policy precedence for all policies of a specific type.
updatePolicyRuleGroups `update_policy_rule_groups`	Manage the rule groups assigned to the policy or set the rule group precedence for all rule groups within the policy.
updateRuleGroupPrecedence `update_rule_group_precedence`	Updates the rule precedence for all rules in the identified rule group.
updateRuleGroups `update_rule_group`	Updates the provided rule group.
updateRules `update_rule`	Updates the provided rule configuration within the specified rule group.
updateScheduledExclusions `update_scheduled_exclusions`	Updates the provided scheduled exclusion configuration within the provided policy.

createPolicies

Creates a new policy of the specified type.

Method POST

Route /filevantage/entities/policies/v1

Scope Falcon FileVantage: WRITE

PEP 8 create_policy

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

description body · string

The policy description. (String, 0-500 characters.)

name body · string

Name of the policy. (String, 1-100 characters.)

platform body · string

Policy platform. (String) Allowed values:

Available values (3)

Windows Linux Mac

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.create_policy(description="string",
                                platform="string",
                                name="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.createPolicies(description="string",
                                 platform="string",
                                 name="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "name": "string",
    "platform": "string"
}

response = falcon.command("createPolicies", body=body_payload)
print(response)

New-FalconFileVantagePolicy -Name "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  name := "string"
  platform := "string"

  response, err := client.Filevantage.CreatePolicies(
    &filevantage.CreatePoliciesParams{
      Body: &models.PoliciesCreateRequest{
        Description: &description,
        Name: &name,
        Platform: &platform,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.createPolicies(
  {
    description: "string",
    name: "string",
    platform: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::filevantage_api::create_policies;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::PoliciesCreateRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = PoliciesCreateRequest {
        name: Some("string".to_string()),
        ..Default::default()
    };

    let response = create_policies(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

body = Falcon::PoliciesCreateRequest.new(
  description: 'string',
  name: 'string',
  platform: 'string'
)

response = api.create_policies(body)

puts response

Responses

[
  {
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "host_groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform": "string",
    "precedence": 0,
    "rule_groups": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

createRuleGroups

Creates a new rule group of the specified type.

Method POST

Route /filevantage/entities/rule-groups/v1

Scope Falcon FileVantage: WRITE

PEP 8 create_rule_group

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

description body · string

The rule group description. (String, 0-500 characters.)

name body · string

Name of the rule group. (String, 1-100 characters.)

type body · string

The type of rule group. (String) Allowed values:

Available values (4)

`WindowsFiles`	`WindowsRegistry`	`LinuxFiles`
`MacFiles`

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.create_rule_group(description="string",
                                    type="string",
                                    name="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.createRuleGroups(description="string",
                                   type="string",
                                   name="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "name": "string",
    "type": "string"
}

response = falcon.command("createRuleGroups", body=body_payload)
print(response)

New-FalconFileVantageRuleGroup -Type "string" -Name "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  name := "string"
  typeVar := "string"

  response, err := client.Filevantage.CreateRuleGroups(
    &filevantage.CreateRuleGroupsParams{
      Body: &models.RulegroupsCreateRequest{
        Description: &description,
        Name: &name,
        Type: &typeVar,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.createRuleGroups(
  {
    description: "string",
    name: "string",
    type: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::filevantage_api::create_rule_groups;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RulegroupsCreateRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RulegroupsCreateRequest {
        name: Some("string".to_string()),
        type: Some("string".to_string()),
        ..Default::default()
    };

    let response = create_rule_groups(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

body = {
  description: 'string',
  name: 'string',
  type: 'string'
}

response = api.create_rule_groups(body)

puts response

Responses

[
  {
    "assigned_rules": [],
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "policy_assignments": [],
    "type": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

createRules

Creates a new rule configuration within the specified rule group.

Method POST

Route /filevantage/entities/rule-groups-rules/v1

Scope Falcon FileVantage: WRITE

PEP 8 create_rule

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

content_files body · array

the files whose content will be monitored. (String). Listed files must match the file include pattern and not match the file exclude pattern.

content_registry_values body · array

the registry values whose content will be monitored. (String). Listed registry values must match the registry include pattern and not match the registry exclude pattern.

created_timestamp body · string

depth body · string

recursion levels below the base path to monitor. (String) Allowed values:

Available values (6)

`1`	`2`	`3`
`4`	`5`	`ANY`

description body · string

The rule description. (String, 0-500 characters.)

enable_content_capture body · boolean

Enable content capturing.

enable_hash_capture body · boolean

Enable hash capturing.

exclude body · string

the files, directories, registry keys, or registry values that will NOT be monitored. (String). Falcon GLOB syntax is supported. Allowed rule group configuration is based on the type of rule the rule group is added to.

exclude_processes body · string

the changes performed by the specific processes that will NOT be monitored. (String). Falcon GLOB syntax is supported. macOS is not supported at this time. Allowed rule group configuration is based on the type of rule the rule group is added to.

exclude_users body · string

the changes performed by specific processes that will be NOT monitored. (String). Falcon GLOB syntax is supported. macOS is not supported at this time. Allowed rule group configuration is based on the type of rule the rule group is added to.

id body · string

include body · string

the files, directories, registry keys, or registry values that will be monitored. (String). Falcon GLOB syntax is supported. Allowed rule group configuration is based on the type of rule the rule group is added to.

include_processes body · string

the changes performed by specific processes that will be monitored. (String). Falcon GLOB syntax is supported. macOS is not supported at this time. Allowed rule group configuration is based on the type of rule the rule group is added to.

include_users body · string

the changes performed by specific users that will be monitored. (String). Falcon GLOB syntax is supported. macOS is not supported at this time. Allowed rule group configuration is based on the type of rule the rule group is added to.

modified_timestamp body · string

path body · string

the file system or registry path to monitor. (String, 1-250 characters) All paths must end with the path separator, e.g. c:\windows\ /usr/bin/

precedence body · integer

the order in which rules will be evaluated starting with 1. Specifying a precedence value that is already set for another rule in the group will result this rule being placed before that existing rule.

rule_group_id body · string

Group ID containing the group configuration. (String)

severity body · string

to categorize change events produced by this rule. (String) Allowed values:

Available values (4)

`Low`	`Medium`	`High`
`Critical`

type body · string

watch_attributes_directory_changes body · boolean

File system directory monitoring. macOS is not supported at this time.

watch_attributes_file_changes body · boolean

File system file monitoring. macOS is not supported at this time.

watch_create_directory_changes body · boolean

File system directory monitoring.

watch_create_file_changes body · boolean

Windows registry key and value monitoring.

watch_create_key_changes body · boolean

Windows registry key and value monitoring.

watch_delete_directory_changes body · boolean

File system directory monitoring.

watch_delete_file_changes body · boolean

File system file monitoring.

watch_delete_key_changes body · boolean

Windows registry key and value monitoring.

watch_delete_value_changes body · boolean

Windows registry key and value monitoring.

watch_permissions_directory_changes body · boolean

File system directory monitoring. macOS is not supported at this time.

watch_permissions_file_changes body · boolean

File system file monitoring. macOS is not supported at this time.

watch_permissions_key_changes body · boolean

Windows registry key permissions monitoring.

watch_rename_directory_changes body · boolean

File system directory monitoring.

watch_rename_file_changes body · boolean

File system file monitoring.

watch_rename_key_changes body · boolean

Windows registry key and value monitoring.

watch_set_value_changes body · boolean

Windows registry key and value monitoring.

watch_write_file_changes body · boolean

File system file monitoring.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.create_rule(description="string",
                              rule_group_id="string",
                              path="string",
                              severity="string",
                              depth="string",
                              precedence=integer,
                              include="string",
                              exclude="string",
                              include_users="string",
                              exclude_users="string",
                              include_processes="string",
                              exclude_users="string",
                              exclude_processes="string",
                              content_files=id_list,
                              content_registry_values=id_list,
                              enable_content_capture=boolean,
                              enable_hash_capture=boolean,
                              watch_delete_directory_changes=boolean,
                              watch_create_directory_changes=boolean,
                              watch_rename_directory_changes=boolean,
                              watch_attributes_directory_changes=boolean,
                              watch_permissions_directory_changes=boolean,
                              watch_rename_file_changes=boolean,
                              watch_write_file_changes=boolean,
                              watch_create_file_changes=boolean,
                              watch_delete_file_changes=boolean,
                              watch_attributes_file_changes=boolean,
                              watch_permissions_file_changes=boolean,
                              watch_create_key_changes=boolean,
                              watch_delete_key_changes=boolean,
                              watch_permissions_key_changes=boolean,
                              watch_rename_key_changes=boolean,
                              watch_set_value_changes=boolean,
                              watch_delete_value_changes=boolean,
                              watch_create_file_changes=boolean)
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.createRules(description="string",
                              rule_group_id="string",
                              path="string",
                              severity="string",
                              depth="string",
                              precedence=integer,
                              include="string",
                              exclude="string",
                              include_users="string",
                              exclude_users="string",
                              include_processes="string",
                              exclude_users="string",
                              exclude_processes="string",
                              content_files=id_list,
                              content_registry_values=id_list,
                              enable_content_capture=boolean,
                              enable_hash_capture=boolean,
                              watch_delete_directory_changes=boolean,
                              watch_create_directory_changes=boolean,
                              watch_rename_directory_changes=boolean,
                              watch_attributes_directory_changes=boolean,
                              watch_permissions_directory_changes=boolean,
                              watch_rename_file_changes=boolean,
                              watch_write_file_changes=boolean,
                              watch_create_file_changes=boolean,
                              watch_delete_file_changes=boolean,
                              watch_attributes_file_changes=boolean,
                              watch_permissions_file_changes=boolean,
                              watch_create_key_changes=boolean,
                              watch_delete_key_changes=boolean,
                              watch_permissions_key_changes=boolean,
                              watch_rename_key_changes=boolean,
                              watch_set_value_changes=boolean,
                              watch_delete_value_changes=boolean,
                              watch_create_file_changes=boolean)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "content_files": ["string"],
    "content_registry_values": ["string"],
    "created_timestamp": "string",
    "depth": "string",
    "description": "string",
    "enable_content_capture": boolean,
    "enable_hash_capture": boolean,
    "exclude": "string",
    "exclude_processes": "string",
    "exclude_users": "string",
    "id": "string",
    "include": "string",
    "include_processes": "string",
    "include_users": "string",
    "modified_timestamp": "string",
    "path": "string",
    "precedence": integer,
    "rule_group_id": "string",
    "severity": "string",
    "type": "string",
    "watch_attributes_directory_changes": boolean,
    "watch_attributes_file_changes": boolean,
    "watch_create_directory_changes": boolean,
    "watch_create_file_changes": boolean,
    "watch_create_key_changes": boolean,
    "watch_delete_directory_changes": boolean,
    "watch_delete_file_changes": boolean,
    "watch_delete_key_changes": boolean,
    "watch_delete_value_changes": boolean,
    "watch_permissions_directory_changes": boolean,
    "watch_permissions_file_changes": boolean,
    "watch_permissions_key_changes": boolean,
    "watch_rename_directory_changes": boolean,
    "watch_rename_file_changes": boolean,
    "watch_rename_key_changes": boolean,
    "watch_set_value_changes": boolean,
    "watch_write_file_changes": boolean
}

response = falcon.command("createRules", body=body_payload)
print(response)

New-FalconFileVantageRule -Precedence integer `
  -Path "string" `
  -RuleGroupId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  created_timestamp := "string"
  depth := "string"
  description := "string"
  enable_content_capture := boolean
  enable_hash_capture := boolean
  exclude := "string"
  exclude_processes := "string"
  exclude_users := "string"
  id := "string"
  include := "string"
  include_processes := "string"
  include_users := "string"
  modified_timestamp := "string"
  path := "string"
  precedence := integer
  rule_group_id := "string"
  severity := "string"
  typeVar := "string"
  watch_attributes_directory_changes := boolean
  watch_attributes_file_changes := boolean
  watch_create_directory_changes := boolean
  watch_create_file_changes := boolean
  watch_create_key_changes := boolean
  watch_delete_directory_changes := boolean
  watch_delete_file_changes := boolean
  watch_delete_key_changes := boolean
  watch_delete_value_changes := boolean
  watch_permissions_directory_changes := boolean
  watch_permissions_file_changes := boolean
  watch_permissions_key_changes := boolean
  watch_rename_directory_changes := boolean
  watch_rename_file_changes := boolean
  watch_rename_key_changes := boolean
  watch_set_value_changes := boolean
  watch_write_file_changes := boolean

  response, err := client.Filevantage.CreateRules(
    &filevantage.CreateRulesParams{
      Body: &models.RulegroupsRule{
        ContentFiles: []string{"string"},
        ContentRegistryValues: []string{"string"},
        CreatedTimestamp: &created_timestamp,
        Depth: &depth,
        Description: &description,
        EnableContentCapture: &enable_content_capture,
        EnableHashCapture: &enable_hash_capture,
        Exclude: &exclude,
        ExcludeProcesses: &exclude_processes,
        ExcludeUsers: &exclude_users,
        ID: &id,
        Include: &include,
        IncludeProcesses: &include_processes,
        IncludeUsers: &include_users,
        ModifiedTimestamp: &modified_timestamp,
        Path: &path,
        Precedence: &precedence,
        RuleGroupID: &rule_group_id,
        Severity: &severity,
        Type: &typeVar,
        WatchAttributesDirectoryChanges: &watch_attributes_directory_changes,
        WatchAttributesFileChanges: &watch_attributes_file_changes,
        WatchCreateDirectoryChanges: &watch_create_directory_changes,
        WatchCreateFileChanges: &watch_create_file_changes,
        WatchCreateKeyChanges: &watch_create_key_changes,
        WatchDeleteDirectoryChanges: &watch_delete_directory_changes,
        WatchDeleteFileChanges: &watch_delete_file_changes,
        WatchDeleteKeyChanges: &watch_delete_key_changes,
        WatchDeleteValueChanges: &watch_delete_value_changes,
        WatchPermissionsDirectoryChanges: &watch_permissions_directory_changes,
        WatchPermissionsFileChanges: &watch_permissions_file_changes,
        WatchPermissionsKeyChanges: &watch_permissions_key_changes,
        WatchRenameDirectoryChanges: &watch_rename_directory_changes,
        WatchRenameFileChanges: &watch_rename_file_changes,
        WatchRenameKeyChanges: &watch_rename_key_changes,
        WatchSetValueChanges: &watch_set_value_changes,
        WatchWriteFileChanges: &watch_write_file_changes,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.createRules(
  {
    contentFiles: [],
    contentRegistryValues: [],
    createdTimestamp: "string",
    depth: "string",
    description: "string",
    enableContentCapture: boolean,
    enableHashCapture: boolean,
    exclude: "string",
    excludeProcesses: "string",
    excludeUsers: "string",
    id: "string",
    include: "string",
    includeProcesses: "string",
    includeUsers: "string",
    modifiedTimestamp: "string",
    path: "string",
    precedence: integer,
    ruleGroupId: "string",
    severity: "string",
    type: "string",
    watchAttributesDirectoryChanges: boolean,
    watchAttributesFileChanges: boolean,
    watchCreateDirectoryChanges: boolean,
    watchCreateFileChanges: boolean,
    watchCreateKeyChanges: boolean,
    watchDeleteDirectoryChanges: boolean,
    watchDeleteFileChanges: boolean,
    watchDeleteKeyChanges: boolean,
    watchDeleteValueChanges: boolean,
    watchPermissionsDirectoryChanges: boolean,
    watchPermissionsFileChanges: boolean,
    watchPermissionsKeyChanges: boolean,
    watchRenameDirectoryChanges: boolean,
    watchRenameFileChanges: boolean,
    watchRenameKeyChanges: boolean,
    watchSetValueChanges: boolean,
    watchWriteFileChanges: boolean
}  // body
);

console.log(response);

use rusty_falcon::apis::filevantage_api::create_rules;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RulegroupsRule;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RulegroupsRule {
        depth: Some("string".to_string()),
        id: Some("string".to_string()),
        include: Some("string".to_string()),
        path: Some("string".to_string()),
        rule_group_id: Some("string".to_string()),
        severity: Some("string".to_string()),
        type: Some("string".to_string()),
        ..Default::default()
    };

    let response = create_rules(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

body = {
  content_files: [],
  content_registry_values: [],
  created_timestamp: 'string',
  depth: 'string',
  description: 'string',
  enable_content_capture: boolean,
  enable_hash_capture: boolean,
  exclude: 'string',
  exclude_processes: 'string',
  exclude_users: 'string',
  id: 'string',
  include: 'string',
  include_processes: 'string',
  include_users: 'string',
  modified_timestamp: 'string',
  path: 'string',
  precedence: integer,
  rule_group_id: 'string',
  severity: 'string',
  type: 'string',
  watch_attributes_directory_changes: boolean,
  watch_attributes_file_changes: boolean,
  watch_create_directory_changes: boolean,
  watch_create_file_changes: boolean,
  watch_create_key_changes: boolean,
  watch_delete_directory_changes: boolean,
  watch_delete_file_changes: boolean,
  watch_delete_key_changes: boolean,
  watch_delete_value_changes: boolean,
  watch_permissions_directory_changes: boolean,
  watch_permissions_file_changes: boolean,
  watch_permissions_key_changes: boolean,
  watch_rename_directory_changes: boolean,
  watch_rename_file_changes: boolean,
  watch_rename_key_changes: boolean,
  watch_set_value_changes: boolean,
  watch_write_file_changes: boolean
}

response = api.create_rules(body)

puts response

Responses

[
  {
    "content_files": [],
    "content_registry_values": [],
    "created_timestamp": "string",
    "depth": "string",
    "description": "string",
    "enable_content_capture": false,
    "enable_hash_capture": false,
    "exclude": "string",
    "exclude_processes": "string",
    "exclude_users": "string",
    "id": "string",
    "include": "string",
    "include_processes": "string",
    "include_users": "string",
    "modified_timestamp": "string",
    "path": "string",
    "precedence": 0,
    "rule_group_id": "string",
    "severity": "string",
    "type": "string",
    "watch_attributes_directory_changes": false,
    "watch_attributes_file_changes": false,
    "watch_create_directory_changes": false,
    "watch_create_file_changes": false,
    "watch_create_key_changes": false,
    "watch_delete_directory_changes": false,
    "watch_delete_file_changes": false,
    "watch_delete_key_changes": false,
    "watch_delete_value_changes": false,
    "watch_permissions_directory_changes": false,
    "watch_permissions_file_changes": false,
    "watch_permissions_key_changes": false,
    "watch_rename_directory_changes": false,
    "watch_rename_file_changes": false,
    "watch_rename_key_changes": false,
    "watch_set_value_changes": false,
    "watch_write_file_changes": false
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

createScheduledExclusions

Creates a new scheduled exclusion configuration for the provided policy id.

Method POST

Route /filevantage/entities/policy-scheduled-exclusions/v1

Scope Falcon FileVantage: WRITE

PEP 8 create_scheduled_exclusions

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

description body · string

The scheduled exclusion description. (String, 0-500 characters.)

name body · string

Name of the scheduled exclusion. (String, 1-100 characters.)

policy_id body · string

ID of the policy the scheduled exclusion is assigned. (String)

processes body · string

Comma delimited list of processes to NOT monitor changes. (String, 1-500 characters) **\RunMe.exe or **/RunMe.sh excludes changes made by RunMe.exe or RunMe.sh in any location.

repeated body · object

Optionally provide to indicate the exclusion is applied repeatedly within the scheduled_start and scheduled_end time. (Dictionary)

schedule_end body · string

Indicates the end of the schedule. (String, RFC3339 format)

schedule_start body · string

Indicates the start of the schedule. (String, RFC3339 format, Required)

timezone body · string

Must be provided to indicate the TimeZone name set for the provided scheduled_start and scheduled_end values. (String) See https://en.wikipedia.org/wiki/List_of_tz_database_time_zones for values.

users body · string

Comma delimited list of users to NOT monitor changes. (String, 1-500 characters) admin* excludes changes made by all usernames that begin with admin. Falcon GLOB syntax is supported.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.create_scheduled_exclusions(description="string",
                                              name="string",
                                              policy_id="string",
                                              users="string",
                                              processes="string",
                                              repeated={},
                                              schedule_start="string",
                                              schedule_end="string",
                                              timezone="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.createScheduledExclusions(description="string",
                                            name="string",
                                            policy_id="string",
                                            users="string",
                                            processes="string",
                                            repeated={},
                                            schedule_start="string",
                                            schedule_end="string",
                                            timezone="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "name": "string",
    "policy_id": "string",
    "processes": "string",
    "repeated": {
        "all_day": boolean,
        "end_time": "string",
        "frequency": "string",
        "monthly_days": ["string"],
        "occurrence": "string",
        "start_time": "string",
        "weekly_days": ["string"]
    },
    "schedule_end": "string",
    "schedule_start": "string",
    "timezone": "string",
    "users": "string"
}

response = falcon.command("createScheduledExclusions", body=body_payload)
print(response)

New-FalconFileVantageExclusion -Name "string" `
  -ScheduleStart "string" `
  -PolicyId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  name := "string"
  policy_id := "string"
  processes := "string"
  schedule_end := "string"
  schedule_start := "string"
  timezone := "string"
  users := "string"

  response, err := client.Filevantage.CreateScheduledExclusions(
    &filevantage.CreateScheduledExclusionsParams{
      Body: &models.ScheduledexclusionsCreateRequest{
        Description: &description,
        Name: &name,
        PolicyID: &policy_id,
        Processes: &processes,
        Repeated: &struct{}{},
        ScheduleEnd: &schedule_end,
        ScheduleStart: &schedule_start,
        Timezone: &timezone,
        Users: &users,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.createScheduledExclusions(
  {
    description: "string",
    name: "string",
    policyId: "string",
    processes: "string",
    repeated: {
      allDay: boolean,
      endTime: "string",
      frequency: "string",
      monthlyDays: [],
      occurrence: "string",
      startTime: "string",
      weeklyDays: []
    },
    scheduleEnd: "string",
    scheduleStart: "string",
    timezone: "string",
    users: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::filevantage_api::create_scheduled_exclusions;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ScheduledexclusionsCreateRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ScheduledexclusionsCreateRequest {
        name: Some("string".to_string()),
        timezone: Some("string".to_string()),
        ..Default::default()
    };

    let response = create_scheduled_exclusions(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

body = {
  description: 'string',
  name: 'string',
  policy_id: 'string',
  processes: 'string',
  repeated: {
    all_day: boolean,
    end_time: 'string',
    frequency: 'string',
    monthly_days: [],
    occurrence: 'string',
    start_time: 'string',
    weekly_days: []
  },
  schedule_end: 'string',
  schedule_start: 'string',
  timezone: 'string',
  users: 'string'
}

response = api.create_scheduled_exclusions(body)

puts response

Responses

[
  {
    "created_timestamp": "string",
    "description": "string",
    "id": "string",
    "modified_timestamp": "string",
    "name": "string",
    "policy_id": "string",
    "processes": "string",
    "repeated": {},
    "schedule_end": "string",
    "schedule_start": "string",
    "timezone": "string",
    "users": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

deletePolicies

Deletes 1 or more policies.

Method DELETE

Route /filevantage/entities/policies/v1

Scope Falcon FileVantage: WRITE

PEP 8 delete_policies

Parameters

ids query · string or list of strings

One or more (up to 500) policy ids in the form of ids=ID1&ids=ID2

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_policies(ids=id_list)
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deletePolicies(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deletePolicies",
                          ids=id_list)
print(response)

Remove-FalconFileVantagePolicy -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.DeletePolicies(
    &filevantage.DeletePoliciesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.deletePolicies(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::filevantage_api::delete_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_policies(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.delete_policies(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

deleteRuleGroups

Deletes 1 or more rule groups

Method DELETE

Route /filevantage/entities/rule-groups/v1

Scope Falcon FileVantage: WRITE

PEP 8 delete_rule_groups

Parameters

ids query · string or list of strings

One or more (up to 500) rule group ids in the form of ids=ID1&ids=ID2

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_rule_groups(ids=id_list)
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteRuleGroups(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deleteRuleGroups",
                          ids=id_list)
print(response)

Remove-FalconFileVantageRuleGroup -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.DeleteRuleGroups(
    &filevantage.DeleteRuleGroupsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.deleteRuleGroups(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::filevantage_api::delete_rule_groups;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_rule_groups(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.delete_rule_groups(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

deleteRules

Deletes 1 or more rules from the specified rule group.

Method DELETE

Route /filevantage/entities/rule-groups-rules/v1

Scope Falcon FileVantage: WRITE

PEP 8 delete_rules

Parameters

rule_group_id query · string

The id of the rule group from which the rules will be deleted.

ids query · string or list of strings

One or more (up to 500) rule ids in the form of ids=ID1&ids=ID2

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_rules(ids=id_list, rule_group_id="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteRules(ids=id_list, rule_group_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deleteRules",
                          rule_group_id="string",
                          ids=id_list)
print(response)

Remove-FalconFileVantageRule -RuleGroupId "string" -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.DeleteRules(
    &filevantage.DeleteRulesParams{
      RuleGroupID: "string",
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.deleteRules(
  "string",  // ruleGroupId
  ["ID1", "ID2", "ID3"]  // ids
);

console.log(response);

use rusty_falcon::apis::filevantage_api::delete_rules;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_rules(
        &falcon.cfg,  // configuration
        "string",  // rule_group_id
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.delete_rules('string', ['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

deleteScheduledExclusions

Deletes 1 or more scheduled exclusions from the provided policy id.

Method DELETE

Route /filevantage/entities/policy-scheduled-exclusions/v1

Scope Falcon FileVantage: WRITE

PEP 8 delete_scheduled_exclusions

Parameters

policy_id query · string

ID of the policy to delete the scheduled exclusions from.

ids query · string or list of strings

One or more (up to 500) scheduled exclusion ids in the form of ids=ID1&ids=ID2.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_scheduled_exclusions(ids=id_list, policy_id="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteScheduledExclusions(ids=id_list, policy_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deleteScheduledExclusions",
                          policy_id="string",
                          ids=id_list)
print(response)

Remove-FalconFileVantageExclusion -PolicyId "string" -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.DeleteScheduledExclusions(
    &filevantage.DeleteScheduledExclusionsParams{
      PolicyID: "string",
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.deleteScheduledExclusions(
  "string",  // policyId
  ["ID1", "ID2", "ID3"]  // ids
);

console.log(response);

use rusty_falcon::apis::filevantage_api::delete_scheduled_exclusions;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_scheduled_exclusions(
        &falcon.cfg,  // configuration
        "string",  // policy_id
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.delete_scheduled_exclusions('string', ['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

getActionsMixin0

Retrieves the processing results for 1 or more actions.

Method GET

Route /filevantage/entities/actions/v1

Scope Falcon FileVantage: READ

PEP 8 get_actions

Parameters

ids query · string or list of strings

One or more actions ids in the form of ids=ID1&ids=ID2

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_actions(ids=id_list)
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getActionsMixin0(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getActionsMixin0",
                          ids=id_list)
print(response)

Get-FalconFileVantageAction -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.GetActionsMixin0(
    &filevantage.GetActionsMixin0Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.getActionsMixin0(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::filevantage_api::get_actions_mixin0;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_actions_mixin0(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.get_actions_mixin0(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "expected_change_count": 0,
    "id": "string",
    "operation_type": "string",
    "previous_change_count": 0,
    "reason": "string",
    "status": "string",
    "total_change_count": 0,
    "updated_by": "string",
    "updated_date": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

getChanges

Retrieve information on changes

Method GET

Route /filevantage/entities/changes/v2

Scope Falcon FileVantage: READ

PEP 8 get_changes

Parameters

ids query · string or list of strings

One or more change ids in the form of ids=ID1&ids=ID2. The maximum number of ids that can be requested at once is 500.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_changes(ids=id_list)
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getChanges(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getChanges",
                          ids=id_list)
print(response)

Get-FalconFileVantageChange -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.GetChanges(
    &filevantage.GetChangesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.getChanges(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::filevantage_api::get_changes;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_changes(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.get_changes(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "action_timestamp": "string",
    "action_type": "string",
    "aid": "string",
    "attributes": [],
    "cid": "string",
    "command_line": "string",
    "diff": {},
    "entity_path": "string",
    "entity_path_new": "string",
    "entity_type": "string",
    "file_size": 0,
    "grandparent_process_image_file_name": "string",
    "host": {},
    "id": "string",
    "ingestion_timestamp": "string",
    "is_from_different_mount_namespace": false,
    "is_suppressed": false,
    "oci_container_id": "string",
    "parent_process_image_file_name": "string",
    "permissions": {},
    "permissions_lin": {},
    "permissions_mac": {},
    "platform_name": "string",
    "policy": {},
    "prevalence": {},
    "process_id": "string",
    "process_image_file_name": "string",
    "real_user_id": "string",
    "severity": "string",
    "tags": [],
    "user_id": "string",
    "user_name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

getContents

Retrieves the content captured for the provided change id

Method GET

Route /filevantage/entities/change-content/v1

Scope Falcon FileVantage Content: READ

PEP 8 get_contents

Parameters

id query · string

ID of the change in the form of id=ID1

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

compress body · string

Compress the response using gzip. Defaults to False.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.get_contents(id="string", compress="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.getContents(id="string", compress="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("getContents",
                          id="string")
print(response)

Get-FalconFileVantageContent -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.GetContents(
    &filevantage.GetContentsParams{
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.getContents(
  "string",  // id
  "string"  // acceptEncoding
);

console.log(response);

use rusty_falcon::apis::filevantage_api::get_contents;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_contents(
        &falcon.cfg,  // configuration
        "string",  // id
        Some("string"),  // accept_encoding
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.get_contents('string')

puts response

Responses

{
  "after": {
    "data": "string",
    "path": "string"
  },
  "before": {
    "data": "string",
    "path": "string"
  },
  "cid": "string",
  "id": "string"
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

getPolicies

Retrieves the configuration for 1 or more policies.

Method GET

Route /filevantage/entities/policies/v1

Scope Falcon FileVantage: READ

PEP 8 get_policies

Parameters

ids query · string or list of strings

One or more (up to 500) policy ids in the form of ids=ID1&ids=ID2

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_policies(ids=id_list)
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getPolicies(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getPolicies",
                          ids=id_list)
print(response)

Get-FalconFileVantagePolicy -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.GetPolicies(
    &filevantage.GetPoliciesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.getPolicies(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::filevantage_api::get_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_policies(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.get_policies(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "host_groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform": "string",
    "precedence": 0,
    "rule_groups": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

getRuleGroups

Retrieves the rule group details for 1 or more rule groups.

Method GET

Route /filevantage/entities/rule-groups/v1

Scope Falcon FileVantage: READ

PEP 8 get_rule_groups

Parameters

ids query · string or list of strings

One or more (up to 500) rule group ids in the form of ids=ID1&ids=ID2

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rule_groups(ids=id_list)
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getRuleGroups(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getRuleGroups",
                          ids=id_list)
print(response)

Get-FalconFileVantageRuleGroup -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.GetRuleGroups(
    &filevantage.GetRuleGroupsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.getRuleGroups(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::filevantage_api::get_rule_groups;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_rule_groups(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.get_rule_groups(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "assigned_rules": [],
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "policy_assignments": [],
    "type": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

getRules

Retrieves the configuration for 1 or more rules.

Method GET

Route /filevantage/entities/rule-groups-rules/v1

Scope Falcon FileVantage: READ

PEP 8 get_rules

Parameters

rule_group_id query · string

Rule group from which to retrieve the rule configuration.

ids query · string or list of strings

One or more (up to 500) rule ids in the form of ids=ID1&ids=ID2.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rules(ids=id_list, rule_group_id="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getRules(ids=id_list, rule_group_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getRules",
                          rule_group_id="string",
                          ids=id_list)
print(response)

Get-FalconFileVantageRule -RuleGroupId "string" -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.GetRules(
    &filevantage.GetRulesParams{
      RuleGroupID: "string",
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.getRules(
  "string",  // ruleGroupId
  ["ID1", "ID2", "ID3"]  // ids
);

console.log(response);

use rusty_falcon::apis::filevantage_api::get_rules;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_rules(
        &falcon.cfg,  // configuration
        "string",  // rule_group_id
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.get_rules('string', ['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "content_files": [],
    "content_registry_values": [],
    "created_timestamp": "string",
    "depth": "string",
    "description": "string",
    "enable_content_capture": false,
    "enable_hash_capture": false,
    "exclude": "string",
    "exclude_processes": "string",
    "exclude_users": "string",
    "id": "string",
    "include": "string",
    "include_processes": "string",
    "include_users": "string",
    "modified_timestamp": "string",
    "path": "string",
    "precedence": 0,
    "rule_group_id": "string",
    "severity": "string",
    "type": "string",
    "watch_attributes_directory_changes": false,
    "watch_attributes_file_changes": false,
    "watch_create_directory_changes": false,
    "watch_create_file_changes": false,
    "watch_create_key_changes": false,
    "watch_delete_directory_changes": false,
    "watch_delete_file_changes": false,
    "watch_delete_key_changes": false,
    "watch_delete_value_changes": false,
    "watch_permissions_directory_changes": false,
    "watch_permissions_file_changes": false,
    "watch_permissions_key_changes": false,
    "watch_rename_directory_changes": false,
    "watch_rename_file_changes": false,
    "watch_rename_key_changes": false,
    "watch_set_value_changes": false,
    "watch_write_file_changes": false
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

getScheduledExclusions

Retrieves the configuration of 1 or more scheduled exclusions from the provided policy id.

Method GET

Route /filevantage/entities/policy-scheduled-exclusions/v1

Scope Falcon FileVantage: READ

PEP 8 get_scheduled_exclusions

Parameters

policy_id query · string

The id of the policy to retrieve the scheduled exclusion configurations.

ids query · string or list of strings

One or more (up to 500) scheduled exclusion ids in the form of ids=ID1&ids=ID2.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_scheduled_exclusions(ids=id_list, policy_id="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getScheduledExclusions(ids=id_list, policy_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getScheduledExclusions",
                          policy_id="string",
                          ids=id_list)
print(response)

Get-FalconFileVantageExclusion -PolicyId "string" -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.GetScheduledExclusions(
    &filevantage.GetScheduledExclusionsParams{
      PolicyID: "string",
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.getScheduledExclusions(
  "string",  // policyId
  ["ID1", "ID2", "ID3"]  // ids
);

console.log(response);

use rusty_falcon::apis::filevantage_api::get_scheduled_exclusions;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_scheduled_exclusions(
        &falcon.cfg,  // configuration
        "string",  // policy_id
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.get_scheduled_exclusions('string', ['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "created_timestamp": "string",
    "description": "string",
    "id": "string",
    "modified_timestamp": "string",
    "name": "string",
    "policy_id": "string",
    "processes": "string",
    "repeated": {},
    "schedule_end": "string",
    "schedule_start": "string",
    "timezone": "string",
    "users": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

highVolumeQueryChanges

Returns 1 or more change ids

Method GET

Route /filevantage/queries/changes/v3

Scope Falcon FileVantage: READ

PEP 8 query_changes_scroll

Parameters

after query · string

A pagination token used with the limit parameter to manage pagination of results. On your first request don’t provide a value for the after token. On subsequent requests provide the after token value from the previous response to continue pagination from where you left. If the response returns an empty after token it means there are no more results to return.

limit query · integer

The maximum number of ids to return. Defaults to 100 if not specified. The maximum number of results that can be returned in a single call is 5000.

sort query · string

Sort results using options like: - action_timestamp (timestamp of the change occurrence) Sort either asc (ascending) or desc (descending). For example: action_timestamp|asc. Defaults to action_timestamp|desc no value is specified. The full list of allowed sorting options can be reviewed in our API documentation.

Available values (1)

action_timestamp

filter query · string

Filter changes using a query in Falcon Query Language (FQL). Common filter options include:

Available values (8)

`parameters`	`can`	`be`
`reviewed`	`in`	`our`
`API`	`documentation`

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.query_changes_scroll(filter="string",
                                       limit=integer,
                                       after="string",
                                       sort="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.highVolumeQueryChanges(filter="string",
                                         limit=integer,
                                         after="string",
                                         sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("highVolumeQueryChanges",
                          after="string",
                          limit=integer,
                          sort="string",
                          filter="string")
print(response)

Get-FalconFileVantageChange -Filter "string" `
  -Sort "string" `
  -Limit integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  after := "string"
  limit := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.Filevantage.HighVolumeQueryChanges(
    &filevantage.HighVolumeQueryChangesParams{
      After: &after,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.highVolumeQueryChanges(
  "string",  // after
  integer,  // limit
  "string",  // sort
  "string"  // filter
);

console.log(response);

use rusty_falcon::apis::filevantage_api::high_volume_query_changes;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = high_volume_query_changes(
        &falcon.cfg,  // configuration
        Some("string"),  // after
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.high_volume_query_changes(after: 'string',
                                         limit: integer,
                                         sort: 'string',
                                         filter: 'string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

queryActionsMixin0

Returns one or more action ids

Method GET

Route /filevantage/queries/actions/v1

Scope Falcon FileVantage: READ

PEP 8 query_actions

Parameters

offset query · integer

The first action index to return in the response. If not provided it will default to ‘0’. Use with the limit parameter to manage pagination of results.

limit query · integer

The maximum number of actions to return in the response (default: 100; max: 500). Use with the offset parameter to manage pagination of results

sort query · string

The sort expression that should be used to sort the results (e.g. created_date|desc)

Available values (1)

created_date

filter query · string

Filter changes using a query in Falcon Query Language (FQL). Common filter options include:

Available values (8)

`parameters`	`can`	`be`
`reviewed`	`in`	`our`
`API`	`documentation`

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.query_actions(filter="string",
                                limit=integer,
                                offset=integer,
                                sort="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.queryActionsMixin0(filter="string",
                                     limit=integer,
                                     offset=integer,
                                     sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryActionsMixin0",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string")
print(response)

Get-FalconFileVantageAction -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.Filevantage.QueryActionsMixin0(
    &filevantage.QueryActionsMixin0Params{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.queryActionsMixin0(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string"  // filter
);

console.log(response);

use rusty_falcon::apis::filevantage_api::query_actions_mixin0;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_actions_mixin0(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.query_actions_mixin0(offset: integer,
                                    limit: integer,
                                    sort: 'string',
                                    filter: 'string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

queryChanges

Returns 1 or more change ids

Method GET

Route /filevantage/queries/changes/v2

Scope Falcon FileVantage: READ

PEP 8 query_changes

Parameters

offset query · integer

The offset to start retrieving records from. Defaults to 0 if not specified.

limit query · integer

The maximum number of ids to return. Defaults to 100 if not specified. The maximum number of results that can be returned in a single call is 500.

sort query · string

Sort results using options like: - action_timestamp (timestamp of the change occurrence) Sort either asc (ascending) or desc (descending). For example: action_timestamp|asc. The full list of allowed sorting options can be reviewed in our API documentation.

Available values (1)

action_timestamp

filter query · string

Filter changes using a query in Falcon Query Language (FQL). Common filter options include:

Available values (8)

`parameters`	`can`	`be`
`reviewed`	`in`	`our`
`API`	`documentation`

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.query_changes(filter="string",
                                limit=integer,
                                offset=integer,
                                sort="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.queryChanges(filter="string",
                               limit=integer,
                               offset=integer,
                               sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryChanges",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.Filevantage.QueryChanges(
    &filevantage.QueryChangesParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.queryChanges(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string"  // filter
);

console.log(response);

use rusty_falcon::apis::filevantage_api::query_changes;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_changes(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.query_changes(offset: integer,
                             limit: integer,
                             sort: 'string',
                             filter: 'string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

queryPolicies

Retrieve the ids of all policies that are assigned the provided policy type.

Method GET

Route /filevantage/queries/policies/v1

Scope Falcon FileVantage: READ

PEP 8 query_policies

Parameters

offset query · integer

The offset to start retrieving records from. Defaults to 0 if not specified.

limit query · integer

The maximum number of ids to return. Defaults to 100 if not specified. The maximum number of results that can be returned in a single call is 500.

sort query · string

Sort the returned ids based on one of:

Available values (2)

the following

type query · string

The types of policies to retrieve. Allowed values are:

Available values (3)

Windows Linux Mac

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.query_policies(limit=integer,
                                 offset=integer,
                                 sort="string",
                                 type="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.queryPolicies(limit=integer,
                                offset=integer,
                                sort="string",
                                type="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryPolicies",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          type="string")
print(response)

Get-FalconFileVantagePolicy -Type "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.Filevantage.QueryPolicies(
    &filevantage.QueryPoliciesParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Type: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.queryPolicies(
  "string",  // type
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::filevantage_api::query_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_policies(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.query_policies('string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

queryRuleGroups

Retrieve the ids of all rule groups that are of the provided rule group type.

Method GET

Route /filevantage/queries/rule-groups/v1

Scope Falcon FileVantage: READ

PEP 8 query_rule_groups

Parameters

offset query · integer

The offset to start retrieving records from. Defaults to 0 if not specified.

limit query · integer

The maximum number of ids to return. Defaults to 100 if not specified. The maximum number of results that can be returned in a single call is 500.

sort query · string

Sort the returned ids based on one of:

Available values (2)

the following

type query · string

The rule group type to retrieve the ids of. Allowed values are:

Available values (4)

`WindowsFiles`	`WindowsRegistry`	`LinuxFiles`
`MacFiles`

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.query_rule_groups(limit=integer,
                                    offset=integer,
                                    sort="string",
                                    type="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.queryRuleGroups(limit=integer,
                                  offset=integer,
                                  sort="string",
                                  type="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryRuleGroups",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          type="string")
print(response)

Get-FalconFileVantageRuleGroup -Type "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.Filevantage.QueryRuleGroups(
    &filevantage.QueryRuleGroupsParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Type: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.queryRuleGroups(
  "string",  // type
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::filevantage_api::query_rule_groups;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_rule_groups(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.query_rule_groups('string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

queryScheduledExclusions

Retrieve the ids of all scheduled exclusions contained within the provided policy id.

Method GET

Route /filevantage/queries/policy-scheduled-exclusions/v1

Scope Falcon FileVantage: READ

PEP 8 query_scheduled_exclusions

Parameters

policy_id query · string

The id of the policy from which to retrieve the scheduled exclusion ids.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.query_scheduled_exclusions(policy_id="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.queryScheduledExclusions(policy_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryScheduledExclusions",
                          policy_id="string")
print(response)

Get-FalconFileVantageExclusion -PolicyId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.QueryScheduledExclusions(
    &filevantage.QueryScheduledExclusionsParams{
      PolicyID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.queryScheduledExclusions("string");  // policyId

console.log(response);

use rusty_falcon::apis::filevantage_api::query_scheduled_exclusions;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_scheduled_exclusions(
        &falcon.cfg,  // configuration
        "string",  // policy_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.query_scheduled_exclusions('string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

signalChangesExternal

Initiates workflows for the provided change ids

Method POST

Route /filevantage/entities/workflow/v1

Scope Falcon FileVantage: WRITE

PEP 8 signal_changes

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

ids body · array

Action IDs to retrieve.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.signal_changes(ids=id_list)
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.signalChangesExternal(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "ids": ["string"]
}

response = falcon.command("signalChangesExternal", body=body_payload)
print(response)

Invoke-FalconFileVantageWorkflow -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.SignalChangesExternal(
    &filevantage.SignalChangesExternalParams{
      Body: &models.WorkflowRequest{
        Ids: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.signalChangesExternal(
  {
    ids: []
}  // body
);

console.log(response);

use rusty_falcon::apis::filevantage_api::signal_changes_external;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::WorkflowRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = WorkflowRequest {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = signal_changes_external(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

body = Falcon::WorkflowRequest.new(
  ids: []
)

response = api.signal_changes_external(body)

puts response

Responses

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "ids": [
    "string"
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

startActions

Initiates the specified action on the provided change ids

Method POST

Route /filevantage/entities/actions/v1

Scope Falcon FileVantage: WRITE

PEP 8 start_actions

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

change_ids body · array

Represents the IDs of the changes the operation will perform. Limited to 100 IDs per action.

comment body · string

OPtional comment to describe the reason for the action.

operation body · string

Operation to perform. Allowed values:

Available values (3)

suppress unsuppress purge

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.start_actions(change_ids=id_list,
                                comment="string",
                                operation="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.startActions(change_ids=id_list,
                               comment="string",
                               operation="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "change_ids": ["string"],
    "comment": "string",
    "operation": "string"
}

response = falcon.command("startActions", body=body_payload)
print(response)

Invoke-FalconFileVantageAction -Name "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  operation := "string"

  response, err := client.Filevantage.StartActions(
    &filevantage.StartActionsParams{
      Body: &models.ActionsCreateActionRequest{
        ChangeIds: []string{"string"},
        Comment: &comment,
        Operation: &operation,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.startActions(
  {
    changeIds: [],
    comment: "string",
    operation: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::filevantage_api::start_actions;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ActionsCreateActionRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ActionsCreateActionRequest {
        change_ids: vec!["string".to_string()],
        operation: Some("string".to_string()),
        ..Default::default()
    };

    let response = start_actions(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

body = Falcon::ActionsCreateActionRequest.new(
  change_ids: [],
  comment: 'string',
  operation: 'string'
)

response = api.start_actions(body)

puts response

Responses

{
  "action_id": "string",
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

updatePolicies

Updates the general information of the provided policy.

Method PATCH

Route /filevantage/entities/policies/v1

Scope Falcon FileVantage: WRITE

PEP 8 update_policies

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

description body · string

The policy description. (String, 0-500 characters.)

enabled body · boolean

Enablement status of the policy.

id body · string

ID of the policy to be updated. (String)

name body · string

Name of the policy. (String, 1-100 characters.)

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.update_policies(description="string",
                                  id="string",
                                  name="string",
                                  enabled=boolean)
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.updatePolicies(description="string",
                                 id="string",
                                 name="string",
                                 enabled=boolean)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "enabled": boolean,
    "id": "string",
    "name": "string"
}

response = falcon.command("updatePolicies", body=body_payload)
print(response)

Edit-FalconFileVantagePolicy -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  enabled := boolean
  id := "string"
  name := "string"

  response, err := client.Filevantage.UpdatePolicies(
    &filevantage.UpdatePoliciesParams{
      Body: &models.PoliciesUpdateRequest{
        Description: &description,
        Enabled: &enabled,
        ID: &id,
        Name: &name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.updatePolicies(
  {
    description: "string",
    enabled: boolean,
    id: "string",
    name: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::filevantage_api::update_policies;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::PoliciesUpdateRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = PoliciesUpdateRequest {
        id: Some("string".to_string()),
        ..Default::default()
    };

    let response = update_policies(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

body = {
  description: 'string',
  enabled: boolean,
  id: 'string',
  name: 'string'
}

response = api.update_policies(body)

puts response

Responses

[
  {
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "host_groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform": "string",
    "precedence": 0,
    "rule_groups": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

updatePolicyHostGroups

Manage host groups assigned to a policy.

Method PATCH

Route /filevantage/entities/policies-host-groups/v1

Scope Falcon FileVantage: WRITE

PEP 8 update_policy_host_groups

Parameters

policy_id query · string

The id of the policy for which to perform the action.

action query · string

The action to perform with the provided ids, must be one of:

Available values (2)

assign unassign

ids query · string or list of strings

One or more host group ids in the form of ids=ID1&ids=ID2

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_policy_host_groups(action="string",
                                            policy_id="string",
                                            ids=id_list)
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.updatePolicyHostGroups(action="string",
                                         policy_id="string",
                                         ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("updatePolicyHostGroups",
                          policy_id="string",
                          action="string",
                          ids=id_list)
print(response)

Remove-FalconFileVantageHostGroup -PolicyId "string" -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.UpdatePolicyHostGroups(
    &filevantage.UpdatePolicyHostGroupsParams{
      PolicyID: "string",
      Action: "string",
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.updatePolicyHostGroups(
  "string",  // policyId
  "string",  // action
  ["ID1", "ID2", "ID3"]  // ids
);

console.log(response);

use rusty_falcon::apis::filevantage_api::update_policy_host_groups;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = update_policy_host_groups(
        &falcon.cfg,  // configuration
        "string",  // policy_id
        "string",  // action
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.update_policy_host_groups('string', 'string', ['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "host_groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform": "string",
    "precedence": 0,
    "rule_groups": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

updatePolicyPrecedence

Updates the policy precedence for all policies of a specific type.

Method PATCH

Route /filevantage/entities/policies-precedence/v1

Scope Falcon FileVantage: WRITE

PEP 8 update_policy_precedence

Parameters

ids query · string or list of strings

Precedence of the policies for the provided type in the form of ids=ID1&ids=ID2

type query · string

The policy type for which to set the precedence order, must be one of:

Available values (3)

Windows Linux Mac

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_policy_precedence(type="string", ids=id_list)
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.updatePolicyPrecedence(type="string", ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("updatePolicyPrecedence",
                          ids=id_list,
                          type="string")
print(response)

Set-FalconFileVantagePrecedence -Type "string" -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.UpdatePolicyPrecedence(
    &filevantage.UpdatePolicyPrecedenceParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Type: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.updatePolicyPrecedence(
  ["ID1", "ID2", "ID3"],  // ids
  "string"  // type
);

console.log(response);

use rusty_falcon::apis::filevantage_api::update_policy_precedence;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = update_policy_precedence(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.update_policy_precedence(['ID1', 'ID2', 'ID3'], 'string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

updatePolicyRuleGroups

Manage the rule groups assigned to the policy or set the rule group precedence for all rule groups within the policy.

Method PATCH

Route /filevantage/entities/policies-rule-groups/v1

Scope Falcon FileVantage: WRITE

PEP 8 update_policy_rule_groups

Parameters

policy_id query · string

The id of the policy for which to perform the action.

action query · string

The action to perform with the provided ids, must be one of:

Available values (3)

assign unassign precedence

ids query · string or list of strings

One or more rule group ids in the form of ids=ID1&ids=ID2. Note, for the precedence action, precedence is controlled by the order of the ids as they are specified in the request.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_policy_rule_groups(action="string",
                                            policy_id="string",
                                            ids=id_list)
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.updatePolicyRuleGroups(action="string",
                                         policy_id="string",
                                         ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("updatePolicyRuleGroups",
                          policy_id="string",
                          action="string",
                          ids=id_list)
print(response)

Set-FalconFileVantageRuleGroupPrecedence -PolicyId "string" -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.UpdatePolicyRuleGroups(
    &filevantage.UpdatePolicyRuleGroupsParams{
      PolicyID: "string",
      Action: "string",
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.updatePolicyRuleGroups(
  "string",  // policyId
  "string",  // action
  ["ID1", "ID2", "ID3"]  // ids
);

console.log(response);

use rusty_falcon::apis::filevantage_api::update_policy_rule_groups;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = update_policy_rule_groups(
        &falcon.cfg,  // configuration
        "string",  // policy_id
        "string",  // action
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.update_policy_rule_groups('string', 'string', ['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "host_groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform": "string",
    "precedence": 0,
    "rule_groups": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

updateRuleGroupPrecedence

Updates the rule precedence for all rules in the identified rule group.

Method PATCH

Route /filevantage/entities/rule-groups-rule-precedence/v1

Scope Falcon FileVantage: WRITE

PEP 8 update_rule_group_precedence

Parameters

rule_group_id query · string

Rule group from which to set the precedence.

ids query · string or list of strings

One or more (up to 500) rule group ids in the form of ids=ID1&ids=ID2.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_rule_group_precedence(ids=id_list,
                                               rule_group_id="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.updateRuleGroupPrecedence(ids=id_list, rule_group_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("updateRuleGroupPrecedence",
                          rule_group_id="string",
                          ids=id_list)
print(response)

Set-FalconFileVantageRulePrecedence -RuleGroupId "string" -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.UpdateRuleGroupPrecedence(
    &filevantage.UpdateRuleGroupPrecedenceParams{
      RuleGroupID: "string",
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.updateRuleGroupPrecedence(
  "string",  // ruleGroupId
  ["ID1", "ID2", "ID3"]  // ids
);

console.log(response);

use rusty_falcon::apis::filevantage_api::update_rule_group_precedence;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = update_rule_group_precedence(
        &falcon.cfg,  // configuration
        "string",  // rule_group_id
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.update_rule_group_precedence('string', ['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "assigned_rules": [],
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "policy_assignments": [],
    "type": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

updateRuleGroups

Updates the provided rule group.

Method PATCH

Route /filevantage/entities/rule-groups/v1

Scope Falcon FileVantage: WRITE

PEP 8 update_rule_group

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

description body · string

The rule group description. (String, 0-500 characters.)

id body · string

ID of the rule group to be updated. (String)

name body · string

Name of the rule group. (String, 1-100 characters.)

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.update_rule_group(description="string",
                                    id="string",
                                    name="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.updateRuleGroups(description="string",
                                   id="string",
                                   name="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "id": "string",
    "name": "string"
}

response = falcon.command("updateRuleGroups", body=body_payload)
print(response)

Edit-FalconFileVantageRuleGroup -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  id := "string"
  name := "string"

  response, err := client.Filevantage.UpdateRuleGroups(
    &filevantage.UpdateRuleGroupsParams{
      Body: &models.RulegroupsUpdateRequest{
        Description: &description,
        ID: &id,
        Name: &name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.updateRuleGroups(
  {
    description: "string",
    id: "string",
    name: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::filevantage_api::update_rule_groups;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RulegroupsUpdateRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RulegroupsUpdateRequest {
        id: Some("string".to_string()),
        name: Some("string".to_string()),
        ..Default::default()
    };

    let response = update_rule_groups(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

body = {
  description: 'string',
  id: 'string',
  name: 'string'
}

response = api.update_rule_groups(body)

puts response

Responses

[
  {
    "assigned_rules": [],
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "policy_assignments": [],
    "type": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

updateRules

Updates the provided rule configuration within the specified rule group.

Method PATCH

Route /filevantage/entities/rule-groups-rules/v1

Scope Falcon FileVantage: WRITE

PEP 8 update_rule

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

content_files body · array

the files whose content will be monitored. (String). Listed files must match the file include pattern and not match the file exclude pattern.

content_registry_values body · array

the registry values whose content will be monitored. (String). Listed registry values must match the registry include pattern and not match the registry exclude pattern.

created_timestamp body · string

depth body · string

recursion levels below the base path to monitor. (String) Allowed values:

Available values (6)

`1`	`2`	`3`
`4`	`5`	`ANY`

description body · string

The rule description. (String, 0-500 characters.)

enable_content_capture body · boolean

Enable content capturing.

enable_hash_capture body · boolean

Enable hash capturing.

exclude body · string

exclude_processes body · string

exclude_users body · string

id body · string

ID of the rule to be updated. (String)

include body · string

include_processes body · string

include_users body · string

modified_timestamp body · string

path body · string

the file system or registry path to monitor. (String, 1-250 characters) All paths must end with the path separator, e.g. c:\windows\ /usr/bin/

precedence body · integer

rule_group_id body · string

Group ID containing the group configuration. (String)

severity body · string

to categorize change events produced by this rule. (String) Allowed values:

Available values (4)

`Low`	`Medium`	`High`
`Critical`

type body · string

watch_attributes_directory_changes body · boolean

File system directory monitoring. macOS is not supported at this time.

watch_attributes_file_changes body · boolean

File system file monitoring. macOS is not supported at this time.

watch_create_directory_changes body · boolean

File system directory monitoring.

watch_create_file_changes body · boolean

Windows registry key and value monitoring.

watch_create_key_changes body · boolean

Windows registry key and value monitoring.

watch_delete_directory_changes body · boolean

File system directory monitoring.

watch_delete_file_changes body · boolean

File system file monitoring.

watch_delete_key_changes body · boolean

Windows registry key and value monitoring.

watch_delete_value_changes body · boolean

Windows registry key and value monitoring.

watch_permissions_directory_changes body · boolean

File system directory monitoring. macOS is not supported at this time.

watch_permissions_file_changes body · boolean

File system file monitoring. macOS is not supported at this time.

watch_permissions_key_changes body · boolean

watch_rename_directory_changes body · boolean

File system directory monitoring.

watch_rename_file_changes body · boolean

File system file monitoring.

watch_rename_key_changes body · boolean

Windows registry key and value monitoring.

watch_set_value_changes body · boolean

Windows registry key and value monitoring.

watch_write_file_changes body · boolean

File system file monitoring.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_rule(description="string",
                              id="string",
                              rule_group_id="string",
                              path="string",
                              severity="string",
                              depth="string",
                              precedence=integer,
                              include="string",
                              exclude="string",
                              include_users="string",
                              exclude_users="string",
                              include_processes="string",
                              exclude_users="string",
                              exclude_processes="string",
                              content_files=id_list,
                              content_registry_values=id_list,
                              enable_content_capture=boolean,
                              enable_hash_capture=boolean,
                              watch_delete_directory_changes=boolean,
                              watch_create_directory_changes=boolean,
                              watch_rename_directory_changes=boolean,
                              watch_attributes_directory_changes=boolean,
                              watch_permissions_directory_changes=boolean,
                              watch_rename_file_changes=boolean,
                              watch_write_file_changes=boolean,
                              watch_create_file_changes=boolean,
                              watch_delete_file_changes=boolean,
                              watch_attributes_file_changes=boolean,
                              watch_permissions_file_changes=boolean,
                              watch_create_key_changes=boolean,
                              watch_delete_key_changes=boolean,
                              watch_rename_key_changes=boolean,
                              watch_set_value_changes=boolean,
                              watch_delete_value_changes=boolean,
                              watch_create_file_changes=boolean)
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.updateRules(description="string",
                              id="string",
                              rule_group_id="string",
                              path="string",
                              severity="string",
                              depth="string",
                              precedence=integer,
                              include="string",
                              exclude="string",
                              include_users="string",
                              exclude_users="string",
                              include_processes="string",
                              exclude_users="string",
                              exclude_processes="string",
                              content_files=id_list,
                              content_registry_values=id_list,
                              enable_content_capture=boolean,
                              enable_hash_capture=boolean,
                              watch_delete_directory_changes=boolean,
                              watch_create_directory_changes=boolean,
                              watch_rename_directory_changes=boolean,
                              watch_attributes_directory_changes=boolean,
                              watch_permissions_directory_changes=boolean,
                              watch_rename_file_changes=boolean,
                              watch_write_file_changes=boolean,
                              watch_create_file_changes=boolean,
                              watch_delete_file_changes=boolean,
                              watch_attributes_file_changes=boolean,
                              watch_permissions_file_changes=boolean,
                              watch_create_key_changes=boolean,
                              watch_delete_key_changes=boolean,
                              watch_rename_key_changes=boolean,
                              watch_set_value_changes=boolean,
                              watch_delete_value_changes=boolean,
                              watch_create_file_changes=boolean)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "content_files": ["string"],
    "content_registry_values": ["string"],
    "created_timestamp": "string",
    "depth": "string",
    "description": "string",
    "enable_content_capture": boolean,
    "enable_hash_capture": boolean,
    "exclude": "string",
    "exclude_processes": "string",
    "exclude_users": "string",
    "id": "string",
    "include": "string",
    "include_processes": "string",
    "include_users": "string",
    "modified_timestamp": "string",
    "path": "string",
    "precedence": integer,
    "rule_group_id": "string",
    "severity": "string",
    "type": "string",
    "watch_attributes_directory_changes": boolean,
    "watch_attributes_file_changes": boolean,
    "watch_create_directory_changes": boolean,
    "watch_create_file_changes": boolean,
    "watch_create_key_changes": boolean,
    "watch_delete_directory_changes": boolean,
    "watch_delete_file_changes": boolean,
    "watch_delete_key_changes": boolean,
    "watch_delete_value_changes": boolean,
    "watch_permissions_directory_changes": boolean,
    "watch_permissions_file_changes": boolean,
    "watch_permissions_key_changes": boolean,
    "watch_rename_directory_changes": boolean,
    "watch_rename_file_changes": boolean,
    "watch_rename_key_changes": boolean,
    "watch_set_value_changes": boolean,
    "watch_write_file_changes": boolean
}

response = falcon.command("updateRules", body=body_payload)
print(response)

Edit-FalconFileVantageRule -Id "string" `
  -Precedence integer `
  -RuleGroupId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  created_timestamp := "string"
  depth := "string"
  description := "string"
  enable_content_capture := boolean
  enable_hash_capture := boolean
  exclude := "string"
  exclude_processes := "string"
  exclude_users := "string"
  id := "string"
  include := "string"
  include_processes := "string"
  include_users := "string"
  modified_timestamp := "string"
  path := "string"
  precedence := integer
  rule_group_id := "string"
  severity := "string"
  typeVar := "string"
  watch_attributes_directory_changes := boolean
  watch_attributes_file_changes := boolean
  watch_create_directory_changes := boolean
  watch_create_file_changes := boolean
  watch_create_key_changes := boolean
  watch_delete_directory_changes := boolean
  watch_delete_file_changes := boolean
  watch_delete_key_changes := boolean
  watch_delete_value_changes := boolean
  watch_permissions_directory_changes := boolean
  watch_permissions_file_changes := boolean
  watch_permissions_key_changes := boolean
  watch_rename_directory_changes := boolean
  watch_rename_file_changes := boolean
  watch_rename_key_changes := boolean
  watch_set_value_changes := boolean
  watch_write_file_changes := boolean

  response, err := client.Filevantage.UpdateRules(
    &filevantage.UpdateRulesParams{
      Body: &models.RulegroupsRule{
        ContentFiles: []string{"string"},
        ContentRegistryValues: []string{"string"},
        CreatedTimestamp: &created_timestamp,
        Depth: &depth,
        Description: &description,
        EnableContentCapture: &enable_content_capture,
        EnableHashCapture: &enable_hash_capture,
        Exclude: &exclude,
        ExcludeProcesses: &exclude_processes,
        ExcludeUsers: &exclude_users,
        ID: &id,
        Include: &include,
        IncludeProcesses: &include_processes,
        IncludeUsers: &include_users,
        ModifiedTimestamp: &modified_timestamp,
        Path: &path,
        Precedence: &precedence,
        RuleGroupID: &rule_group_id,
        Severity: &severity,
        Type: &typeVar,
        WatchAttributesDirectoryChanges: &watch_attributes_directory_changes,
        WatchAttributesFileChanges: &watch_attributes_file_changes,
        WatchCreateDirectoryChanges: &watch_create_directory_changes,
        WatchCreateFileChanges: &watch_create_file_changes,
        WatchCreateKeyChanges: &watch_create_key_changes,
        WatchDeleteDirectoryChanges: &watch_delete_directory_changes,
        WatchDeleteFileChanges: &watch_delete_file_changes,
        WatchDeleteKeyChanges: &watch_delete_key_changes,
        WatchDeleteValueChanges: &watch_delete_value_changes,
        WatchPermissionsDirectoryChanges: &watch_permissions_directory_changes,
        WatchPermissionsFileChanges: &watch_permissions_file_changes,
        WatchPermissionsKeyChanges: &watch_permissions_key_changes,
        WatchRenameDirectoryChanges: &watch_rename_directory_changes,
        WatchRenameFileChanges: &watch_rename_file_changes,
        WatchRenameKeyChanges: &watch_rename_key_changes,
        WatchSetValueChanges: &watch_set_value_changes,
        WatchWriteFileChanges: &watch_write_file_changes,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.updateRules(
  {
    contentFiles: [],
    contentRegistryValues: [],
    createdTimestamp: "string",
    depth: "string",
    description: "string",
    enableContentCapture: boolean,
    enableHashCapture: boolean,
    exclude: "string",
    excludeProcesses: "string",
    excludeUsers: "string",
    id: "string",
    include: "string",
    includeProcesses: "string",
    includeUsers: "string",
    modifiedTimestamp: "string",
    path: "string",
    precedence: integer,
    ruleGroupId: "string",
    severity: "string",
    type: "string",
    watchAttributesDirectoryChanges: boolean,
    watchAttributesFileChanges: boolean,
    watchCreateDirectoryChanges: boolean,
    watchCreateFileChanges: boolean,
    watchCreateKeyChanges: boolean,
    watchDeleteDirectoryChanges: boolean,
    watchDeleteFileChanges: boolean,
    watchDeleteKeyChanges: boolean,
    watchDeleteValueChanges: boolean,
    watchPermissionsDirectoryChanges: boolean,
    watchPermissionsFileChanges: boolean,
    watchPermissionsKeyChanges: boolean,
    watchRenameDirectoryChanges: boolean,
    watchRenameFileChanges: boolean,
    watchRenameKeyChanges: boolean,
    watchSetValueChanges: boolean,
    watchWriteFileChanges: boolean
}  // body
);

console.log(response);

use rusty_falcon::apis::filevantage_api::update_rules;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RulegroupsRule;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RulegroupsRule {
        depth: Some("string".to_string()),
        id: Some("string".to_string()),
        include: Some("string".to_string()),
        path: Some("string".to_string()),
        rule_group_id: Some("string".to_string()),
        severity: Some("string".to_string()),
        type: Some("string".to_string()),
        ..Default::default()
    };

    let response = update_rules(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

body = {
  content_files: [],
  content_registry_values: [],
  created_timestamp: 'string',
  depth: 'string',
  description: 'string',
  enable_content_capture: boolean,
  enable_hash_capture: boolean,
  exclude: 'string',
  exclude_processes: 'string',
  exclude_users: 'string',
  id: 'string',
  include: 'string',
  include_processes: 'string',
  include_users: 'string',
  modified_timestamp: 'string',
  path: 'string',
  precedence: integer,
  rule_group_id: 'string',
  severity: 'string',
  type: 'string',
  watch_attributes_directory_changes: boolean,
  watch_attributes_file_changes: boolean,
  watch_create_directory_changes: boolean,
  watch_create_file_changes: boolean,
  watch_create_key_changes: boolean,
  watch_delete_directory_changes: boolean,
  watch_delete_file_changes: boolean,
  watch_delete_key_changes: boolean,
  watch_delete_value_changes: boolean,
  watch_permissions_directory_changes: boolean,
  watch_permissions_file_changes: boolean,
  watch_permissions_key_changes: boolean,
  watch_rename_directory_changes: boolean,
  watch_rename_file_changes: boolean,
  watch_rename_key_changes: boolean,
  watch_set_value_changes: boolean,
  watch_write_file_changes: boolean
}

response = api.update_rules(body)

puts response

Responses

[
  {
    "content_files": [],
    "content_registry_values": [],
    "created_timestamp": "string",
    "depth": "string",
    "description": "string",
    "enable_content_capture": false,
    "enable_hash_capture": false,
    "exclude": "string",
    "exclude_processes": "string",
    "exclude_users": "string",
    "id": "string",
    "include": "string",
    "include_processes": "string",
    "include_users": "string",
    "modified_timestamp": "string",
    "path": "string",
    "precedence": 0,
    "rule_group_id": "string",
    "severity": "string",
    "type": "string",
    "watch_attributes_directory_changes": false,
    "watch_attributes_file_changes": false,
    "watch_create_directory_changes": false,
    "watch_create_file_changes": false,
    "watch_create_key_changes": false,
    "watch_delete_directory_changes": false,
    "watch_delete_file_changes": false,
    "watch_delete_key_changes": false,
    "watch_delete_value_changes": false,
    "watch_permissions_directory_changes": false,
    "watch_permissions_file_changes": false,
    "watch_permissions_key_changes": false,
    "watch_rename_directory_changes": false,
    "watch_rename_file_changes": false,
    "watch_rename_key_changes": false,
    "watch_set_value_changes": false,
    "watch_write_file_changes": false
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

updateScheduledExclusions

Updates the provided scheduled exclusion configuration within the provided policy.

Method PATCH

Route /filevantage/entities/policy-scheduled-exclusions/v1

Scope Falcon FileVantage: WRITE

PEP 8 update_scheduled_exclusions

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

description body · string

The scheduled exclusion description. (String, 0-500 characters.)

id body · string

ID of the scheduled exclusion to be updated. (String)

name body · string

Name of the scheduled exclusion. (String, 1-100 characters.)

policy_id body · string

ID of the policy the scheduled exclusion is assigned. (String)

processes body · string

Comma delimited list of processes to NOT monitor changes. (String, 1-500 characters) **\RunMe.exe or **/RunMe.sh excludes changes made by RunMe.exe or RunMe.sh in any location.

repeated body · object

schedule_end body · string

Indicates the end of the schedule. (String, RFC3339 format)

schedule_start body · string

Indicates the start of the schedule. (String, RFC3339 format, Required)

timezone body · string

users body · string

Comma delimited list of users to NOT monitor changes. (String, 1-500 characters) admin* excludes changes made by all usernames that begin with admin. Falcon GLOB syntax is supported.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.update_scheduled_exclusions(description="string",
                                              id="string",
                                              name="string",
                                              policy_id="string",
                                              users="string",
                                              processes="string",
                                              schedule_start="string",
                                              schedule_end="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.updateScheduledExclusions(description="string",
                                            id="string",
                                            name="string",
                                            policy_id="string",
                                            users="string",
                                            processes="string",
                                            schedule_start="string",
                                            schedule_end="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "id": "string",
    "name": "string",
    "policy_id": "string",
    "processes": "string",
    "repeated": {
        "all_day": boolean,
        "end_time": "string",
        "frequency": "string",
        "monthly_days": ["string"],
        "occurrence": "string",
        "start_time": "string",
        "weekly_days": ["string"]
    },
    "schedule_end": "string",
    "schedule_start": "string",
    "timezone": "string",
    "users": "string"
}

response = falcon.command("updateScheduledExclusions", body=body_payload)
print(response)

Edit-FalconFileVantageExclusion -Id "string" `
  -PolicyId "string" `
  -ScheduleStart "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  id := "string"
  name := "string"
  policy_id := "string"
  processes := "string"
  schedule_end := "string"
  schedule_start := "string"
  timezone := "string"
  users := "string"

  response, err := client.Filevantage.UpdateScheduledExclusions(
    &filevantage.UpdateScheduledExclusionsParams{
      Body: &models.ScheduledexclusionsUpdateRequest{
        Description: &description,
        ID: &id,
        Name: &name,
        PolicyID: &policy_id,
        Processes: &processes,
        Repeated: &struct{}{},
        ScheduleEnd: &schedule_end,
        ScheduleStart: &schedule_start,
        Timezone: &timezone,
        Users: &users,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.updateScheduledExclusions(
  {
    description: "string",
    id: "string",
    name: "string",
    policyId: "string",
    processes: "string",
    repeated: {
      allDay: boolean,
      endTime: "string",
      frequency: "string",
      monthlyDays: [],
      occurrence: "string",
      startTime: "string",
      weeklyDays: []
    },
    scheduleEnd: "string",
    scheduleStart: "string",
    timezone: "string",
    users: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::filevantage_api::update_scheduled_exclusions;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ScheduledexclusionsUpdateRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ScheduledexclusionsUpdateRequest {
        id: Some("string".to_string()),
        name: Some("string".to_string()),
        timezone: Some("string".to_string()),
        ..Default::default()
    };

    let response = update_scheduled_exclusions(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

body = {
  description: 'string',
  id: 'string',
  name: 'string',
  policy_id: 'string',
  processes: 'string',
  repeated: {
    all_day: boolean,
    end_time: 'string',
    frequency: 'string',
    monthly_days: [],
    occurrence: 'string',
    start_time: 'string',
    weekly_days: []
  },
  schedule_end: 'string',
  schedule_start: 'string',
  timezone: 'string',
  users: 'string'
}

response = api.update_scheduled_exclusions(body)

puts response

Responses

[
  {
    "created_timestamp": "string",
    "description": "string",
    "id": "string",
    "modified_timestamp": "string",
    "name": "string",
    "policy_id": "string",
    "processes": "string",
    "repeated": {},
    "schedule_end": "string",
    "schedule_start": "string",
    "timezone": "string",
    "users": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

FileVantage

Table of Contents

createPolicies

Parameters

createRuleGroups

Parameters

createRules

Parameters

createScheduledExclusions

Parameters

deletePolicies

Parameters

deleteRuleGroups

Parameters

deleteRules

Parameters

deleteScheduledExclusions

Parameters

getActionsMixin0

Parameters

getChanges

Parameters

getContents

Parameters

getPolicies

Parameters

getRuleGroups

Parameters

getRules

Parameters

getScheduledExclusions

Parameters

highVolumeQueryChanges

Parameters

queryActionsMixin0

Parameters

queryChanges

Parameters

queryPolicies

Parameters

queryRuleGroups

Parameters

queryScheduledExclusions

Parameters

signalChangesExternal

Parameters

startActions

Parameters

updatePolicies

Parameters

updatePolicyHostGroups

Parameters

updatePolicyPrecedence

Parameters

updatePolicyRuleGroups

Parameters

updateRuleGroupPrecedence

Parameters

updateRuleGroups

Parameters

updateRules

Parameters

updateScheduledExclusions

Parameters