FileVantage

The FileVantage service collection provides operations for managing CrowdStrike Falcon FileVantage configurations. Monitor and detect changes to files, directories, and registry settings. Manage policies, scheduled exclusions, rule groups, and rules. Retrieve and initiate actions on changes, get file change content, initiate workflows for change IDs, and query action, change, policy, scheduled exclusion, and rule group IDs.

Language	Last Update
Python	v1.6.1
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

Operation	Description
getActionsMixin0 `get_actions`	Retrieves the processing results for one or more actions.
startActions `start_actions`	Initiates the specified action on the provided change IDs.
getContents `get_contents`	Retrieves the content captured for the provided change ID.
getChanges `get_changes`	Retrieve information on changes.
updatePolicyHostGroups `update_policy_host_groups`	Manage host groups assigned to a policy.
updatePolicyPrecedence `update_policy_precedence`	Updates the policy precedence for all policies of a specific type.
updatePolicyRuleGroups `update_policy_rule_groups`	Manage the rule groups assigned to the policy or set the rule group precedence for all rule groups within the policy.
getPolicies `get_policies`	Retrieves the configuration for 1 or more policies.
createPolicies `create_policy`	Creates a new policy of the specified type. New policies are always added at the end of the precedence list for the provided policy type.
deletePolicies `delete_policies`	Deletes 1 or more policies.
updatePolicies `update_policies`	Updates the general information of the provided policy.
getScheduledExclusions `get_scheduled_exclusions`	Retrieves the configuration of 1 or more scheduled exclusions from the provided policy id.
createScheduledExclusions `create_scheduled_exclusions`	Creates a new scheduled exclusion configuration for the provided policy id.
deleteScheduledExclusions `delete_scheduled_exclusions`	Deletes 1 or more scheduled exclusions from the provided policy id.
updateScheduledExclusions `update_scheduled_exclusions`	Updates the provided scheduled exclusion configuration within the provided policy.
updateRuleGroupPrecedence `update_rule_group_precedence`	Updates the rule precedence for all rules in the identified rule group.
getRules `get_rules`	Retrieves the configuration for 1 or more rules.
createRules `create_rule`	Creates a new rule configuration within the specified rule group.
deleteRules `delete_rules`	Deletes 1 or more rules from the specified rule group.
updateRules `update_rule`	Updates the provided rule configuration within the specified rule group.
getRuleGroups `get_rule_groups`	Retrieves the rule group details for 1 or more rule groups.
createRuleGroups `create_rule_group`	Creates a new rule group of the specified type.
deleteRuleGroups `delete_rule_groups`	Deletes 1 or more rule groups.
updateRuleGroups `update_rule_group`	Updates the provided rule group.
signalChangesExternal `signal_changes`	Initiates workflows for the provided change IDs.
queryActionsMixin0 `query_actions`	Returns one or more action IDs.
queryChanges `query_changes`	Returns 1 or more change ids.
highVolumeQueryChanges `query_changes_scroll`	Returns 1 or more change ids.
queryPolicies `query_policies`	Retrieve the ids of all policies that are assigned the provided policy type.
queryScheduledExclusions `query_scheduled_exclusions`	Retrieve the ids of all scheduled exclusions contained within the provided policy id.
queryRuleGroups `query_rule_groups`	Retrieve the ids of all rule groups that are of the provided rule group type.

getActionsMixin0

Retrieves the processing results for one or more actions.

GET /filevantage/entities/actions/v1

Scope Falcon FileVantage: READ Consumes · Produces application/json

PEP 8 get_actions

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	One or more change ids. The maximum number of ids that can be requested at once is `500`.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_actions(ids=id_list)
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getActionsMixin0(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getActionsMixin0",
                          ids=id_list)
print(response)

Get-FalconFileVantageAction -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.GetActionsMixin0(
    &filevantage.GetActionsMixin0Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.getActionsMixin0(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::filevantage_api::get_actions_mixin0;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_actions_mixin0(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.get_actions_mixin0(['ID1', 'ID2', 'ID3'])

puts response

startActions

Initiates the specified action on the provided change IDs.

POST /filevantage/entities/actions/v1

Scope Falcon FileVantage: WRITE Consumes · Produces application/json

PEP 8 start_actions

Parameters

Name	Type	Data type	Description
body	body	list of dictionaries	Full body payload in JSON format.
change_ids	body	string or list of strings	The IDs of the changes the operation will perform. Maximum of 100 IDs per action.
comment	body	string	Optional comment to describe reason for action.
operation	body	string	Operation to perform. Must be one of: `suppress`, `unsuppress`, `purge`.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.start_actions(change_ids=id_list,
                                comment="string",
                                operation="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.startActions(change_ids=id_list,
                               comment="string",
                               operation="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "change_ids": ["string"],
    "comment": "string",
    "operation": "string"
}

response = falcon.command("startActions", body=body_payload)
print(response)

Invoke-FalconFileVantageAction -Name "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  operation := "string"

  response, err := client.Filevantage.StartActions(
    &filevantage.StartActionsParams{
      Body: &models.ActionsCreateActionRequest{
        ChangeIds: []string{"string"},
        Comment: &comment,
        Operation: &operation,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.startActions(
  {
    changeIds: [],
    comment: "string",
    operation: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::filevantage_api::start_actions;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ActionsCreateActionRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ActionsCreateActionRequest {
        change_ids: vec!["string".to_string()],
        operation: Some("string".to_string()),
        ..Default::default()
    };

    let response = start_actions(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

body = Falcon::ActionsCreateActionRequest.new(
  change_ids: [],
  comment: 'string',
  operation: 'string'
)

response = api.start_actions(body)

puts response

getContents

Retrieves the content captured for the provided change ID.

GET /filevantage/entities/change-content/v1

Scope Falcon FileVantage Content: READ Consumes · Produces application/json

PEP 8 get_contents

Parameters

Name	Type	Data type	Description
compress	query	boolean	Compress the response using gzip. Defaults to False.
id	query	string	ID of the change.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_contents(id=id_list, compress=boolean)
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getContents(id=id_list, compress=boolean)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getContents",
                          id="string")
print(response)

Get-FalconFileVantageContent -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.GetContents(
    &filevantage.GetContentsParams{
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.getContents(
  "string",  // id
  "string"  // acceptEncoding
);

console.log(response);

use rusty_falcon::apis::filevantage_api::get_contents;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_contents(
        &falcon.cfg,  // configuration
        "string",  // id
        Some("string"),  // accept_encoding
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.get_contents('string')

puts response

getChanges

Retrieve information on changes.

GET /filevantage/entities/changes/v2

Scope Falcon FileVantage: READ Consumes · Produces application/json

PEP 8 get_changes

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	One or more change ids. The maximum number of ids that can be requested at once is `500`.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_changes(ids=id_list)
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getChanges(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getChanges",
                          ids=id_list)
print(response)

Get-FalconFileVantageChange -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.GetChanges(
    &filevantage.GetChangesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.getChanges(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::filevantage_api::get_changes;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_changes(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.get_changes(['ID1', 'ID2', 'ID3'])

puts response

updatePolicyHostGroups

Manage host groups assigned to a policy.

PATCH /filevantage/entities/policies-host-groups/v1

Scope Falcon FileVantage: WRITE Consumes · Produces application/json

PEP 8 update_policy_host_groups

Parameters

Name	Type	Data type	Description
policy_id	query	string	The id of the policy for which to perform the action.
action	query	string	The action to perform with the provided ids, must be one of: `assign` or `unassign`.
ids	query	string or list of strings	One or more host group ids.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_policy_host_groups(action="string",
                                            policy_id="string",
                                            ids=id_list)
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.updatePolicyHostGroups(action="string",
                                         policy_id="string",
                                         ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("updatePolicyHostGroups",
                          policy_id="string",
                          action="string",
                          ids=id_list)
print(response)

Remove-FalconFileVantageHostGroup -PolicyId "string" -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.UpdatePolicyHostGroups(
    &filevantage.UpdatePolicyHostGroupsParams{
      PolicyID: "string",
      Action: "string",
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.updatePolicyHostGroups(
  "string",  // policyId
  "string",  // action
  ["ID1", "ID2", "ID3"]  // ids
);

console.log(response);

use rusty_falcon::apis::filevantage_api::update_policy_host_groups;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = update_policy_host_groups(
        &falcon.cfg,  // configuration
        "string",  // policy_id
        "string",  // action
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.update_policy_host_groups('string', 'string', ['ID1', 'ID2', 'ID3'])

puts response

updatePolicyPrecedence

Updates the policy precedence for all policies of a specific type.

PATCH /filevantage/entities/policies-precedence/v1

Scope Falcon FileVantage: WRITE Consumes · Produces application/json

PEP 8 update_policy_precedence

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	Precedence of the policies for the provided type. Precedence is determined by element position within the provided list.
type	query	string	The policy type for which to set the precedence order, must be one of `Windows`, `Linux` or `Mac`.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

Examples coming soon.

Set-FalconContainerPolicyPrecedence -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/image_assessment_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ImageAssessmentPolicies.UpdatePolicyPrecedence(
    &image_assessment_policies.UpdatePolicyPrecedenceParams{
      Body: &models.ModelsAPIPrecedenceRequest{
        Precedence: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.imageAssessmentPolicies.updatePolicyPrecedence(
  {
    precedence: []
}  // body
);

console.log(response);

use rusty_falcon::apis::filevantage_api::update_policy_precedence;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = update_policy_precedence(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ImageAssessmentPolicies.new

body = Falcon::ModelsAPIPrecedenceRequest.new(
  precedence: []
)

response = api.update_policy_precedence(body)

puts response

updatePolicyRuleGroups

Manage the rule groups assigned to the policy or set the rule group precedence for all rule groups within the policy.

PATCH /filevantage/entities/policies-rule-groups/v1

Scope Falcon FileVantage: WRITE Consumes · Produces application/json

PEP 8 update_policy_rule_groups

Parameters

Name	Type	Data type	Description
policy_id	query	string	The id of the policy for which to perform the action.
action	query	string	The action to perform with the provided ids, must be one of: `assign`, `unassign`, or `precedence`.
ids	query	string or list of strings	One or more rule group ids. Note, for the precedence action, precedence is controlled by the order of the ids as they are specified in the request.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_policy_rule_groups(action="string",
                                            policy_id="string",
                                            ids=id_list)
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.updatePolicyRuleGroups(action="string",
                                         policy_id="string",
                                         ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("updatePolicyRuleGroups",
                          policy_id="string",
                          action="string",
                          ids=id_list)
print(response)

Set-FalconFileVantageRuleGroupPrecedence -PolicyId "string" -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.UpdatePolicyRuleGroups(
    &filevantage.UpdatePolicyRuleGroupsParams{
      PolicyID: "string",
      Action: "string",
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.updatePolicyRuleGroups(
  "string",  // policyId
  "string",  // action
  ["ID1", "ID2", "ID3"]  // ids
);

console.log(response);

use rusty_falcon::apis::filevantage_api::update_policy_rule_groups;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = update_policy_rule_groups(
        &falcon.cfg,  // configuration
        "string",  // policy_id
        "string",  // action
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.update_policy_rule_groups('string', 'string', ['ID1', 'ID2', 'ID3'])

puts response

getPolicies

Retrieves the configuration for 1 or more policies.

GET /filevantage/entities/policies/v1

Scope Falcon FileVantage: READ Consumes · Produces application/json

PEP 8 get_policies

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	One or more (up to 500) policy IDs.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_policies(ids=id_list)
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getPolicies(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getPolicies",
                          ids=id_list)
print(response)

Get-FalconFileVantagePolicy -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.GetPolicies(
    &filevantage.GetPoliciesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.getPolicies(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::filevantage_api::get_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_policies(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.get_policies(['ID1', 'ID2', 'ID3'])

puts response

createPolicies

Creates a new policy of the specified type. New policies are always added at the end of the precedence list for the provided policy type.

POST /filevantage/entities/policies/v1

Scope Falcon FileVantage: WRITE Consumes · Produces application/json

PEP 8 create_policy

Parameters

Name	Type	Data type	Description
body	body	list of dictionaries	Full body payload in JSON format.
description	body	string	The policy description (Max: 500 characters)
name	body	string	Name of the policy (Max: 100 characters)
platform	body	string	Policy platform. Must be one of: `Windows`, `Linux`, `Mac`.

Code Examples

Examples coming soon.

New-FalconContainerPolicy -Name "string" -Description "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/image_assessment_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  name := "string"

  response, err := client.ImageAssessmentPolicies.CreatePolicies(
    &image_assessment_policies.CreatePoliciesParams{
      Body: &models.ModelsCreatePolicyRequest{
        Description: &description,
        Name: &name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.imageAssessmentPolicies.createPolicies(
  {
    description: "string",
    name: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::filevantage_api::create_policies;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::PoliciesCreateRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = PoliciesCreateRequest {
        name: Some("string".to_string()),
        ..Default::default()
    };

    let response = create_policies(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ImageAssessmentPolicies.new

body = Falcon::ModelsCreatePolicyRequest.new(
  description: 'string',
  name: 'string'
)

response = api.create_policies(body)

puts response

deletePolicies

Deletes 1 or more policies.

DELETE /filevantage/entities/policies/v1

Scope Falcon FileVantage: WRITE Consumes · Produces application/json

PEP 8 delete_policies

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	One or more (up to 500) policy IDs.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_policies(ids=id_list)
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deletePolicies(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deletePolicies",
                          ids=id_list)
print(response)

Remove-FalconFileVantagePolicy -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.DeletePolicies(
    &filevantage.DeletePoliciesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.deletePolicies(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::filevantage_api::delete_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_policies(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.delete_policies(['ID1', 'ID2', 'ID3'])

puts response

updatePolicies

Updates the general information of the provided policy.

PATCH /filevantage/entities/policies/v1

Scope Falcon FileVantage: WRITE Consumes · Produces application/json

PEP 8 update_policies

Parameters

Name	Type	Data type	Description
body	body	list of dictionaries	Full body payload in JSON format.
description	body	string	The policy description (Max: 500 characters)
id	body	string	The ID of the policy to be updated.
name	body	string	Name of the policy (Max: 100 characters)
enabled	body	boolean	Policy enablement status.

Code Examples

Examples coming soon.

Edit-FalconContainerPolicy -Id "string" `
  -Name "string" `
  -Enabled $boolean

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/image_assessment_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  is_enabled := boolean
  name := "string"

  response, err := client.ImageAssessmentPolicies.UpdatePolicies(
    &image_assessment_policies.UpdatePoliciesParams{
      Body: &models.ModelsPatchPolicyRequest{
        Description: &description,
        IsEnabled: &is_enabled,
        Name: &name,
        PolicyData: &struct{}{},
      },
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.imageAssessmentPolicies.updatePolicies(
  "string",  // id
  {  // body
      description: "string",
      isEnabled: boolean,
      name: "string",
      policyData: {
        rules: [{
            action: "string",
            policyRulesData: {}
          }]
      }
  }
);

console.log(response);

use rusty_falcon::apis::filevantage_api::update_policies;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::PoliciesUpdateRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = PoliciesUpdateRequest {
        description: Some("string".to_string()),
        is_enabled: Some(boolean),
        name: Some("string".to_string()),
        ..Default::default()
    };

    let response = update_policies(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ImageAssessmentPolicies.new

body = Falcon::ModelsPatchPolicyRequest.new(
  description: 'string',
  is_enabled: boolean,
  name: 'string',
  policy_data: {
    rules: [{
        action: 'string',
        policy_rules_data: {}
      }]
  }
)

response = api.update_policies(body, 'string')

puts response

getScheduledExclusions

Retrieves the configuration of 1 or more scheduled exclusions from the provided policy id.

GET /filevantage/entities/policy-scheduled-exclusions/v1

Scope Falcon FileVantage: READ Consumes · Produces application/json

PEP 8 get_scheduled_exclusions

Parameters

Name	Type	Data type	Description
policy_id	query	string	The id of the policy to retrieve the scheduled exclusion configurations.
ids	query	string or list of strings	One or more (up to 500) scheduled exclusion IDs.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_scheduled_exclusions(ids=id_list, policy_id="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getScheduledExclusions(ids=id_list, policy_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getScheduledExclusions",
                          policy_id="string",
                          ids=id_list)
print(response)

Get-FalconFileVantageExclusion -PolicyId "string" -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.GetScheduledExclusions(
    &filevantage.GetScheduledExclusionsParams{
      PolicyID: "string",
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.getScheduledExclusions(
  "string",  // policyId
  ["ID1", "ID2", "ID3"]  // ids
);

console.log(response);

use rusty_falcon::apis::filevantage_api::get_scheduled_exclusions;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_scheduled_exclusions(
        &falcon.cfg,  // configuration
        "string",  // policy_id
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.get_scheduled_exclusions('string', ['ID1', 'ID2', 'ID3'])

puts response

createScheduledExclusions

Creates a new scheduled exclusion configuration for the provided policy id.

POST /filevantage/entities/policy-scheduled-exclusions/v1

Scope Falcon FileVantage: WRITE Consumes · Produces application/json

PEP 8 create_scheduled_exclusions

Parameters

Name	Type	Data type	Description
body	body	list of dictionaries	Full body payload in JSON format.
description	body	string	The scheduled exclusion description (Max: 500 characters)
name	body	string	Name of the scheduled exclusion (Max: 100 characters)
policy_id	body	string	ID of the policy the schedule exclusion is assigned.
users	body	string	Comma-delimited list of users to not monitor changes. (Max: 500 characters). Example: `admin` excludes changes made by all usernames that begin with admin. Supports Falcon GLOB syntax*
processes	body	string	Comma-delimited list of processes to not monitor changes. (Max: 500 characters). Example: `\RunMe.exe` or `/RunMe.sh` excludes changes made by RunMe.exe or RunMe.sh in any location.
schedule_start	body	string	Indicates the start of the schedule. (RFC3339 format)
schedule_end	body	string	Indicates the end of the schedule. (RFC3339 format)

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.create_scheduled_exclusions(description="string",
                                              name="string",
                                              policy_id="string",
                                              users=["string"],
                                              processes=["string"],
                                              repeated="string",
                                              schedule_start="string",
                                              schedule_end="string",
                                              timezone="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.createScheduledExclusions(description="string",
                                            name="string",
                                            policy_id="string",
                                            users=["string"],
                                            processes=["string"],
                                            repeated="string",
                                            schedule_start="string",
                                            schedule_end="string",
                                            timezone="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "name": "string",
    "policy_id": "string",
    "processes": "string",
    "repeated": {
        "all_day": boolean,
        "end_time": "string",
        "frequency": "string",
        "monthly_days": ["string"],
        "occurrence": "string",
        "start_time": "string",
        "weekly_days": ["string"]
    },
    "schedule_end": "string",
    "schedule_start": "string",
    "timezone": "string",
    "users": "string"
}

response = falcon.command("createScheduledExclusions", body=body_payload)
print(response)

New-FalconFileVantageExclusion -Name "string" `
  -ScheduleStart "string" `
  -PolicyId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  name := "string"
  policy_id := "string"
  processes := "string"
  schedule_end := "string"
  schedule_start := "string"
  timezone := "string"
  users := "string"

  response, err := client.Filevantage.CreateScheduledExclusions(
    &filevantage.CreateScheduledExclusionsParams{
      Body: &models.ScheduledexclusionsCreateRequest{
        Description: &description,
        Name: &name,
        PolicyID: &policy_id,
        Processes: &processes,
        Repeated: &struct{}{},
        ScheduleEnd: &schedule_end,
        ScheduleStart: &schedule_start,
        Timezone: &timezone,
        Users: &users,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.createScheduledExclusions(
  {
    description: "string",
    name: "string",
    policyId: "string",
    processes: "string",
    repeated: {
      allDay: boolean,
      endTime: "string",
      frequency: "string",
      monthlyDays: [],
      occurrence: "string",
      startTime: "string",
      weeklyDays: []
    },
    scheduleEnd: "string",
    scheduleStart: "string",
    timezone: "string",
    users: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::filevantage_api::create_scheduled_exclusions;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ScheduledexclusionsCreateRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ScheduledexclusionsCreateRequest {
        name: Some("string".to_string()),
        timezone: Some("string".to_string()),
        ..Default::default()
    };

    let response = create_scheduled_exclusions(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

body = {
  description: 'string',
  name: 'string',
  policy_id: 'string',
  processes: 'string',
  repeated: {
    all_day: boolean,
    end_time: 'string',
    frequency: 'string',
    monthly_days: [],
    occurrence: 'string',
    start_time: 'string',
    weekly_days: []
  },
  schedule_end: 'string',
  schedule_start: 'string',
  timezone: 'string',
  users: 'string'
}

response = api.create_scheduled_exclusions(body)

puts response

deleteScheduledExclusions

Deletes 1 or more scheduled exclusions from the provided policy id.

DELETE /filevantage/entities/policy-scheduled-exclusions/v1

Scope Falcon FileVantage: WRITE Consumes · Produces application/json

PEP 8 delete_scheduled_exclusions

Parameters

Name	Type	Data type	Description
policy_id	query	string	ID of the policy to delete the scheduled exclusions from.
ids	query	string or list of strings	One or more (up to 500) scheduled exclusion IDs.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_scheduled_exclusions(ids=id_list, policy_id="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteScheduledExclusions(ids=id_list, policy_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deleteScheduledExclusions",
                          policy_id="string",
                          ids=id_list)
print(response)

Remove-FalconFileVantageExclusion -PolicyId "string" -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.DeleteScheduledExclusions(
    &filevantage.DeleteScheduledExclusionsParams{
      PolicyID: "string",
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.deleteScheduledExclusions(
  "string",  // policyId
  ["ID1", "ID2", "ID3"]  // ids
);

console.log(response);

use rusty_falcon::apis::filevantage_api::delete_scheduled_exclusions;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_scheduled_exclusions(
        &falcon.cfg,  // configuration
        "string",  // policy_id
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.delete_scheduled_exclusions('string', ['ID1', 'ID2', 'ID3'])

puts response

updateScheduledExclusions

Updates the provided scheduled exclusion configuration within the provided policy.

PATCH /filevantage/entities/policy-scheduled-exclusions/v1

Scope Falcon FileVantage: WRITE Consumes · Produces application/json

PEP 8 update_scheduled_exclusions

Parameters

Name	Type	Data type	Description
body	body	list of dictionaries	Full body payload in JSON format.
description	body	string	The scheduled exclusion description (Max: 500 characters)
id	body	string	ID of the scheduled exclusion to update.
name	body	string	Name of the scheduled exclusion (Max: 100 characters)
policy_id	body	string	ID of the policy the schedule exclusion is assigned.
users	body	string	Comma-delimited list of users to not monitor changes. (Max: 500 characters). Example: `admin` excludes changes made by all usernames that begin with admin. Supports Falcon GLOB syntax*
processes	body	string	Comma-delimited list of processes to not monitor changes. (Max: 500 characters). Example: `\RunMe.exe` or `/RunMe.sh` excludes changes made by RunMe.exe or RunMe.sh in any location.
schedule_start	body	string	Indicates the start of the schedule. (RFC3339 format)
schedule_end	body	string	Indicates the end of the schedule. (RFC3339 format)
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.update_scheduled_exclusions(description="string",
                                              id="string",
                                              name="string",
                                              policy_id="string",
                                              users=["string"])
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.updateScheduledExclusions(description="string",
                                            id="string",
                                            name="string",
                                            policy_id="string",
                                            users=["string"])
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "id": "string",
    "name": "string",
    "policy_id": "string",
    "processes": "string",
    "repeated": {
        "all_day": boolean,
        "end_time": "string",
        "frequency": "string",
        "monthly_days": ["string"],
        "occurrence": "string",
        "start_time": "string",
        "weekly_days": ["string"]
    },
    "schedule_end": "string",
    "schedule_start": "string",
    "timezone": "string",
    "users": "string"
}

response = falcon.command("updateScheduledExclusions", body=body_payload)
print(response)

Edit-FalconFileVantageExclusion -Id "string" `
  -PolicyId "string" `
  -ScheduleStart "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  id := "string"
  name := "string"
  policy_id := "string"
  processes := "string"
  schedule_end := "string"
  schedule_start := "string"
  timezone := "string"
  users := "string"

  response, err := client.Filevantage.UpdateScheduledExclusions(
    &filevantage.UpdateScheduledExclusionsParams{
      Body: &models.ScheduledexclusionsUpdateRequest{
        Description: &description,
        ID: &id,
        Name: &name,
        PolicyID: &policy_id,
        Processes: &processes,
        Repeated: &struct{}{},
        ScheduleEnd: &schedule_end,
        ScheduleStart: &schedule_start,
        Timezone: &timezone,
        Users: &users,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.updateScheduledExclusions(
  {
    description: "string",
    id: "string",
    name: "string",
    policyId: "string",
    processes: "string",
    repeated: {
      allDay: boolean,
      endTime: "string",
      frequency: "string",
      monthlyDays: [],
      occurrence: "string",
      startTime: "string",
      weeklyDays: []
    },
    scheduleEnd: "string",
    scheduleStart: "string",
    timezone: "string",
    users: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::filevantage_api::update_scheduled_exclusions;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ScheduledexclusionsUpdateRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ScheduledexclusionsUpdateRequest {
        id: Some("string".to_string()),
        name: Some("string".to_string()),
        timezone: Some("string".to_string()),
        ..Default::default()
    };

    let response = update_scheduled_exclusions(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

body = {
  description: 'string',
  id: 'string',
  name: 'string',
  policy_id: 'string',
  processes: 'string',
  repeated: {
    all_day: boolean,
    end_time: 'string',
    frequency: 'string',
    monthly_days: [],
    occurrence: 'string',
    start_time: 'string',
    weekly_days: []
  },
  schedule_end: 'string',
  schedule_start: 'string',
  timezone: 'string',
  users: 'string'
}

response = api.update_scheduled_exclusions(body)

puts response

updateRuleGroupPrecedence

Updates the rule precedence for all rules in the identified rule group.

PATCH /filevantage/entities/rule-groups-rule-precedence/v1

Scope Falcon FileVantage: WRITE Consumes · Produces application/json

PEP 8 update_rule_group_precedence

Parameters

Name	Type	Data type	Description
rule_group_id	query	string	Rule group from which to set the precedence.
ids	query	string or list of strings	One or more (up to 500) rule group IDs.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_rule_group_precedence(ids=id_list,
                                               rule_group_id="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.updateRuleGroupPrecedence(ids=id_list, rule_group_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("updateRuleGroupPrecedence",
                          rule_group_id="string",
                          ids=id_list)
print(response)

Set-FalconFileVantageRulePrecedence -RuleGroupId "string" -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.UpdateRuleGroupPrecedence(
    &filevantage.UpdateRuleGroupPrecedenceParams{
      RuleGroupID: "string",
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.updateRuleGroupPrecedence(
  "string",  // ruleGroupId
  ["ID1", "ID2", "ID3"]  // ids
);

console.log(response);

use rusty_falcon::apis::filevantage_api::update_rule_group_precedence;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = update_rule_group_precedence(
        &falcon.cfg,  // configuration
        "string",  // rule_group_id
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.update_rule_group_precedence('string', ['ID1', 'ID2', 'ID3'])

puts response

getRules

Retrieves the configuration for 1 or more rules.

GET /filevantage/entities/rule-groups-rules/v1

Scope Falcon FileVantage: READ Consumes · Produces application/json

PEP 8 get_rules

Parameters

Name	Type	Data type	Description
rule_group_id	query	string	Rule group from which to retrieve the rule configuration.
ids	query	string or list of strings	One or more (up to 500) rule IDs.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rules(ids=id_list, rule_group_id="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getRules(ids=id_list, rule_group_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getRules",
                          rule_group_id="string",
                          ids=id_list)
print(response)

Get-FalconFileVantageRule -RuleGroupId "string" -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.GetRules(
    &filevantage.GetRulesParams{
      RuleGroupID: "string",
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.getRules(
  "string",  // ruleGroupId
  ["ID1", "ID2", "ID3"]  // ids
);

console.log(response);

use rusty_falcon::apis::filevantage_api::get_rules;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_rules(
        &falcon.cfg,  // configuration
        "string",  // rule_group_id
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.get_rules('string', ['ID1', 'ID2', 'ID3'])

puts response

createRules

Creates a new rule configuration within the specified rule group.

POST /filevantage/entities/rule-groups-rules/v1

Scope Falcon FileVantage: WRITE Consumes · Produces application/json

PEP 8 create_rule

Parameters

Name	Type	Data type	Description
body	body	list of dictionaries	Full body payload in JSON format.
description	body	string	The rule description (Max: 500 characters)
rule_group_id	body	string	Group ID containing the group configuration.
path	body	string	The file system or registry path to monitor. (Max: 250 characters) All paths must end with the path separator, e.g. `\` (Windows) or `/` (Linux/MacOS)
severity	body	string	To categorize change events produced by this rule. Allowed values: `Low`, `Medium`, `High`, `Critical`.
depth	body	string	Recursion levels below the base path to monitor (`1` - `5`, or `ANY`).
precedence	body	integer	The order in which rules will be evaluated starting with `1`. Specifying a precedence value that is already set for another rule in the group will result in this rule being placed before the existing rule.
include	body	string	The files, directories, registry keys, or registry values that will be monitored. Allowed rule group configuration is based on the type of rule the rule group is added to. Falcon GLOB syntax is supported
exclude	body	string	The files, directories, registry keys, or registry values that will not be monitored. Allowed rule group configuration is based on the type of rule the rule group is added to. Falcon GLOB syntax is supported
include_users	body	string	The changes performed by these specific users will be monitored. Allowed rule group configuration is based on the type of rule the rule group is added to. Falcon GLOB syntax is supported MacOS is not supported at this time
exclude_users	body	string	The changes performed by these specific users will not be monitored. Allowed rule group configuration is based on the type of rule the rule group is added to. Falcon GLOB syntax is supported MacOS is not supported at this time
include_processes	body	string	The changes performed by these specific processes will be monitored. Allowed rule group configuration is based on the type of rule the rule group is added to. Falcon GLOB syntax is supported MacOS is not supported at this time
exclude_processes	body	string	The changes performed by these specific processes will not be monitored. Allowed rule group configuration is based on the type of rule the rule group is added to. Falcon GLOB syntax is supported MacOS is not supported at this time
content_files	body	string	The files whose content will be monitored. Listed files must match the file include pattern and not match the file exclude pattern.
content_registry_values	body	string	The registry values whose content will be monitored. Listed registry values must match the registry include pattern and not match the registry exclude pattern.
enable_content_capture	body	boolean	Enable content capturing.
enable_hash_capture	body	boolean	Enable hash capturing.
watch_create_directory_changes	body	boolean	File system directory monitoring.
watch_delete_directory_changes	body	boolean	File system directory monitoring.
watch_rename_directory_changes	body	boolean	File system directory monitoring.
watch_attributes_directory_changes	body	boolean	File system directory monitoring. MacOS is not supported at this time
watch_permissions_directory_changes	body	boolean	File system directory monitoring. MacOS is not supported at this time
watch_create_file_changes	body	boolean	File system file monitoring.
watch_delete_file_changes	body	boolean	File system file monitoring.
watch_write_file_changes	body	boolean	File system file monitoring.
watch_rename_file_changes	body	boolean	File system file monitoring.
watch_attributes_file_changes	body	boolean	File system file monitoring. MacOS is not supported at this time
watch_permissions_file_changes	body	boolean	File system file monitoring. MacOS is not supported at this time
watch_create_key_changes	body	boolean	Windows registry key and value monitoring.
watch_delete_key_changes	body	boolean	Windows registry key and value monitoring.
watch_permissions_key_changes	body	boolean	Windows registry key and value permissions monitoring.
watch_set_value_changes	body	boolean	Windows registry key and value monitoring.
watch_delete_value_changes	body	boolean	Windows registry key and value monitoring.
watch_rename_key_changes	body	boolean	Windows registry key and value monitoring.
watch_create_file_changes	body	boolean	Windows registry key and value monitoring.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.create_rule(description="string",
                              rule_group_id="string",
                              path="string",
                              severity="string",
                              depth="string",
                              precedence="string",
                              include="string",
                              exclude="string",
                              include_users="string",
                              exclude_users="string",
                              include_processes="string",
                              exclude_users="string",
                              exclude_processes="string",
                              content_files="string",
                              content_registry_values="string",
                              enable_content_capture=boolean,
                              enable_hash_capture=boolean,
                              watch_delete_directory_changes=boolean,
                              watch_create_directory_changes=boolean,
                              watch_rename_directory_changes=boolean,
                              watch_attributes_directory_changes=boolean,
                              watch_permissions_directory_changes=boolean,
                              watch_rename_file_changes=boolean,
                              watch_write_file_changes=boolean,
                              watch_create_file_changes=boolean,
                              watch_delete_file_changes=boolean,
                              watch_attributes_file_changes=boolean,
                              watch_permissions_file_changes=boolean,
                              watch_create_key_changes=boolean,
                              watch_delete_key_changes=boolean,
                              watch_permissions_key_changes=boolean,
                              watch_rename_key_changes=boolean,
                              watch_set_value_changes=boolean,
                              watch_delete_value_changes=boolean,
                              watch_create_file_changes=boolean)
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.createRules(description="string",
                              rule_group_id="string",
                              path="string",
                              severity="string",
                              depth="string",
                              precedence="string",
                              include="string",
                              exclude="string",
                              include_users="string",
                              exclude_users="string",
                              include_processes="string",
                              exclude_users="string",
                              exclude_processes="string",
                              content_files="string",
                              content_registry_values="string",
                              enable_content_capture=boolean,
                              enable_hash_capture=boolean,
                              watch_delete_directory_changes=boolean,
                              watch_create_directory_changes=boolean,
                              watch_rename_directory_changes=boolean,
                              watch_attributes_directory_changes=boolean,
                              watch_permissions_directory_changes=boolean,
                              watch_rename_file_changes=boolean,
                              watch_write_file_changes=boolean,
                              watch_create_file_changes=boolean,
                              watch_delete_file_changes=boolean,
                              watch_attributes_file_changes=boolean,
                              watch_permissions_file_changes=boolean,
                              watch_create_key_changes=boolean,
                              watch_delete_key_changes=boolean,
                              watch_permissions_key_changes=boolean,
                              watch_rename_key_changes=boolean,
                              watch_set_value_changes=boolean,
                              watch_delete_value_changes=boolean,
                              watch_create_file_changes=boolean)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "content_files": ["string"],
    "content_registry_values": ["string"],
    "created_timestamp": "string",
    "depth": "string",
    "description": "string",
    "enable_content_capture": boolean,
    "enable_hash_capture": boolean,
    "exclude": "string",
    "exclude_processes": "string",
    "exclude_users": "string",
    "id": "string",
    "include": "string",
    "include_processes": "string",
    "include_users": "string",
    "modified_timestamp": "string",
    "path": "string",
    "precedence": integer,
    "rule_group_id": "string",
    "severity": "string",
    "type": "string",
    "watch_attributes_directory_changes": boolean,
    "watch_attributes_file_changes": boolean,
    "watch_create_directory_changes": boolean,
    "watch_create_file_changes": boolean,
    "watch_create_key_changes": boolean,
    "watch_delete_directory_changes": boolean,
    "watch_delete_file_changes": boolean,
    "watch_delete_key_changes": boolean,
    "watch_delete_value_changes": boolean,
    "watch_permissions_directory_changes": boolean,
    "watch_permissions_file_changes": boolean,
    "watch_permissions_key_changes": boolean,
    "watch_rename_directory_changes": boolean,
    "watch_rename_file_changes": boolean,
    "watch_rename_key_changes": boolean,
    "watch_set_value_changes": boolean,
    "watch_write_file_changes": boolean
}

response = falcon.command("createRules", body=body_payload)
print(response)

New-FalconFileVantageRule -Precedence integer `
  -Path "string" `
  -RuleGroupId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  created_timestamp := "string"
  depth := "string"
  description := "string"
  enable_content_capture := boolean
  enable_hash_capture := boolean
  exclude := "string"
  exclude_processes := "string"
  exclude_users := "string"
  id := "string"
  include := "string"
  include_processes := "string"
  include_users := "string"
  modified_timestamp := "string"
  path := "string"
  precedence := integer
  rule_group_id := "string"
  severity := "string"
  type := "string"
  watch_attributes_directory_changes := boolean
  watch_attributes_file_changes := boolean
  watch_create_directory_changes := boolean
  watch_create_file_changes := boolean
  watch_create_key_changes := boolean
  watch_delete_directory_changes := boolean
  watch_delete_file_changes := boolean
  watch_delete_key_changes := boolean
  watch_delete_value_changes := boolean
  watch_permissions_directory_changes := boolean
  watch_permissions_file_changes := boolean
  watch_permissions_key_changes := boolean
  watch_rename_directory_changes := boolean
  watch_rename_file_changes := boolean
  watch_rename_key_changes := boolean
  watch_set_value_changes := boolean
  watch_write_file_changes := boolean

  response, err := client.Filevantage.CreateRules(
    &filevantage.CreateRulesParams{
      Body: &models.RulegroupsRule{
        ContentFiles: []string{"string"},
        ContentRegistryValues: []string{"string"},
        CreatedTimestamp: &created_timestamp,
        Depth: &depth,
        Description: &description,
        EnableContentCapture: &enable_content_capture,
        EnableHashCapture: &enable_hash_capture,
        Exclude: &exclude,
        ExcludeProcesses: &exclude_processes,
        ExcludeUsers: &exclude_users,
        ID: &id,
        Include: &include,
        IncludeProcesses: &include_processes,
        IncludeUsers: &include_users,
        ModifiedTimestamp: &modified_timestamp,
        Path: &path,
        Precedence: &precedence,
        RuleGroupID: &rule_group_id,
        Severity: &severity,
        Type: &type,
        WatchAttributesDirectoryChanges: &watch_attributes_directory_changes,
        WatchAttributesFileChanges: &watch_attributes_file_changes,
        WatchCreateDirectoryChanges: &watch_create_directory_changes,
        WatchCreateFileChanges: &watch_create_file_changes,
        WatchCreateKeyChanges: &watch_create_key_changes,
        WatchDeleteDirectoryChanges: &watch_delete_directory_changes,
        WatchDeleteFileChanges: &watch_delete_file_changes,
        WatchDeleteKeyChanges: &watch_delete_key_changes,
        WatchDeleteValueChanges: &watch_delete_value_changes,
        WatchPermissionsDirectoryChanges: &watch_permissions_directory_changes,
        WatchPermissionsFileChanges: &watch_permissions_file_changes,
        WatchPermissionsKeyChanges: &watch_permissions_key_changes,
        WatchRenameDirectoryChanges: &watch_rename_directory_changes,
        WatchRenameFileChanges: &watch_rename_file_changes,
        WatchRenameKeyChanges: &watch_rename_key_changes,
        WatchSetValueChanges: &watch_set_value_changes,
        WatchWriteFileChanges: &watch_write_file_changes,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.createRules(
  {
    contentFiles: [],
    contentRegistryValues: [],
    createdTimestamp: "string",
    depth: "string",
    description: "string",
    enableContentCapture: boolean,
    enableHashCapture: boolean,
    exclude: "string",
    excludeProcesses: "string",
    excludeUsers: "string",
    id: "string",
    include: "string",
    includeProcesses: "string",
    includeUsers: "string",
    modifiedTimestamp: "string",
    path: "string",
    precedence: integer,
    ruleGroupId: "string",
    severity: "string",
    type: "string",
    watchAttributesDirectoryChanges: boolean,
    watchAttributesFileChanges: boolean,
    watchCreateDirectoryChanges: boolean,
    watchCreateFileChanges: boolean,
    watchCreateKeyChanges: boolean,
    watchDeleteDirectoryChanges: boolean,
    watchDeleteFileChanges: boolean,
    watchDeleteKeyChanges: boolean,
    watchDeleteValueChanges: boolean,
    watchPermissionsDirectoryChanges: boolean,
    watchPermissionsFileChanges: boolean,
    watchPermissionsKeyChanges: boolean,
    watchRenameDirectoryChanges: boolean,
    watchRenameFileChanges: boolean,
    watchRenameKeyChanges: boolean,
    watchSetValueChanges: boolean,
    watchWriteFileChanges: boolean
}  // body
);

console.log(response);

use rusty_falcon::apis::filevantage_api::create_rules;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RulegroupsRule;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RulegroupsRule {
        depth: Some("string".to_string()),
        id: Some("string".to_string()),
        include: Some("string".to_string()),
        path: Some("string".to_string()),
        rule_group_id: Some("string".to_string()),
        severity: Some("string".to_string()),
        type: Some("string".to_string()),
        ..Default::default()
    };

    let response = create_rules(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

body = {
  content_files: [],
  content_registry_values: [],
  created_timestamp: 'string',
  depth: 'string',
  description: 'string',
  enable_content_capture: boolean,
  enable_hash_capture: boolean,
  exclude: 'string',
  exclude_processes: 'string',
  exclude_users: 'string',
  id: 'string',
  include: 'string',
  include_processes: 'string',
  include_users: 'string',
  modified_timestamp: 'string',
  path: 'string',
  precedence: integer,
  rule_group_id: 'string',
  severity: 'string',
  type: 'string',
  watch_attributes_directory_changes: boolean,
  watch_attributes_file_changes: boolean,
  watch_create_directory_changes: boolean,
  watch_create_file_changes: boolean,
  watch_create_key_changes: boolean,
  watch_delete_directory_changes: boolean,
  watch_delete_file_changes: boolean,
  watch_delete_key_changes: boolean,
  watch_delete_value_changes: boolean,
  watch_permissions_directory_changes: boolean,
  watch_permissions_file_changes: boolean,
  watch_permissions_key_changes: boolean,
  watch_rename_directory_changes: boolean,
  watch_rename_file_changes: boolean,
  watch_rename_key_changes: boolean,
  watch_set_value_changes: boolean,
  watch_write_file_changes: boolean
}

response = api.create_rules(body)

puts response

deleteRules

Deletes 1 or more rules from the specified rule group.

DELETE /filevantage/entities/rule-groups-rules/v1

Scope Falcon FileVantage: WRITE Consumes · Produces application/json

PEP 8 delete_rules

Parameters

Name	Type	Data type	Description
rule_group_id	query	string	The id of the rule group from which the rules will be deleted.
ids	query	string or list of strings	One or more (up to 500) rule IDs.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_rules(ids=id_list, rule_group_id="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteRules(ids=id_list, rule_group_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deleteRules",
                          rule_group_id="string",
                          ids=id_list)
print(response)

Remove-FalconFileVantageRule -RuleGroupId "string" -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.DeleteRules(
    &filevantage.DeleteRulesParams{
      RuleGroupID: "string",
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.deleteRules(
  "string",  // ruleGroupId
  ["ID1", "ID2", "ID3"]  // ids
);

console.log(response);

use rusty_falcon::apis::filevantage_api::delete_rules;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_rules(
        &falcon.cfg,  // configuration
        "string",  // rule_group_id
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.delete_rules('string', ['ID1', 'ID2', 'ID3'])

puts response

updateRules

Updates the provided rule configuration within the specified rule group.

PATCH /filevantage/entities/rule-groups-rules/v1

Scope Falcon FileVantage: WRITE Consumes · Produces application/json

PEP 8 update_rule

Parameters

Name	Type	Data type	Description
body	body	list of dictionaries	Full body payload in JSON format.
description	body	string	The rule description (Max: 500 characters)
rule_group_id	body	string	Group ID containing the group configuration.
path	body	string	The file system or registry path to monitor. (Max: 250 characters) All paths must end with the path separator, e.g. `\` (Windows) or `/` (Linux/MacOS)
severity	body	string	To categorize change events produced by this rule. Allowed values: `Low`, `Medium`, `High`, `Critical`.
depth	body	string	Recursion levels below the base path to monitor (`1` - `5`, or `ANY`).
precedence	body	integer	The order in which rules will be evaluated starting with `1`. Specifying a precedence value that is already set for another rule in the group will result in this rule being placed before the existing rule.
include	body	string	The files, directories, registry keys, or registry values that will be monitored. Allowed rule group configuration is based on the type of rule the rule group is added to. Falcon GLOB syntax is supported
exclude	body	string	The files, directories, registry keys, or registry values that will not be monitored. Allowed rule group configuration is based on the type of rule the rule group is added to. Falcon GLOB syntax is supported
include_users	body	string	The changes performed by these specific users will be monitored. Allowed rule group configuration is based on the type of rule the rule group is added to. Falcon GLOB syntax is supported MacOS is not supported at this time
exclude_users	body	string	The changes performed by these specific users will not be monitored. Allowed rule group configuration is based on the type of rule the rule group is added to. Falcon GLOB syntax is supported MacOS is not supported at this time
include_processes	body	string	The changes performed by these specific processes will be monitored. Allowed rule group configuration is based on the type of rule the rule group is added to. Falcon GLOB syntax is supported MacOS is not supported at this time
exclude_processes	body	string	The changes performed by these specific processes will not be monitored. Allowed rule group configuration is based on the type of rule the rule group is added to. Falcon GLOB syntax is supported MacOS is not supported at this time
content_files	body	string	The files whose content will be monitored. Listed files must match the file include pattern and not match the file exclude pattern.
content_registry_values	body	string	The registry values whose content will be monitored. Listed registry values must match the registry include pattern and not match the registry exclude pattern.
enable_content_capture	body	boolean	Enable content capturing.
enable_hash_capture	body	boolean	Enable hash capturing.
watch_create_directory_changes	body	boolean	File system directory monitoring.
watch_delete_directory_changes	body	boolean	File system directory monitoring.
watch_rename_directory_changes	body	boolean	File system directory monitoring.
watch_attributes_directory_changes	body	boolean	File system directory monitoring. MacOS is not supported at this time
watch_permissions_directory_changes	body	boolean	File system directory monitoring. MacOS is not supported at this time
watch_create_file_changes	body	boolean	File system file monitoring.
watch_delete_file_changes	body	boolean	File system file monitoring.
watch_write_file_changes	body	boolean	File system file monitoring.
watch_rename_file_changes	body	boolean	File system file monitoring.
watch_attributes_file_changes	body	boolean	File system file monitoring. MacOS is not supported at this time
watch_permissions_file_changes	body	boolean	File system file monitoring. MacOS is not supported at this time
watch_create_key_changes	body	boolean	Windows registry key and value monitoring.
watch_delete_key_changes	body	boolean	Windows registry key and value monitoring.
watch_set_value_changes	body	boolean	Windows registry key and value monitoring.
watch_delete_value_changes	body	boolean	Windows registry key and value monitoring.
watch_rename_key_changes	body	boolean	Windows registry key and value monitoring.
watch_create_file_changes	body	boolean	Windows registry key and value monitoring.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.update_rule(description="string",
                              id="string",
                              rule_group_id="string",
                              path="string",
                              severity="string",
                              depth="string",
                              precedence="string",
                              include="string",
                              exclude="string",
                              include_users="string",
                              exclude_users="string",
                              include_processes="string",
                              exclude_users="string",
                              exclude_processes="string",
                              content_files="string",
                              content_registry_values="string",
                              enable_content_capture=boolean,
                              enable_hash_capture=boolean,
                              watch_delete_directory_changes=boolean,
                              watch_create_directory_changes=boolean,
                              watch_rename_directory_changes=boolean,
                              watch_attributes_directory_changes=boolean,
                              watch_permissions_directory_changes=boolean,
                              watch_rename_file_changes=boolean,
                              watch_write_file_changes=boolean,
                              watch_create_file_changes=boolean,
                              watch_delete_file_changes=boolean,
                              watch_attributes_file_changes=boolean,
                              watch_permissions_file_changes=boolean,
                              watch_create_key_changes=boolean,
                              watch_delete_key_changes=boolean,
                              watch_rename_key_changes=boolean,
                              watch_set_value_changes=boolean,
                              watch_delete_value_changes=boolean,
                              watch_create_file_changes=boolean)
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.updateRules(description="string",
                              id="string",
                              rule_group_id="string",
                              path="string",
                              severity="string",
                              depth="string",
                              precedence="string",
                              include="string",
                              exclude="string",
                              include_users="string",
                              exclude_users="string",
                              include_processes="string",
                              exclude_users="string",
                              exclude_processes="string",
                              content_files="string",
                              content_registry_values="string",
                              enable_content_capture=boolean,
                              enable_hash_capture=boolean,
                              watch_delete_directory_changes=boolean,
                              watch_create_directory_changes=boolean,
                              watch_rename_directory_changes=boolean,
                              watch_attributes_directory_changes=boolean,
                              watch_permissions_directory_changes=boolean,
                              watch_rename_file_changes=boolean,
                              watch_write_file_changes=boolean,
                              watch_create_file_changes=boolean,
                              watch_delete_file_changes=boolean,
                              watch_attributes_file_changes=boolean,
                              watch_permissions_file_changes=boolean,
                              watch_create_key_changes=boolean,
                              watch_delete_key_changes=boolean,
                              watch_rename_key_changes=boolean,
                              watch_set_value_changes=boolean,
                              watch_delete_value_changes=boolean,
                              watch_create_file_changes=boolean)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "content_files": ["string"],
    "content_registry_values": ["string"],
    "created_timestamp": "string",
    "depth": "string",
    "description": "string",
    "enable_content_capture": boolean,
    "enable_hash_capture": boolean,
    "exclude": "string",
    "exclude_processes": "string",
    "exclude_users": "string",
    "id": "string",
    "include": "string",
    "include_processes": "string",
    "include_users": "string",
    "modified_timestamp": "string",
    "path": "string",
    "precedence": integer,
    "rule_group_id": "string",
    "severity": "string",
    "type": "string",
    "watch_attributes_directory_changes": boolean,
    "watch_attributes_file_changes": boolean,
    "watch_create_directory_changes": boolean,
    "watch_create_file_changes": boolean,
    "watch_create_key_changes": boolean,
    "watch_delete_directory_changes": boolean,
    "watch_delete_file_changes": boolean,
    "watch_delete_key_changes": boolean,
    "watch_delete_value_changes": boolean,
    "watch_permissions_directory_changes": boolean,
    "watch_permissions_file_changes": boolean,
    "watch_permissions_key_changes": boolean,
    "watch_rename_directory_changes": boolean,
    "watch_rename_file_changes": boolean,
    "watch_rename_key_changes": boolean,
    "watch_set_value_changes": boolean,
    "watch_write_file_changes": boolean
}

response = falcon.command("updateRules", body=body_payload)
print(response)

Edit-FalconFileVantageRule -Id "string" `
  -Precedence integer `
  -RuleGroupId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  created_timestamp := "string"
  depth := "string"
  description := "string"
  enable_content_capture := boolean
  enable_hash_capture := boolean
  exclude := "string"
  exclude_processes := "string"
  exclude_users := "string"
  id := "string"
  include := "string"
  include_processes := "string"
  include_users := "string"
  modified_timestamp := "string"
  path := "string"
  precedence := integer
  rule_group_id := "string"
  severity := "string"
  type := "string"
  watch_attributes_directory_changes := boolean
  watch_attributes_file_changes := boolean
  watch_create_directory_changes := boolean
  watch_create_file_changes := boolean
  watch_create_key_changes := boolean
  watch_delete_directory_changes := boolean
  watch_delete_file_changes := boolean
  watch_delete_key_changes := boolean
  watch_delete_value_changes := boolean
  watch_permissions_directory_changes := boolean
  watch_permissions_file_changes := boolean
  watch_permissions_key_changes := boolean
  watch_rename_directory_changes := boolean
  watch_rename_file_changes := boolean
  watch_rename_key_changes := boolean
  watch_set_value_changes := boolean
  watch_write_file_changes := boolean

  response, err := client.Filevantage.UpdateRules(
    &filevantage.UpdateRulesParams{
      Body: &models.RulegroupsRule{
        ContentFiles: []string{"string"},
        ContentRegistryValues: []string{"string"},
        CreatedTimestamp: &created_timestamp,
        Depth: &depth,
        Description: &description,
        EnableContentCapture: &enable_content_capture,
        EnableHashCapture: &enable_hash_capture,
        Exclude: &exclude,
        ExcludeProcesses: &exclude_processes,
        ExcludeUsers: &exclude_users,
        ID: &id,
        Include: &include,
        IncludeProcesses: &include_processes,
        IncludeUsers: &include_users,
        ModifiedTimestamp: &modified_timestamp,
        Path: &path,
        Precedence: &precedence,
        RuleGroupID: &rule_group_id,
        Severity: &severity,
        Type: &type,
        WatchAttributesDirectoryChanges: &watch_attributes_directory_changes,
        WatchAttributesFileChanges: &watch_attributes_file_changes,
        WatchCreateDirectoryChanges: &watch_create_directory_changes,
        WatchCreateFileChanges: &watch_create_file_changes,
        WatchCreateKeyChanges: &watch_create_key_changes,
        WatchDeleteDirectoryChanges: &watch_delete_directory_changes,
        WatchDeleteFileChanges: &watch_delete_file_changes,
        WatchDeleteKeyChanges: &watch_delete_key_changes,
        WatchDeleteValueChanges: &watch_delete_value_changes,
        WatchPermissionsDirectoryChanges: &watch_permissions_directory_changes,
        WatchPermissionsFileChanges: &watch_permissions_file_changes,
        WatchPermissionsKeyChanges: &watch_permissions_key_changes,
        WatchRenameDirectoryChanges: &watch_rename_directory_changes,
        WatchRenameFileChanges: &watch_rename_file_changes,
        WatchRenameKeyChanges: &watch_rename_key_changes,
        WatchSetValueChanges: &watch_set_value_changes,
        WatchWriteFileChanges: &watch_write_file_changes,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.updateRules(
  {
    contentFiles: [],
    contentRegistryValues: [],
    createdTimestamp: "string",
    depth: "string",
    description: "string",
    enableContentCapture: boolean,
    enableHashCapture: boolean,
    exclude: "string",
    excludeProcesses: "string",
    excludeUsers: "string",
    id: "string",
    include: "string",
    includeProcesses: "string",
    includeUsers: "string",
    modifiedTimestamp: "string",
    path: "string",
    precedence: integer,
    ruleGroupId: "string",
    severity: "string",
    type: "string",
    watchAttributesDirectoryChanges: boolean,
    watchAttributesFileChanges: boolean,
    watchCreateDirectoryChanges: boolean,
    watchCreateFileChanges: boolean,
    watchCreateKeyChanges: boolean,
    watchDeleteDirectoryChanges: boolean,
    watchDeleteFileChanges: boolean,
    watchDeleteKeyChanges: boolean,
    watchDeleteValueChanges: boolean,
    watchPermissionsDirectoryChanges: boolean,
    watchPermissionsFileChanges: boolean,
    watchPermissionsKeyChanges: boolean,
    watchRenameDirectoryChanges: boolean,
    watchRenameFileChanges: boolean,
    watchRenameKeyChanges: boolean,
    watchSetValueChanges: boolean,
    watchWriteFileChanges: boolean
}  // body
);

console.log(response);

use rusty_falcon::apis::filevantage_api::update_rules;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RulegroupsRule;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RulegroupsRule {
        depth: Some("string".to_string()),
        id: Some("string".to_string()),
        include: Some("string".to_string()),
        path: Some("string".to_string()),
        rule_group_id: Some("string".to_string()),
        severity: Some("string".to_string()),
        type: Some("string".to_string()),
        ..Default::default()
    };

    let response = update_rules(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

body = {
  content_files: [],
  content_registry_values: [],
  created_timestamp: 'string',
  depth: 'string',
  description: 'string',
  enable_content_capture: boolean,
  enable_hash_capture: boolean,
  exclude: 'string',
  exclude_processes: 'string',
  exclude_users: 'string',
  id: 'string',
  include: 'string',
  include_processes: 'string',
  include_users: 'string',
  modified_timestamp: 'string',
  path: 'string',
  precedence: integer,
  rule_group_id: 'string',
  severity: 'string',
  type: 'string',
  watch_attributes_directory_changes: boolean,
  watch_attributes_file_changes: boolean,
  watch_create_directory_changes: boolean,
  watch_create_file_changes: boolean,
  watch_create_key_changes: boolean,
  watch_delete_directory_changes: boolean,
  watch_delete_file_changes: boolean,
  watch_delete_key_changes: boolean,
  watch_delete_value_changes: boolean,
  watch_permissions_directory_changes: boolean,
  watch_permissions_file_changes: boolean,
  watch_permissions_key_changes: boolean,
  watch_rename_directory_changes: boolean,
  watch_rename_file_changes: boolean,
  watch_rename_key_changes: boolean,
  watch_set_value_changes: boolean,
  watch_write_file_changes: boolean
}

response = api.update_rules(body)

puts response

getRuleGroups

Retrieves the rule group details for 1 or more rule groups.

GET /filevantage/entities/rule-groups/v1

Scope Falcon FileVantage: READ Consumes · Produces application/json

PEP 8 get_rule_groups

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	One or more (up to 500) rule group ids.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rule_groups(ids=id_list)
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getRuleGroups(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getRuleGroups",
                          ids=id_list)
print(response)

Get-FalconFileVantageRuleGroup -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.GetRuleGroups(
    &filevantage.GetRuleGroupsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.getRuleGroups(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::filevantage_api::get_rule_groups;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_rule_groups(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.get_rule_groups(['ID1', 'ID2', 'ID3'])

puts response

createRuleGroups

Creates a new rule group of the specified type.

POST /filevantage/entities/rule-groups/v1

Scope Falcon FileVantage: WRITE Consumes · Produces application/json

PEP 8 create_rule_group

Parameters

Name	Type	Data type	Description
body	body	list of dictionaries	Full body payload in JSON format.
description	body	string	The policy description (Max: 500 characters)
name	body	string	Name of the policy (Max: 100 characters)
type	body	string	Rule group type. Must be one of: `WindowsFiles`, `WindowsRegistry`, `LinuxFiles`, `MacFiles`.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.create_rule_group(description="string",
                                    type="string",
                                    name="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.createRuleGroups(description="string",
                                   type="string",
                                   name="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "name": "string",
    "type": "string"
}

response = falcon.command("createRuleGroups", body=body_payload)
print(response)

New-FalconFileVantageRuleGroup -Type "string" -Name "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  name := "string"
  type := "string"

  response, err := client.Filevantage.CreateRuleGroups(
    &filevantage.CreateRuleGroupsParams{
      Body: &models.RulegroupsCreateRequest{
        Description: &description,
        Name: &name,
        Type: &type,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.createRuleGroups(
  {
    description: "string",
    name: "string",
    type: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::filevantage_api::create_rule_groups;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RulegroupsCreateRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RulegroupsCreateRequest {
        name: Some("string".to_string()),
        type: Some("string".to_string()),
        ..Default::default()
    };

    let response = create_rule_groups(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

body = {
  description: 'string',
  name: 'string',
  type: 'string'
}

response = api.create_rule_groups(body)

puts response

deleteRuleGroups

Deletes 1 or more rule groups.

DELETE /filevantage/entities/rule-groups/v1

Scope Falcon FileVantage: WRITE Consumes · Produces application/json

PEP 8 delete_rule_groups

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	One or more (up to 500) rule group ids.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_rule_groups(ids=id_list)
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteRuleGroups(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deleteRuleGroups",
                          ids=id_list)
print(response)

Remove-FalconFileVantageRuleGroup -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.DeleteRuleGroups(
    &filevantage.DeleteRuleGroupsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.deleteRuleGroups(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::filevantage_api::delete_rule_groups;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_rule_groups(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.delete_rule_groups(['ID1', 'ID2', 'ID3'])

puts response

updateRuleGroups

Updates the provided rule group.

PATCH /filevantage/entities/rule-groups/v1

Scope Falcon FileVantage: WRITE Consumes · Produces application/json

PEP 8 update_rule_group

Parameters

Name	Type	Data type	Description
body	body	list of dictionaries	Full body payload in JSON format.
description	body	string	The policy description (Max: 500 characters)
name	body	string	Name of the policy (Max: 100 characters)
id	body	string	Rule group ID to update.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.update_rule_group(description="string",
                                    id="string",
                                    name="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.updateRuleGroups(description="string",
                                   id="string",
                                   name="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "id": "string",
    "name": "string"
}

response = falcon.command("updateRuleGroups", body=body_payload)
print(response)

Edit-FalconFileVantageRuleGroup -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  id := "string"
  name := "string"

  response, err := client.Filevantage.UpdateRuleGroups(
    &filevantage.UpdateRuleGroupsParams{
      Body: &models.RulegroupsUpdateRequest{
        Description: &description,
        ID: &id,
        Name: &name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.updateRuleGroups(
  {
    description: "string",
    id: "string",
    name: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::filevantage_api::update_rule_groups;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RulegroupsUpdateRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RulegroupsUpdateRequest {
        id: Some("string".to_string()),
        name: Some("string".to_string()),
        ..Default::default()
    };

    let response = update_rule_groups(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

body = {
  description: 'string',
  id: 'string',
  name: 'string'
}

response = api.update_rule_groups(body)

puts response

signalChangesExternal

Initiates workflows for the provided change IDs.

POST /filevantage/entities/workflow/v1

Scope Falcon FileVantage: WRITE Consumes · Produces application/json

PEP 8 signal_changes

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
ids	body	string or list of strings	Change IDs to initiate the workflows, limited to 100 IDs per request.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.signal_changes(ids=id_list)
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.signalChangesExternal(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "ids": ["string"]
}

response = falcon.command("signalChangesExternal", body=body_payload)
print(response)

Invoke-FalconFileVantageWorkflow -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.SignalChangesExternal(
    &filevantage.SignalChangesExternalParams{
      Body: &models.WorkflowRequest{
        Ids: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.signalChangesExternal(
  {
    ids: []
}  // body
);

console.log(response);

use rusty_falcon::apis::filevantage_api::signal_changes_external;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::WorkflowRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = WorkflowRequest {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = signal_changes_external(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

body = Falcon::WorkflowRequest.new(
  ids: []
)

response = api.signal_changes_external(body)

puts response

queryActionsMixin0

Returns one or more action IDs.

GET /filevantage/queries/actions/v1

Scope Falcon FileVantage: READ Consumes · Produces application/json

PEP 8 query_actions

Parameters

Name	Type	Data type	Description
offset	query	integer	The offset to start retrieving records from. Defaults to `0` if not specified.
limit	query	integer	The maximum number of ids to return. Defaults to `100` if not specified. The maximum number of results that can be returned in a single call is `500`.
sort	query	string	Sort results using options like: - `created_date` (timestamp of the change occurrence) Sort either `asc` (ascending) or `desc` (descending). For example: `created_date\|asc`. The full list of allowed sorting options can be reviewed in our API documentation.
filter	query	string	Filter changes using a query in Falcon Query Language (FQL). Common filter options include: - `status` - `operation_type` The full list of allowed filter parameters can be reviewed in our API documentation.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.query_actions(filter="string",
                                limit=integer,
                                offset=integer,
                                sort="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.queryActionsMixin0(filter="string",
                                     limit=integer,
                                     offset=integer,
                                     sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryActionsMixin0",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string")
print(response)

Get-FalconFileVantageAction -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.Filevantage.QueryActionsMixin0(
    &filevantage.QueryActionsMixin0Params{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.queryActionsMixin0(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string"  // filter
);

console.log(response);

use rusty_falcon::apis::filevantage_api::query_actions_mixin0;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_actions_mixin0(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.query_actions_mixin0(offset: integer,
                                    limit: integer,
                                    sort: 'string',
                                    filter: 'string')

puts response

queryChanges

Returns 1 or more change ids.

GET /filevantage/queries/changes/v2

Scope Falcon FileVantage: READ Consumes · Produces application/json

PEP 8 query_changes

Parameters

Name	Type	Data type	Description
offset	query	integer	The offset to start retrieving records from. Defaults to `0` if not specified.
limit	query	integer	The maximum number of ids to return. Defaults to `100` if not specified. The maximum number of results that can be returned in a single call is `500`.
sort	query	string	Sort results using options like: - `action_timestamp` (timestamp of the change occurrence) Sort either `asc` (ascending) or `desc` (descending). For example: `action_timestamp\|asc`. The full list of allowed sorting options can be reviewed in our API documentation.
filter	query	string	Filter changes using a query in Falcon Query Language (FQL). Common filter options include: - `host.name` - `action_timestamp` The full list of allowed filter parameters can be reviewed in our API documentation.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.query_changes(filter="string",
                                limit=integer,
                                offset=integer,
                                sort="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.queryChanges(filter="string",
                               limit=integer,
                               offset=integer,
                               sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryChanges",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.Filevantage.QueryChanges(
    &filevantage.QueryChangesParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.queryChanges(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string"  // filter
);

console.log(response);

use rusty_falcon::apis::filevantage_api::query_changes;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_changes(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.query_changes(offset: integer,
                             limit: integer,
                             sort: 'string',
                             filter: 'string')

puts response

highVolumeQueryChanges

Returns 1 or more change ids.

GET /filevantage/queries/changes/v3

Scope Falcon FileVantage: READ Consumes · Produces application/json

PEP 8 query_changes_scroll

Parameters

Name	Type	Data type	Description
after	query	string	A pagination token used with the `limit` parameter to manage pagination of results. On your first request don’t provide a value for the `after` token. On subsequent requests provide the `after` token value from the previous response to continue pagination from where you left. If the response returns an empty `after` token it means there are no more results to return.
limit	query	integer	The maximum number of ids to return. Defaults to `100` if not specified. The maximum number of results that can be returned in a single call is `5000`.
sort	query	string	Sort results using options like: - `action_timestamp` (timestamp of the change occurrence) Sort either `asc` (ascending) or `desc` (descending). For example: `action_timestamp\|asc`. Defaults to `action_timestamp\|desc` no value is specified. The full list of allowed sorting options can be reviewed in our API documentation.
filter	query	string	Filter changes using a query in Falcon Query Language (FQL). Common filter options include: - `host.name` - `action_timestamp` The full list of allowed filter parameters can be reviewed in our API documentation.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.query_changes_scroll(filter="string",
                                       limit=integer,
                                       after="string",
                                       sort="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.highVolumeQueryChanges(filter="string",
                                         limit=integer,
                                         after="string",
                                         sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("highVolumeQueryChanges",
                          after="string",
                          limit=integer,
                          sort="string",
                          filter="string")
print(response)

Get-FalconFileVantageChange -Filter "string" `
  -Sort "string" `
  -Limit integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  after := "string"
  limit := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.Filevantage.HighVolumeQueryChanges(
    &filevantage.HighVolumeQueryChangesParams{
      After: &after,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.highVolumeQueryChanges(
  "string",  // after
  integer,  // limit
  "string",  // sort
  "string"  // filter
);

console.log(response);

use rusty_falcon::apis::filevantage_api::high_volume_query_changes;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = high_volume_query_changes(
        &falcon.cfg,  // configuration
        Some("string"),  // after
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.high_volume_query_changes(after: 'string',
                                         limit: integer,
                                         sort: 'string',
                                         filter: 'string')

puts response

queryPolicies

Retrieve the ids of all policies that are assigned the provided policy type.

GET /filevantage/queries/policies/v1

Scope Falcon FileVantage: READ Consumes · Produces application/json

PEP 8 query_policies

Parameters

Name	Type	Data type	Description
offset	query	integer	The offset to start retrieving records from. Defaults to 0 if not specified.
limit	query	integer	The maximum number of ids to return. Defaults to 100 if not specified. The maximum number of results that can be returned in a single call is 500.
sort	query	string	Sort the returned ids based on one of the following properties: `precedence`, `created_timestamp` or `modified_timestamp` Sort either `asc` (ascending) or `desc` (descending); for example: `precedence\|asc`.
type	query	string	The types of policies to retrieve. Allowed values are: `Windows`, `Linux` or `Mac`.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.query_policies(limit="string",
                                 offset=integer,
                                 sort="string",
                                 type="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.queryPolicies(limit="string",
                                offset=integer,
                                sort="string",
                                type="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryPolicies",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          type="string")
print(response)

Get-FalconFileVantagePolicy -Type "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.Filevantage.QueryPolicies(
    &filevantage.QueryPoliciesParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Type: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.queryPolicies(
  "string",  // type
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::filevantage_api::query_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_policies(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.query_policies('string')

puts response

queryScheduledExclusions

Retrieve the ids of all scheduled exclusions contained within the provided policy id.

GET /filevantage/queries/policy-scheduled-exclusions/v1

Scope Falcon FileVantage: READ Consumes · Produces application/json

PEP 8 query_scheduled_exclusions

Parameters

Name	Type	Data type	Description
policy_id	query	string	The id of the policy from which to retrieve the scheduled exclusion ids.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.query_scheduled_exclusions(policy_id=id_list)
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.queryScheduledExclusions(policy_id=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("queryScheduledExclusions",
                          policy_id="string")
print(response)

Get-FalconFileVantageExclusion -PolicyId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Filevantage.QueryScheduledExclusions(
    &filevantage.QueryScheduledExclusionsParams{
      PolicyID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.queryScheduledExclusions("string");  // policyId

console.log(response);

use rusty_falcon::apis::filevantage_api::query_scheduled_exclusions;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_scheduled_exclusions(
        &falcon.cfg,  // configuration
        "string",  // policy_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.query_scheduled_exclusions('string')

puts response

queryRuleGroups

Retrieve the ids of all rule groups that are of the provided rule group type.

GET /filevantage/queries/rule-groups/v1

Scope Falcon FileVantage: READ Consumes · Produces application/json

PEP 8 query_rule_groups

Parameters

Name	Type	Data type	Description
offset	query	integer	The offset to start retrieving records from. Defaults to 0 if not specified.
limit	query	integer	The maximum number of ids to return. Defaults to 100 if not specified. The maximum number of results that can be returned in a single call is 500.
sort	query	string	Sort the returned ids based on one of the following properties: `created_timestamp` or `modified_timestamp` Sort either `asc` (ascending) or `desc` (descending); for example: `created_timestamp\|asc`.
type	query	string	The rule group type to retrieve the ids of. Allowed values are: `WindowsFiles`, `WindowsRegistry`, `LinuxFiles` or `MacFiles`.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.query_rule_groups(limit="string",
                                    offset=integer,
                                    sort="string",
                                    type="string")
print(response)

from falconpy import FileVantage

falcon = FileVantage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.queryRuleGroups(limit="string",
                                  offset=integer,
                                  sort="string",
                                  type="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryRuleGroups",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          type="string")
print(response)

Get-FalconFileVantageRuleGroup -Type "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/filevantage"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.Filevantage.QueryRuleGroups(
    &filevantage.QueryRuleGroupsParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Type: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.filevantage.queryRuleGroups(
  "string",  // type
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::filevantage_api::query_rule_groups;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_rule_groups(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Filevantage.new

response = api.query_rule_groups('string')

puts response

FileVantage

Table of Contents

getActionsMixin0

Parameters

Code Examples

startActions

Parameters

Code Examples

getContents

Parameters

Code Examples

getChanges

Parameters

Code Examples

updatePolicyHostGroups

Parameters

Code Examples

updatePolicyPrecedence

Parameters

Code Examples

updatePolicyRuleGroups

Parameters

Code Examples

getPolicies

Parameters

Code Examples

createPolicies

Parameters

Code Examples

deletePolicies

Parameters

Code Examples

updatePolicies

Parameters

Code Examples

getScheduledExclusions

Parameters

Code Examples

createScheduledExclusions

Parameters

Code Examples

deleteScheduledExclusions

Parameters

Code Examples

updateScheduledExclusions

Parameters

Code Examples

updateRuleGroupPrecedence

Parameters

Code Examples

getRules

Parameters

Code Examples

createRules

Parameters

Code Examples

deleteRules

Parameters

Code Examples

updateRules

Parameters

Code Examples

getRuleGroups

Parameters

Code Examples

createRuleGroups

Parameters

Code Examples

deleteRuleGroups

Parameters

Code Examples

updateRuleGroups

Parameters

Code Examples

signalChangesExternal

Parameters

Code Examples

queryActionsMixin0

Parameters

Code Examples