Firewall Policies

The Firewall Policies service collection provides operations for managing Firewall Policies. Search for policies and their members, perform actions on policies, set policy precedence, retrieve, create, delete, and update Firewall Policies.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
createFirewallPolicies create_policies	Create Firewall Policies by specifying details about the policy to create
deleteFirewallPolicies delete_policies	Delete a set of Firewall Policies by specifying their IDs
getFirewallPolicies get_policies	Retrieve a set of Firewall Policies by specifying their IDs
performFirewallPoliciesAction perform_action	Perform the specified action on the Firewall Policies specified in the request
queryCombinedFirewallPolicies query_combined_policies	Search for Firewall Policies in your environment by providing an FQL filter and paging details.
queryCombinedFirewallPolicyMembers query_combined_policy_members	Search for members of a Firewall Policy in your environment by providing an FQL filter and paging details.
queryFirewallPolicies query_policies	Search for Firewall Policies in your environment by providing an FQL filter and paging details.
queryFirewallPolicyMembers query_policy_members	Search for members of a Firewall Policy in your environment by providing an FQL filter and paging details.
setFirewallPoliciesPrecedence set_policies	Sets the precedence of Firewall Policies based on the order of IDs specified in the request.
updateFirewallPolicies update_policies	Update Firewall Policies by specifying the ID of the policy and details to update

---

createFirewallPolicies

Create Firewall Policies by specifying details about the policy to create

Method POST

Route /policy/entities/firewall/v1

Scope Firewall management: WRITE

PEP 8 create_policies

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

A collection of policies to create

clone_id query · string

The policy ID to be cloned from

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

description body · string

Firewall Policy description.

name body · string

Firewall Policy name.

platform_name body · string

Name of the operating system platform.

Code Examples

Python

PEP 8

from falconpy import FirewallPolicies

falcon = FirewallPolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.create_policies(clone_id="string",
                                  description="string",
                                  name="string",
                                  platform_name="string")
print(response)

Operation ID

from falconpy import FirewallPolicies

falcon = FirewallPolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.createFirewallPolicies(clone_id="string",
                                         description="string",
                                         name="string",
                                         platform_name="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "clone_id": "string",
            "description": "string",
            "name": "string",
            "platform_name": "string"
        }
    ]
}

response = falcon.command("createFirewallPolicies",
                          clone_id="string",
                          body=body_payload)
print(response)

PowerShell

New-FalconFirewallPolicy -Name "string" -PlatformName "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/firewall_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  clone_id := "string"
  description := "string"
  name := "string"
  platform_name := "string"
  cloneID := "string"

  response, err := client.FirewallPolicies.CreateFirewallPolicies(
    &firewall_policies.CreateFirewallPoliciesParams{
      Body: &models.FirewallCreateFirewallPoliciesReqV1{
        Resources: []interface{}{
          {
          CloneID: &clone_id,
          Description: &description,
          Name: &name,
          PlatformName: &platform_name,
          },
        },
      },
      CloneID: &cloneID,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.firewallPolicies.createFirewallPolicies(
  {  // body
      resources: [{
          cloneId: "string",
          description: "string",
          name: "string",
          platformName: "string"
        }]
  },
  "string"  // cloneId
);

console.log(response);

Rust

use rusty_falcon::apis::firewall_policies_api::create_firewall_policies;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::FirewallCreateFirewallPoliciesReqV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = FirewallCreateFirewallPoliciesReqV1 {
        resources: vec![CreateFirewallPolicyReqV1 {
            name: Some("string".to_string()),
            platform_name: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = create_firewall_policies(
        &falcon.cfg,  // configuration
        body,  // body
        Some("string"),  // clone_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FirewallPolicies.new

body = Falcon::FirewallCreateFirewallPoliciesReqV1.new(
  resources: [{
      clone_id: 'string',
      description: 'string',
      name: 'string',
      platform_name: 'string'
    }]
)

response = api.create_firewall_policies(body)

puts response

Responses

201 Created

[
  {
    "channel_version": 0,
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform_name": "string",
    "rule_set_id": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "channel_version": 0,
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "rule_set_id": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "channel_version": 0,
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "rule_set_id": "string"
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "channel_version": 0,
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "rule_set_id": "string"
    }
  ]
}

---

---

deleteFirewallPolicies

Delete a set of Firewall Policies by specifying their IDs

Method DELETE

Route /policy/entities/firewall/v1

Scope Firewall management: WRITE

PEP 8 delete_policies

Parameters

ids query · string or list of strings

The IDs of the Firewall Policies to delete

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import FirewallPolicies

falcon = FirewallPolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_policies(ids=id_list)
print(response)

Operation ID

from falconpy import FirewallPolicies

falcon = FirewallPolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteFirewallPolicies(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deleteFirewallPolicies",
                          ids=id_list)
print(response)

PowerShell

Remove-FalconFirewallPolicy -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/firewall_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.FirewallPolicies.DeleteFirewallPolicies(
    &firewall_policies.DeleteFirewallPoliciesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.firewallPolicies.deleteFirewallPolicies(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::firewall_policies_api::delete_firewall_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_firewall_policies(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FirewallPolicies.new

response = api.delete_firewall_policies(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  "string"
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

---

---

getFirewallPolicies

Retrieve a set of Firewall Policies by specifying their IDs

Method GET

Route /policy/entities/firewall/v1

Scope Firewall management: READ

PEP 8 get_policies

Parameters

ids query · string or list of strings

The IDs of the Firewall Policies to return

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import FirewallPolicies

falcon = FirewallPolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_policies(ids=id_list)
print(response)

Operation ID

from falconpy import FirewallPolicies

falcon = FirewallPolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getFirewallPolicies(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getFirewallPolicies",
                          ids=id_list)
print(response)

PowerShell

Get-FalconFirewallPolicy -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/firewall_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.FirewallPolicies.GetFirewallPolicies(
    &firewall_policies.GetFirewallPoliciesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.firewallPolicies.getFirewallPolicies(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::firewall_policies_api::get_firewall_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_firewall_policies(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FirewallPolicies.new

response = api.get_firewall_policies(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "channel_version": 0,
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform_name": "string",
    "rule_set_id": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "channel_version": 0,
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "rule_set_id": "string"
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "channel_version": 0,
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "rule_set_id": "string"
    }
  ]
}

---

---

performFirewallPoliciesAction

Perform the specified action on the Firewall Policies specified in the request

Method POST

Route /policy/entities/firewall-actions/v1

Scope Firewall management: WRITE

PEP 8 perform_action

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

action_parameters body · array

Action specific parameter options.

ids body · array

Firewall policy ID(s) to perform actions against.

action_name query · string

The action to perform

Available values (6)

add-host-group	add-rule-group	disable
enable	remove-host-group	remove-rule-group

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

group_id body · string

Host Group ID to apply the policy to. Overridden if action_parameters is specified.

Code Examples

Python

PEP 8

from falconpy import FirewallPolicies

falcon = FirewallPolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.perform_action(action_name="string",
                                 action_parameters=[{"key": "value"}],
                                 group_id="string",
                                 ids=id_list)
print(response)

Operation ID

from falconpy import FirewallPolicies

falcon = FirewallPolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.performFirewallPoliciesAction(action_name="string",
                                                action_parameters=[{"key": "value"}],
                                                group_id="string",
                                                ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "action_parameters": [
        {
            "name": "string",
            "value": "string"
        }
    ],
    "ids": ["string"]
}

response = falcon.command("performFirewallPoliciesAction",
                          action_name="string",
                          body=body_payload)
print(response)

PowerShell

Invoke-FalconFirewallPolicyAction -Name "string" -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/firewall_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"
  value := "string"

  response, err := client.FirewallPolicies.PerformFirewallPoliciesAction(
    &firewall_policies.PerformFirewallPoliciesActionParams{
      Body: &models.MsaEntityActionRequestV2{
        ActionParameters: []interface{}{
          {
          Name: &name,
          Value: &value,
          },
        },
        Ids: []string{"string"},
      },
      ActionName: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.firewallPolicies.performFirewallPoliciesAction(
  "string",  // actionName
  {  // body
      actionParameters: [{
          name: "string",
          value: "string"
        }],
      ids: []
  }
);

console.log(response);

Rust

use rusty_falcon::apis::firewall_policies_api::perform_firewall_policies_action;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaEntityActionRequestV2;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaEntityActionRequestV2 {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = perform_firewall_policies_action(
        &falcon.cfg,  // configuration
        "string",  // action_name
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FirewallPolicies.new

body = Falcon::MsaEntityActionRequestV2.new(
  action_parameters: [{
      name: 'string',
      value: 'string'
    }],
  ids: []
)

response = api.perform_firewall_policies_action(body, 'string')

puts response

Responses

200 OK

[
  {
    "channel_version": 0,
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform_name": "string",
    "rule_set_id": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "channel_version": 0,
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "rule_set_id": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "channel_version": 0,
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "rule_set_id": "string"
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "channel_version": 0,
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "rule_set_id": "string"
    }
  ]
}

---

---

queryCombinedFirewallPolicies

Search for Firewall Policies in your environment by providing an FQL filter and paging details.

Method GET

Route /policy/combined/firewall/v1

Scope Firewall management: READ

PEP 8 query_combined_policies

Parameters

filter query · string

FQL Syntax formatted string used to limit the results.

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return. [1-5000]

sort query · string

The property to sort by. (Ex: modified_timestamp.desc)

Available values (16)

created_by.asc	created_by.desc	created_timestamp.asc
created_timestamp.desc	enabled.asc	enabled.desc
modified_by.asc	modified_by.desc	modified_timestamp.asc
modified_timestamp.desc	name.asc	name.desc
platform_name.asc	platform_name.desc	precedence.asc
precedence.desc

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import FirewallPolicies

falcon = FirewallPolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.query_combined_policies(filter="string",
                                          limit=integer,
                                          offset=integer,
                                          sort="string")
print(response)

Operation ID

from falconpy import FirewallPolicies

falcon = FirewallPolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.queryCombinedFirewallPolicies(filter="string",
                                                limit=integer,
                                                offset=integer,
                                                sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryCombinedFirewallPolicies",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

PowerShell

Get-FalconFirewallPolicy -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/firewall_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.FirewallPolicies.QueryCombinedFirewallPolicies(
    &firewall_policies.QueryCombinedFirewallPoliciesParams{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.firewallPolicies.queryCombinedFirewallPolicies(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

Rust

use rusty_falcon::apis::firewall_policies_api::query_combined_firewall_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_combined_firewall_policies(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FirewallPolicies.new

response = api.query_combined_firewall_policies(filter: 'string',
                                                offset: integer,
                                                limit: integer,
                                                sort: 'string')

puts response

Responses

200 OK

[
  {
    "channel_version": 0,
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform_name": "string",
    "rule_set_id": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "channel_version": 0,
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "rule_set_id": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "channel_version": 0,
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "rule_set_id": "string"
    }
  ]
}

---

---

queryCombinedFirewallPolicyMembers

Search for members of a Firewall Policy in your environment by providing an FQL filter and paging details.

Method GET

Route /policy/combined/firewall-members/v1

Scope Firewall management: READ

PEP 8 query_combined_policy_members

Parameters

id query · string

The ID of the Firewall Policy to search for members of

filter query · string

FQL Syntax formatted string used to limit the results.

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return. [1-5000]

sort query · string

The property to sort by. (Ex: modified_timestamp.desc)

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import FirewallPolicies

falcon = FirewallPolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.query_combined_policy_members(id="string",
                                                filter="string",
                                                limit=integer,
                                                offset=integer,
                                                sort="string")
print(response)

Operation ID

from falconpy import FirewallPolicies

falcon = FirewallPolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.queryCombinedFirewallPolicyMembers(id="string",
                                                     filter="string",
                                                     limit=integer,
                                                     offset=integer,
                                                     sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryCombinedFirewallPolicyMembers",
                          id="string",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

PowerShell

Get-FalconFirewallPolicyMember -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/firewall_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  iD := "string"
  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.FirewallPolicies.QueryCombinedFirewallPolicyMembers(
    &firewall_policies.QueryCombinedFirewallPolicyMembersParams{
      ID: &iD,
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.firewallPolicies.queryCombinedFirewallPolicyMembers(
  "string",  // id
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

Rust

use rusty_falcon::apis::firewall_policies_api::query_combined_firewall_policy_members;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_combined_firewall_policy_members(
        &falcon.cfg,  // configuration
        Some("string"),  // id
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FirewallPolicies.new

response = api.query_combined_firewall_policy_members(id: 'string',
                                                      filter: 'string',
                                                      offset: integer,
                                                      limit: integer,
                                                      sort: 'string')

puts response

Responses

200 OK

[
  {
    "agent_load_flags": "string",
    "agent_local_time": "string",
    "agent_version": "string",
    "base_image_version": "string",
    "bios_manufacturer": "string",
    "bios_version": "string",
    "build_number": "string",
    "chassis_type": "string",
    "chassis_type_desc": "string",
    "cid": "string",
    "cloud_service_compartment_id": "string",
    "config_id_base": "string",
    "config_id_build": "string",
    "config_id_platform": "string",
    "connection_ip": "string",
    "connection_mac_address": "string",
    "cpu_signature": "string",
    "cpu_vendor": "string",
    "criticality": "string",
    "default_gateway_ip": "string",
    "deployment_type": "string",
    "detection_suppression_status": "string",
    "device_id": "string",
    "device_policies": {},
    "email": "string",
    "external_ip": "string",
    "filesystem_containment_status": "string",
    "first_login_timestamp": "string",
    "first_login_user": "string",
    "first_seen": "string",
    "group_hash": "string",
    "groups": [],
    "host_deleted_status": "string",
    "host_hidden_status": "string",
    "host_utc_offset": "string",
    "hostname": "string",
    "instance_id": "string",
    "internet_exposure": "string",
    "k8s_cluster_git_version": "string",
    "k8s_cluster_id": "string",
    "k8s_cluster_version": "string",
    "kernel_version": "string",
    "last_login_timestamp": "string",
    "last_login_uid": "string",
    "last_login_user": "string",
    "last_login_user_sid": "string",
    "last_reboot": "string",
    "last_seen": "string",
    "license_activation_state": "string",
    "linux_sensor_mode": "string",
    "local_ip": "string",
    "mac_address": "string",
    "machine_domain": "string",
    "major_version": "string",
    "managed_apps": {},
    "meta": {},
    "migration_completed_time": "string",
    "minor_version": "string",
    "modified_timestamp": "string",
    "notes": [],
    "os_build": "string",
    "os_product_name": "string",
    "os_version": "string",
    "ou": [],
    "platform_id": "string",
    "platform_name": "string",
    "pod_annotations": [],
    "pod_host_ip4": "string",
    "pod_host_ip6": "string",
    "pod_hostname": "string",
    "pod_id": "string",
    "pod_ip4": "string",
    "pod_ip6": "string",
    "pod_labels": [],
    "pod_name": "string",
    "pod_namespace": "string",
    "pod_service_account_name": "string",
    "pointer_size": "string",
    "policies": [],
    "product_type": "string",
    "product_type_desc": "string",
    "provision_status": "string",
    "reduced_functionality_mode": "string",
    "release_group": "string",
    "rtr_state": "string",
    "safe_mode": "string",
    "serial_number": "string",
    "service_pack_major": "string",
    "service_pack_minor": "string",
    "service_provider": "string",
    "service_provider_account_id": "string",
    "site_name": "string",
    "slow_changing_modified_timestamp": "string",
    "status": "string",
    "system_manufacturer": "string",
    "system_product_name": "string",
    "tags": [],
    "zone_group": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "agent_load_flags": "string",
      "agent_local_time": "string",
      "agent_version": "string",
      "base_image_version": "string",
      "bios_manufacturer": "string",
      "bios_version": "string",
      "build_number": "string",
      "chassis_type": "string",
      "chassis_type_desc": "string",
      "cid": "string",
      "cloud_service_compartment_id": "string",
      "config_id_base": "string",
      "config_id_build": "string",
      "config_id_platform": "string",
      "connection_ip": "string",
      "connection_mac_address": "string",
      "cpu_signature": "string",
      "cpu_vendor": "string",
      "criticality": "string",
      "default_gateway_ip": "string",
      "deployment_type": "string",
      "detection_suppression_status": "string",
      "device_id": "string",
      "device_policies": {},
      "email": "string",
      "external_ip": "string",
      "filesystem_containment_status": "string",
      "first_login_timestamp": "string",
      "first_login_user": "string",
      "first_seen": "string",
      "group_hash": "string",
      "groups": [],
      "host_deleted_status": "string",
      "host_hidden_status": "string",
      "host_utc_offset": "string",
      "hostname": "string",
      "instance_id": "string",
      "internet_exposure": "string",
      "k8s_cluster_git_version": "string",
      "k8s_cluster_id": "string",
      "k8s_cluster_version": "string",
      "kernel_version": "string",
      "last_login_timestamp": "string",
      "last_login_uid": "string",
      "last_login_user": "string",
      "last_login_user_sid": "string",
      "last_reboot": "string",
      "last_seen": "string",
      "license_activation_state": "string",
      "linux_sensor_mode": "string",
      "local_ip": "string",
      "mac_address": "string",
      "machine_domain": "string",
      "major_version": "string",
      "managed_apps": {},
      "meta": {},
      "migration_completed_time": "string",
      "minor_version": "string",
      "modified_timestamp": "string",
      "notes": [],
      "os_build": "string",
      "os_product_name": "string",
      "os_version": "string",
      "ou": [],
      "platform_id": "string",
      "platform_name": "string",
      "pod_annotations": [],
      "pod_host_ip4": "string",
      "pod_host_ip6": "string",
      "pod_hostname": "string",
      "pod_id": "string",
      "pod_ip4": "string",
      "pod_ip6": "string",
      "pod_labels": [],
      "pod_name": "string",
      "pod_namespace": "string",
      "pod_service_account_name": "string",
      "pointer_size": "string",
      "policies": [],
      "product_type": "string",
      "product_type_desc": "string",
      "provision_status": "string",
      "reduced_functionality_mode": "string",
      "release_group": "string",
      "rtr_state": "string",
      "safe_mode": "string",
      "serial_number": "string",
      "service_pack_major": "string",
      "service_pack_minor": "string",
      "service_provider": "string",
      "service_provider_account_id": "string",
      "site_name": "string",
      "slow_changing_modified_timestamp": "string",
      "status": "string",
      "system_manufacturer": "string",
      "system_product_name": "string",
      "tags": [],
      "zone_group": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "agent_load_flags": "string",
      "agent_local_time": "string",
      "agent_version": "string",
      "base_image_version": "string",
      "bios_manufacturer": "string",
      "bios_version": "string",
      "build_number": "string",
      "chassis_type": "string",
      "chassis_type_desc": "string",
      "cid": "string",
      "cloud_service_compartment_id": "string",
      "config_id_base": "string",
      "config_id_build": "string",
      "config_id_platform": "string",
      "connection_ip": "string",
      "connection_mac_address": "string",
      "cpu_signature": "string",
      "cpu_vendor": "string",
      "criticality": "string",
      "default_gateway_ip": "string",
      "deployment_type": "string",
      "detection_suppression_status": "string",
      "device_id": "string",
      "device_policies": {},
      "email": "string",
      "external_ip": "string",
      "filesystem_containment_status": "string",
      "first_login_timestamp": "string",
      "first_login_user": "string",
      "first_seen": "string",
      "group_hash": "string",
      "groups": [],
      "host_deleted_status": "string",
      "host_hidden_status": "string",
      "host_utc_offset": "string",
      "hostname": "string",
      "instance_id": "string",
      "internet_exposure": "string",
      "k8s_cluster_git_version": "string",
      "k8s_cluster_id": "string",
      "k8s_cluster_version": "string",
      "kernel_version": "string",
      "last_login_timestamp": "string",
      "last_login_uid": "string",
      "last_login_user": "string",
      "last_login_user_sid": "string",
      "last_reboot": "string",
      "last_seen": "string",
      "license_activation_state": "string",
      "linux_sensor_mode": "string",
      "local_ip": "string",
      "mac_address": "string",
      "machine_domain": "string",
      "major_version": "string",
      "managed_apps": {},
      "meta": {},
      "migration_completed_time": "string",
      "minor_version": "string",
      "modified_timestamp": "string",
      "notes": [],
      "os_build": "string",
      "os_product_name": "string",
      "os_version": "string",
      "ou": [],
      "platform_id": "string",
      "platform_name": "string",
      "pod_annotations": [],
      "pod_host_ip4": "string",
      "pod_host_ip6": "string",
      "pod_hostname": "string",
      "pod_id": "string",
      "pod_ip4": "string",
      "pod_ip6": "string",
      "pod_labels": [],
      "pod_name": "string",
      "pod_namespace": "string",
      "pod_service_account_name": "string",
      "pointer_size": "string",
      "policies": [],
      "product_type": "string",
      "product_type_desc": "string",
      "provision_status": "string",
      "reduced_functionality_mode": "string",
      "release_group": "string",
      "rtr_state": "string",
      "safe_mode": "string",
      "serial_number": "string",
      "service_pack_major": "string",
      "service_pack_minor": "string",
      "service_provider": "string",
      "service_provider_account_id": "string",
      "site_name": "string",
      "slow_changing_modified_timestamp": "string",
      "status": "string",
      "system_manufacturer": "string",
      "system_product_name": "string",
      "tags": [],
      "zone_group": "string"
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "agent_load_flags": "string",
      "agent_local_time": "string",
      "agent_version": "string",
      "base_image_version": "string",
      "bios_manufacturer": "string",
      "bios_version": "string",
      "build_number": "string",
      "chassis_type": "string",
      "chassis_type_desc": "string",
      "cid": "string",
      "cloud_service_compartment_id": "string",
      "config_id_base": "string",
      "config_id_build": "string",
      "config_id_platform": "string",
      "connection_ip": "string",
      "connection_mac_address": "string",
      "cpu_signature": "string",
      "cpu_vendor": "string",
      "criticality": "string",
      "default_gateway_ip": "string",
      "deployment_type": "string",
      "detection_suppression_status": "string",
      "device_id": "string",
      "device_policies": {},
      "email": "string",
      "external_ip": "string",
      "filesystem_containment_status": "string",
      "first_login_timestamp": "string",
      "first_login_user": "string",
      "first_seen": "string",
      "group_hash": "string",
      "groups": [],
      "host_deleted_status": "string",
      "host_hidden_status": "string",
      "host_utc_offset": "string",
      "hostname": "string",
      "instance_id": "string",
      "internet_exposure": "string",
      "k8s_cluster_git_version": "string",
      "k8s_cluster_id": "string",
      "k8s_cluster_version": "string",
      "kernel_version": "string",
      "last_login_timestamp": "string",
      "last_login_uid": "string",
      "last_login_user": "string",
      "last_login_user_sid": "string",
      "last_reboot": "string",
      "last_seen": "string",
      "license_activation_state": "string",
      "linux_sensor_mode": "string",
      "local_ip": "string",
      "mac_address": "string",
      "machine_domain": "string",
      "major_version": "string",
      "managed_apps": {},
      "meta": {},
      "migration_completed_time": "string",
      "minor_version": "string",
      "modified_timestamp": "string",
      "notes": [],
      "os_build": "string",
      "os_product_name": "string",
      "os_version": "string",
      "ou": [],
      "platform_id": "string",
      "platform_name": "string",
      "pod_annotations": [],
      "pod_host_ip4": "string",
      "pod_host_ip6": "string",
      "pod_hostname": "string",
      "pod_id": "string",
      "pod_ip4": "string",
      "pod_ip6": "string",
      "pod_labels": [],
      "pod_name": "string",
      "pod_namespace": "string",
      "pod_service_account_name": "string",
      "pointer_size": "string",
      "policies": [],
      "product_type": "string",
      "product_type_desc": "string",
      "provision_status": "string",
      "reduced_functionality_mode": "string",
      "release_group": "string",
      "rtr_state": "string",
      "safe_mode": "string",
      "serial_number": "string",
      "service_pack_major": "string",
      "service_pack_minor": "string",
      "service_provider": "string",
      "service_provider_account_id": "string",
      "site_name": "string",
      "slow_changing_modified_timestamp": "string",
      "status": "string",
      "system_manufacturer": "string",
      "system_product_name": "string",
      "tags": [],
      "zone_group": "string"
    }
  ]
}

---

---

queryFirewallPolicies

Search for Firewall Policies in your environment by providing an FQL filter and paging details.

Method GET

Route /policy/queries/firewall/v1

Scope Firewall management: READ

PEP 8 query_policies

Parameters

filter query · string

FQL Syntax formatted string used to limit the results.

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return. [1-5000]

sort query · string

The property to sort by. (Ex: modified_timestamp.desc)

Available values (16)

created_by.asc	created_by.desc	created_timestamp.asc
created_timestamp.desc	enabled.asc	enabled.desc
modified_by.asc	modified_by.desc	modified_timestamp.asc
modified_timestamp.desc	name.asc	name.desc
platform_name.asc	platform_name.desc	precedence.asc
precedence.desc

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import FirewallPolicies

falcon = FirewallPolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.query_policies(filter="string",
                                 limit=integer,
                                 offset=integer,
                                 sort="string")
print(response)

Operation ID

from falconpy import FirewallPolicies

falcon = FirewallPolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.queryFirewallPolicies(filter="string",
                                        limit=integer,
                                        offset=integer,
                                        sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryFirewallPolicies",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

PowerShell

Get-FalconFirewallPolicy -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/firewall_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.FirewallPolicies.QueryFirewallPolicies(
    &firewall_policies.QueryFirewallPoliciesParams{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.firewallPolicies.queryFirewallPolicies(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

Rust

use rusty_falcon::apis::firewall_policies_api::query_firewall_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_firewall_policies(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FirewallPolicies.new

response = api.query_firewall_policies(filter: 'string',
                                       offset: integer,
                                       limit: integer,
                                       sort: 'string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

---

---

queryFirewallPolicyMembers

Search for members of a Firewall Policy in your environment by providing an FQL filter and paging details.

Method GET

Route /policy/queries/firewall-members/v1

Scope Firewall management: READ

PEP 8 query_policy_members

Parameters

id query · string

The ID of the Firewall Policy to search for members of

filter query · string

FQL Syntax formatted string used to limit the results.

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return. [1-5000]

sort query · string

The property to sort by. (Ex: modified_timestamp.desc)

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import FirewallPolicies

falcon = FirewallPolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.query_policy_members(id="string",
                                       filter="string",
                                       limit=integer,
                                       offset=integer,
                                       sort="string")
print(response)

Operation ID

from falconpy import FirewallPolicies

falcon = FirewallPolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.queryFirewallPolicyMembers(id="string",
                                             filter="string",
                                             limit=integer,
                                             offset=integer,
                                             sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryFirewallPolicyMembers",
                          id="string",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

PowerShell

Get-FalconFirewallPolicyMember -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/firewall_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  iD := "string"
  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.FirewallPolicies.QueryFirewallPolicyMembers(
    &firewall_policies.QueryFirewallPolicyMembersParams{
      ID: &iD,
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.firewallPolicies.queryFirewallPolicyMembers(
  "string",  // id
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

Rust

use rusty_falcon::apis::firewall_policies_api::query_firewall_policy_members;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_firewall_policy_members(
        &falcon.cfg,  // configuration
        Some("string"),  // id
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FirewallPolicies.new

response = api.query_firewall_policy_members(id: 'string',
                                             filter: 'string',
                                             offset: integer,
                                             limit: integer,
                                             sort: 'string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

---

---

setFirewallPoliciesPrecedence

Sets the precedence of Firewall Policies based on the order of IDs specified in the request.

Method POST

Route /policy/entities/firewall-precedence/v1

Scope Firewall management: WRITE

PEP 8 set_policies

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

ids body · array

The ids of all current prevention policies for the platform specified. The precedence will be set in the order the ids are specified

platform_name body · string

The name of the platform for which to set precedence

Available values (3)

Windows

Mac

Linux

Code Examples

Python

PEP 8

from falconpy import FirewallPolicies

falcon = FirewallPolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.set_policies(ids=id_list, platform_name="string")
print(response)

Operation ID

from falconpy import FirewallPolicies

falcon = FirewallPolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.setFirewallPoliciesPrecedence(ids=id_list,
                                                platform_name="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "ids": ["string"],
    "platform_name": "string"
}

response = falcon.command("setFirewallPoliciesPrecedence", body=body_payload)
print(response)

PowerShell

Set-FalconFirewallPrecedence -PlatformName "string" -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/firewall_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  platform_name := "string"

  response, err := client.FirewallPolicies.SetFirewallPoliciesPrecedence(
    &firewall_policies.SetFirewallPoliciesPrecedenceParams{
      Body: &models.BaseSetPolicyPrecedenceReqV1{
        Ids: []string{"string"},
        PlatformName: &platform_name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.firewallPolicies.setFirewallPoliciesPrecedence(
  {
    ids: [],
    platformName: "string"
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::firewall_policies_api::set_firewall_policies_precedence;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::BaseSetPolicyPrecedenceReqV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = BaseSetPolicyPrecedenceReqV1 {
        ids: vec!["string".to_string()],
        platform_name: Some("string".to_string()),
        ..Default::default()
    };

    let response = set_firewall_policies_precedence(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FirewallPolicies.new

body = Falcon::BaseSetPolicyPrecedenceReqV1.new(
  ids: [],
  platform_name: 'string'
)

response = api.set_firewall_policies_precedence(body)

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

---

---

updateFirewallPolicies

Update Firewall Policies by specifying the ID of the policy and details to update

Method PATCH

Route /policy/entities/firewall/v1

Scope Firewall management: WRITE

PEP 8 update_policies

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

A collection of policies to update

id body · string

ID of the Device Control Policy to update.

description body · string

Device Control Policy description.

name body · string

Device Control Policy name.

Code Examples

Python

PEP 8

from falconpy import FirewallPolicies

falcon = FirewallPolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.update_policies(id="string",
                                  description="string",
                                  name="string")
print(response)

Operation ID

from falconpy import FirewallPolicies

falcon = FirewallPolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.updateFirewallPolicies(id="string",
                                         description="string",
                                         name="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "description": "string",
            "id": "string",
            "name": "string"
        }
    ]
}

response = falcon.command("updateFirewallPolicies", body=body_payload)
print(response)

PowerShell

Edit-FalconFirewallPolicy -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/firewall_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  id := "string"
  name := "string"

  response, err := client.FirewallPolicies.UpdateFirewallPolicies(
    &firewall_policies.UpdateFirewallPoliciesParams{
      Body: &models.FirewallUpdateFirewallPoliciesReqV1{
        Resources: []interface{}{
          {
          Description: &description,
          ID: &id,
          Name: &name,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.firewallPolicies.updateFirewallPolicies(
  {
    resources: [{
        description: "string",
        id: "string",
        name: "string"
      }]
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::firewall_policies_api::update_firewall_policies;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::FirewallUpdateFirewallPoliciesReqV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = FirewallUpdateFirewallPoliciesReqV1 {
        resources: vec![UpdateFirewallPolicyReqV1 {
            id: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = update_firewall_policies(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FirewallPolicies.new

body = Falcon::FirewallUpdateFirewallPoliciesReqV1.new(
  resources: [{
      description: 'string',
      id: 'string',
      name: 'string'
    }]
)

response = api.update_firewall_policies(body)

puts response

Responses

200 OK

[
  {
    "channel_version": 0,
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform_name": "string",
    "rule_set_id": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "channel_version": 0,
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "rule_set_id": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "channel_version": 0,
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "rule_set_id": "string"
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "channel_version": 0,
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "rule_set_id": "string"
    }
  ]
}