Foundry LogScale

The Foundry LogScale service collection provides operations for ingesting data, managing lookup files, executing saved searches, and listing repositories and views within your CrowdStrike Falcon Foundry LogScale environment.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
CreateSavedSearchesDynamicExecuteV1 execute_dynamic	Execute a dynamic saved search
CreateSavedSearchesExecuteV1 execute	Execute a saved search
CreateSavedSearchesIngestV1 populate	Populate a saved search
GetSavedSearchesExecuteV1 get_search_results	Get the results of a saved search
GetSavedSearchesJobResultsDownloadV1 download_results	Get the results of a saved search as a file
IngestDataAsyncV1 ingest_data_async	Asynchronously ingest data into the application repository
IngestDataV1 ingest_data	Synchronously ingest data into the application repository
ListReposV1 list_repos	Lists available repositories
ListViewV1 list_views	List available views

---

CreateSavedSearchesDynamicExecuteV1

Execute a dynamic saved search

Method POST

Route /loggingapi/entities/saved-searches/execute-dynamic/v1

Scope App Logs: WRITE

PEP 8 execute_dynamic

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

end body · string

Ending position.

repo_or_view body · string

Name of the repo or view to perform the search.

search_query body · string

Query for the search.

search_query_args body · object

Argumetns provided to the search.

start body · string

Starting position.

app_id query · string

Application ID.

include_schema_generation query · boolean

Include generated schemas in the response

include_test_data query · boolean

Include test data when executing searches

infer_json_types query · boolean

Whether to try to infer data types in json event response instead of returning map[string]string

match_response_schema query · boolean

Whether to validate search results against their schema

metadata query · boolean

Whether to include metadata in the response

mode query · string

Mode to execute the query under.

Available values (3)

sync

async

async_offload

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

incude_test_data body · boolean

Include test data when executing searches.

Code Examples

Python

PEP 8

from falconpy import FoundryLogScale

falcon = FoundryLogScale(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

search_query_args = {}

response = falcon.execute_dynamic(app_id="string",
                                  end="string",
                                  include_schema_generation=boolean,
                                  incude_test_data=boolean,
                                  infer_json_types=boolean,
                                  match_response_schema=boolean,
                                  metadata=boolean,
                                  mode="string",
                                  repo_or_view="string",
                                  search_query="string",
                                  search_query_args=search_query_args,
                                  start="string")
print(response)

Operation ID

from falconpy import FoundryLogScale

falcon = FoundryLogScale(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

search_query_args = {}

response = falcon.CreateSavedSearchesDynamicExecuteV1(app_id="string",
                                                      end="string",
                                                      include_schema_generation=boolean,
                                                      incude_test_data=boolean,
                                                      infer_json_types=boolean,
                                                      match_response_schema=boolean,
                                                      metadata=boolean,
                                                      mode="string",
                                                      repo_or_view="string",
                                                      search_query="string",
                                                      search_query_args=search_query_args,
                                                      start="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "end": "string",
    "repo_or_view": "string",
    "search_query": "string",
    "search_query_args": {},
    "start": "string"
}

response = falcon.command("CreateSavedSearchesDynamicExecuteV1",
                          app_id="string",
                          include_schema_generation=boolean,
                          include_test_data=boolean,
                          infer_json_types=boolean,
                          match_response_schema=boolean,
                          metadata=boolean,
                          mode="string",
                          body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/foundry_logscale"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  end := "string"
  repo_or_view := "string"
  search_query := "string"
  start := "string"
  appID := "string"
  includeSchemaGeneration := boolean
  includeTestData := boolean
  inferJSONTypes := boolean
  matchResponseSchema := boolean
  metadata := boolean
  mode := "string"

  response, err := client.FoundryLogscale.ExecuteDynamic(
    &foundry_logscale.ExecuteDynamicParams{
      Body: &models.ApidomainDynamicExecuteSearchRequestV1{
        End: &end,
        RepoOrView: &repo_or_view,
        SearchQuery: &search_query,
        SearchQueryArgs: &struct{}{},
        Start: &start,
      },
      AppID: &appID,
      IncludeSchemaGeneration: &includeSchemaGeneration,
      IncludeTestData: &includeTestData,
      InferJSONTypes: &inferJSONTypes,
      MatchResponseSchema: &matchResponseSchema,
      Metadata: &metadata,
      Mode: &mode,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.foundryLogscale.executeDynamic(
  {  // body
      end: "string",
      repoOrView: "string",
      searchQuery: "string",
      searchQueryArgs: {},
      start: "string"
  },
  "string",  // appId
  boolean,  // includeSchemaGeneration
  boolean,  // includeTestData
  boolean,  // inferJsonTypes
  boolean,  // matchResponseSchema
  boolean,  // metadata
  "string"  // mode
);

console.log(response);

Rust

use rusty_falcon::apis::foundry_logscale_api::create_saved_searches_dynamic_execute_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApidomainDynamicExecuteSearchRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ApidomainDynamicExecuteSearchRequestV1 {
        repo_or_view: Some("string".to_string()),
        search_query: Some("string".to_string()),
        search_query_args: Default::default(),
        ..Default::default()
    };

    let response = create_saved_searches_dynamic_execute_v1(
        &falcon.cfg,  // configuration
        body,  // body
        Some("string"),  // app_id
        Some(boolean),  // include_schema_generation
        Some(boolean),  // include_test_data
        Some(boolean),  // infer_json_types
        Some(boolean),  // match_response_schema
        Some(boolean),  // metadata
        Some("string"),  // mode
        Some("string"),  // x_cs_useruuid
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FoundryLogscale.new

body = {
  end: 'string',
  repo_or_view: 'string',
  search_query: 'string',
  search_query_args: {},
  start: 'string'
}

response = api.create_saved_searches_dynamic_execute_v1(body)

puts response

Responses

200 OK

[
  {
    "event_count": 0,
    "events": [],
    "fields": [],
    "filtered_event_count": 0,
    "job_status": {},
    "meta_data": {},
    "schemas": {}
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

CreateSavedSearchesExecuteV1

Execute a saved search

Method POST

Route /loggingapi/entities/saved-searches/execute/v1

Scope App Logs: WRITE

PEP 8 execute

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

end body · string

Ending position.

id body · string

Saved search ID.

mode body · string

name body · string

Saved search name.

parameters body · object

start body · string

Starting position.

version body · string

with_in body · object

With in.

with_limit body · object

With limit.

with_renames body · array

With renames.

with_sort body · object

With sort.

app_id query · string

Application ID.

detailed query · boolean

Whether to include search field details

include_test_data query · boolean

Include test data when executing searches

infer_json_types query · boolean

Whether to try to infer data types in json event response instead of returning map[string]string

match_response_schema query · boolean

Whether to validate search results against their schema

metadata query · boolean

Whether to include metadata in the response

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

search_parameters body · dictionary

Search specific parameters. NOT to be confused with the default parameters.

Code Examples

Python

PEP 8

from falconpy import FoundryLogScale

falcon = FoundryLogScale(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

with_in = {
    "field": "string",
    "values": [
        "string"
    ]
}

with_limit = {
    "from": "string",
    "limit": 0
}

with_sort = {
    "fields": [
        "string"
    ],
    "limit": 0,
    "order": [
        "string"
    ],
    "reverse": True,
    "type": [
        "string"
    ]
}

response = falcon.execute(app_id="string",
                          detailed=boolean,
                          end="string",
                          id="string",
                          include_test_data=boolean,
                          infer_json_types=boolean,
                          match_response_schema=boolean,
                          metadata=boolean,
                          name="string",
                          search_parameters={},
                          start="string",
                          with_in=with_in,
                          with_limit=with_limit,
                          with_renames=["string"],
                          with_sort=with_sort)
print(response)

Operation ID

from falconpy import FoundryLogScale

falcon = FoundryLogScale(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

with_in = {
    "field": "string",
    "values": [
        "string"
    ]
}

with_limit = {
    "from": "string",
    "limit": 0
}

with_sort = {
    "fields": [
        "string"
    ],
    "limit": 0,
    "order": [
        "string"
    ],
    "reverse": True,
    "type": [
        "string"
    ]
}

response = falcon.CreateSavedSearchesExecuteV1(app_id="string",
                                               detailed=boolean,
                                               end="string",
                                               id="string",
                                               include_test_data=boolean,
                                               infer_json_types=boolean,
                                               match_response_schema=boolean,
                                               metadata=boolean,
                                               name="string",
                                               search_parameters={},
                                               start="string",
                                               with_in=with_in,
                                               with_limit=with_limit,
                                               with_renames=["string"],
                                               with_sort=with_sort)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "end": "string",
    "id": "string",
    "mode": "string",
    "name": "string",
    "parameters": {},
    "start": "string",
    "version": "string",
    "with_in": {
        "field": "string",
        "values": ["string"]
    },
    "with_limit": {
        "from": "string",
        "limit": integer
    },
    "with_renames": [
        {
            "as": "string",
            "field": "string"
        }
    ],
    "with_sort": {
        "fields": ["string"],
        "limit": integer,
        "order": ["string"],
        "reverse": boolean,
        "type": ["string"]
    }
}

response = falcon.command("CreateSavedSearchesExecuteV1",
                          app_id="string",
                          detailed=boolean,
                          include_test_data=boolean,
                          infer_json_types=boolean,
                          match_response_schema=boolean,
                          metadata=boolean,
                          body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/foundry_logscale"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  end := "string"
  id := "string"
  mode := "string"
  name := "string"
  start := "string"
  version := "string"
  as := "string"
  field := "string"
  appID := "string"
  detailed := boolean
  includeTestData := boolean
  inferJSONTypes := boolean
  matchResponseSchema := boolean
  metadata := boolean

  response, err := client.FoundryLogscale.Execute(
    &foundry_logscale.ExecuteParams{
      Body: &models.ApidomainSavedSearchExecuteRequestV1{
        End: &end,
        ID: &id,
        Mode: &mode,
        Name: &name,
        Parameters: &struct{}{},
        Start: &start,
        Version: &version,
        WithIn: &struct{}{},
        WithLimit: &struct{}{},
        WithRenames: []interface{}{
          {
          As: &as,
          Field: &field,
          },
        },
        WithSort: &struct{}{},
      },
      AppID: &appID,
      Detailed: &detailed,
      IncludeTestData: &includeTestData,
      InferJSONTypes: &inferJSONTypes,
      MatchResponseSchema: &matchResponseSchema,
      Metadata: &metadata,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.foundryLogscale.execute(
  {  // body
      end: "string",
      id: "string",
      mode: "string",
      name: "string",
      parameters: {},
      start: "string",
      version: "string",
      withIn: {
        field: "string",
        values: []
      },
      withLimit: {
        from: "string",
        limit: integer
      },
      withRenames: [{
          as: "string",
          field: "string"
        }],
      withSort: {
        fields: [],
        limit: integer,
        order: [],
        reverse: boolean,
        type: []
      }
  },
  "string",  // appId
  boolean,  // detailed
  boolean,  // includeTestData
  boolean,  // inferJsonTypes
  boolean,  // matchResponseSchema
  boolean  // metadata
);

console.log(response);

Rust

use rusty_falcon::apis::foundry_logscale_api::create_saved_searches_execute_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApidomainSavedSearchExecuteRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ApidomainSavedSearchExecuteRequestV1 {
        ..Default::default()
    };

    let response = create_saved_searches_execute_v1(
        &falcon.cfg,  // configuration
        body,  // body
        Some("string"),  // app_id
        Some(boolean),  // detailed
        Some(boolean),  // include_test_data
        Some(boolean),  // infer_json_types
        Some(boolean),  // match_response_schema
        Some(boolean),  // metadata
        Some("string"),  // x_cs_useruuid
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FoundryLogscale.new

body = {
  end: 'string',
  id: 'string',
  mode: 'string',
  name: 'string',
  parameters: {},
  start: 'string',
  version: 'string',
  with_in: {
    field: 'string',
    values: []
  },
  with_limit: {
    from: 'string',
    limit: integer
  },
  with_renames: [{
      as: 'string',
      field: 'string'
    }],
  with_sort: {
    fields: [],
    limit: integer,
    order: [],
    reverse: boolean,
    type: []
  }
}

response = api.create_saved_searches_execute_v1(body)

puts response

Responses

200 OK

[
  {
    "event_count": 0,
    "events": [],
    "fields": [],
    "filtered_event_count": 0,
    "job_status": {},
    "meta_data": {},
    "schemas": {}
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

CreateSavedSearchesIngestV1

Populate a saved search

Method POST

Route /loggingapi/entities/saved-searches/ingest/v1

Scope App Logs: WRITE

PEP 8 populate

Parameters

app_id query · string

Application ID.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import FoundryLogScale

falcon = FoundryLogScale(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.populate(app_id="string")
print(response)

Operation ID

from falconpy import FoundryLogScale

falcon = FoundryLogScale(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.CreateSavedSearchesIngestV1(app_id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("CreateSavedSearchesIngestV1",
                          app_id="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/foundry_logscale"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  appID := "string"

  response, err := client.FoundryLogscale.Populate(
    &foundry_logscale.PopulateParams{
      AppID: &appID,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.foundryLogscale.populate("string");  // appId

console.log(response);

Rust

use rusty_falcon::apis::foundry_logscale_api::create_saved_searches_ingest_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = create_saved_searches_ingest_v1(
        &falcon.cfg,  // configuration
        Some("string"),  // app_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FoundryLogscale.new

response = api.create_saved_searches_ingest_v1(app_id: 'string')

puts response

Responses

200 OK

[
  {
    "error_message": "string",
    "failed_events": 0,
    "failed_item_indices": [],
    "partial_success": false,
    "repo": {},
    "rows_written": 0,
    "successful_events": 0,
    "total_events": 0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

GetSavedSearchesExecuteV1

Get the results of a saved search

Method GET

Route /loggingapi/entities/saved-searches/execute/v1

Scope App Logs: READ

PEP 8 get_search_results

Parameters

job_id query · string

Job ID for a previously executed async query

app_id query · string

Application ID.

infer_json_types query · boolean

Whether to try to infer data types in json event response instead of returning map[string]string

job_status_only query · boolean

If set to true, result rows are dropped from the response and only the job status is returned

limit query · string

Maximum number of records to return.

match_response_schema query · boolean

Whether to validate search results against their schema

metadata query · boolean

Whether to include metadata in the response

offset query · string

Starting pagination offset of records to return.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import FoundryLogScale

falcon = FoundryLogScale(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_search_results(app_id="string",
                                     job_id="string",
                                     job_status_only=boolean,
                                     limit="string",
                                     infer_json_types=boolean,
                                     match_response_schema=boolean,
                                     metadata=boolean,
                                     offset="string")
print(response)

Operation ID

from falconpy import FoundryLogScale

falcon = FoundryLogScale(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.GetSavedSearchesExecuteV1(app_id="string",
                                            job_id="string",
                                            job_status_only=boolean,
                                            limit="string",
                                            infer_json_types=boolean,
                                            match_response_schema=boolean,
                                            metadata=boolean,
                                            offset="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetSavedSearchesExecuteV1",
                          job_id="string",
                          app_id="string",
                          infer_json_types=boolean,
                          job_status_only=boolean,
                          limit="string",
                          match_response_schema=boolean,
                          metadata=boolean,
                          offset="string")
print(response)

PowerShell

Get-FalconFoundrySearch -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/foundry_logscale"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  appID := "string"
  inferJSONTypes := boolean
  jobStatusOnly := boolean
  limit := "string"
  matchResponseSchema := boolean
  metadata := boolean
  offset := "string"

  response, err := client.FoundryLogscale.GetSearchResults(
    &foundry_logscale.GetSearchResultsParams{
      JobID: "string",
      AppID: &appID,
      InferJSONTypes: &inferJSONTypes,
      JobStatusOnly: &jobStatusOnly,
      Limit: &limit,
      MatchResponseSchema: &matchResponseSchema,
      Metadata: &metadata,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.foundryLogscale.getSearchResults(
  "string",  // jobId
  "string",  // appId
  boolean,  // inferJsonTypes
  boolean,  // jobStatusOnly
  "string",  // limit
  boolean,  // matchResponseSchema
  boolean,  // metadata
  "string"  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::foundry_logscale_api::get_saved_searches_execute_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_saved_searches_execute_v1(
        &falcon.cfg,  // configuration
        "string",  // job_id
        Some("string"),  // app_id
        Some(boolean),  // infer_json_types
        Some(boolean),  // job_status_only
        Some("string"),  // limit
        Some(boolean),  // match_response_schema
        Some(boolean),  // metadata
        Some("string"),  // offset
        Some("string"),  // x_cs_useruuid
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FoundryLogscale.new

response = api.get_saved_searches_execute_v1('string')

puts response

Responses

200 OK

[
  {
    "event_count": 0,
    "events": [],
    "fields": [],
    "filtered_event_count": 0,
    "job_status": {},
    "meta_data": {},
    "schemas": {}
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

GetSavedSearchesJobResultsDownloadV1

Get the results of a saved search as a file

Method GET

Route /loggingapi/entities/saved-searches/job-results-download/v1

Scope App Logs: READ

PEP 8 download_results

Parameters

job_id query · string

Job ID for a previously executed async query

infer_json_types query · boolean

Whether to try to infer data types in json event response instead of returning map[string]string

result_format query · string

Result Format

Available values (2)

json

csv

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import FoundryLogScale

falcon = FoundryLogScale(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

with open("output_file", "wb") as save_file:
    response = falcon.download_results(job_id="string",
                                       infer_json_types=boolean,
                                       result_format="string",
                                       stream=boolean)
    save_file.write(response)

Operation ID

from falconpy import FoundryLogScale

falcon = FoundryLogScale(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

with open("output_file", "wb") as save_file:
    response = falcon.GetSavedSearchesJobResultsDownloadV1(job_id="string",
                                                           infer_json_types=boolean,
                                                           result_format="string",
                                                           stream=boolean)
    save_file.write(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

with open("output_file", "wb") as save_file:
    response = falcon.command("GetSavedSearchesJobResultsDownloadV1",
                              job_id="string",
                              infer_json_types=boolean,
                              result_format="string")
    save_file.write(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/foundry_logscale"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  inferJSONTypes := boolean
  resultFormat := "string"

  response, err := client.FoundryLogscale.DownloadResults(
    &foundry_logscale.DownloadResultsParams{
      JobID: "string",
      InferJSONTypes: &inferJSONTypes,
      ResultFormat: &resultFormat,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.foundryLogscale.downloadResults(
  "string",  // jobId
  boolean,  // inferJsonTypes
  "string"  // resultFormat
);

console.log(response);

Rust

use rusty_falcon::apis::foundry_logscale_api::get_saved_searches_job_results_download_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_saved_searches_job_results_download_v1(
        &falcon.cfg,  // configuration
        "string",  // job_id
        Some(boolean),  // infer_json_types
        Some("string"),  // result_format
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FoundryLogscale.new

response = api.get_saved_searches_job_results_download_v1('string')

puts response

Responses

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

401 Unauthorized

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

IngestDataAsyncV1

Asynchronously ingest data into the application repository

Method POST

Route /loggingapi/entities/data-ingestion/ingest-async/v1

Scope App Logs: WRITE

PEP 8 ingest_data_async

Parameters

data_content body · string

JSON data to ingest

data_file body · file

Data file to ingest

repo body · string

Repository name if not part of a foundry app

tag body · string or list of strings

Custom tag for ingested data in the form tag:value

tag_source body · string

Tag the data with the specified source

test_data body · boolean

Tag the data with test-ingest

Code Examples

Python

PEP 8

from falconpy import FoundryLogScale

falcon = FoundryLogScale(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.ingest_data_async(data_content="string",
                                    data_file="string",
                                    tag="string",
                                    tag_source="string",
                                    test_data=boolean)
print(response)

Operation ID

from falconpy import FoundryLogScale

falcon = FoundryLogScale(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.IngestDataAsyncV1(data_content="string",
                                    data_file="string",
                                    tag="string",
                                    tag_source="string",
                                    test_data=boolean)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("IngestDataAsyncV1",
                          data_content="string",
                          data_file="string",
                          repo="string",
                          tag="string",
                          tag_source="string",
                          test_data=boolean)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/foundry_logscale"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  dataContent := "string"
  repo := "string"
  tagSource := "string"
  testData := boolean

  response, err := client.FoundryLogscale.IngestDataAsyncV1(
    &foundry_logscale.IngestDataAsyncV1Params{
      DataContent: &dataContent,
      Repo: &repo,
      Tag: []string{"ID1", "ID2", "ID3"},
      TagSource: &tagSource,
      TestData: &testData,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.foundryLogscale.ingestDataAsyncV1(
  "string",  // dataContent
  "string",  // dataFile
  "string",  // repo
  ["ID1", "ID2", "ID3"],  // tag
  "string",  // tagSource
  boolean  // testData
);

console.log(response);

Rust

use rusty_falcon::apis::foundry_logscale_api::ingest_data_async_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = ingest_data_async_v1(
        &falcon.cfg,  // configuration
        Some("string"),  // data_content
        Some(std::path::PathBuf::default()),  // data_file
        Some("string"),  // repo
        Some(vec!["string".to_string()]),  // tag
        Some("string"),  // tag_source
        Some(boolean),  // test_data
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FoundryLogscale.new

response = api.ingest_data_async_v1(data_content: 'string',
                                    repo: 'string',
                                    tag: ['ID1', 'ID2', 'ID3'],
                                    tag_source: 'string',
                                    test_data: boolean)

puts response

Responses

200 OK

[
  {
    "error_message": "string",
    "failed_events": 0,
    "failed_item_indices": [],
    "partial_success": false,
    "repo": {},
    "rows_written": 0,
    "successful_events": 0,
    "total_events": 0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

IngestDataV1

Synchronously ingest data into the application repository

Method POST

Route /loggingapi/entities/data-ingestion/ingest/v1

Scope App Logs: WRITE

PEP 8 ingest_data

Parameters

data_content body · string

JSON data to ingest

data_file body · file

Data file to ingest

tag body · string or list of strings

Custom tag for ingested data in the form tag:value

tag_source body · string

Tag the data with the specified source

test_data body · boolean

Tag the data with test-ingest

Code Examples

Python

PEP 8

from falconpy import FoundryLogScale

falcon = FoundryLogScale(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.ingest_data(data_content="string",
                              data_file="string",
                              tag="string",
                              tag_source="string",
                              test_data=boolean)
print(response)

Operation ID

from falconpy import FoundryLogScale

falcon = FoundryLogScale(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.IngestDataV1(data_content="string",
                               data_file="string",
                               tag="string",
                               tag_source="string",
                               test_data=boolean)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("IngestDataV1",
                          data_content="string",
                          data_file="string",
                          tag="string",
                          tag_source="string",
                          test_data=boolean)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/foundry_logscale"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  dataContent := "string"
  tagSource := "string"
  testData := boolean

  response, err := client.FoundryLogscale.IngestData(
    &foundry_logscale.IngestDataParams{
      DataContent: &dataContent,
      Tag: []string{"ID1", "ID2", "ID3"},
      TagSource: &tagSource,
      TestData: &testData,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.foundryLogscale.ingestData(
  "string",  // dataContent
  "string",  // dataFile
  ["ID1", "ID2", "ID3"],  // tag
  "string",  // tagSource
  boolean  // testData
);

console.log(response);

Rust

use rusty_falcon::apis::foundry_logscale_api::ingest_data_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = ingest_data_v1(
        &falcon.cfg,  // configuration
        Some("string"),  // data_content
        Some(std::path::PathBuf::default()),  // data_file
        Some(vec!["string".to_string()]),  // tag
        Some("string"),  // tag_source
        Some(boolean),  // test_data
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FoundryLogscale.new

response = api.ingest_data_v1(data_content: 'string',
                              tag: ['ID1', 'ID2', 'ID3'],
                              tag_source: 'string',
                              test_data: boolean)

puts response

Responses

200 OK

[
  {
    "error_message": "string",
    "failed_events": 0,
    "failed_item_indices": [],
    "partial_success": false,
    "repo": {},
    "rows_written": 0,
    "successful_events": 0,
    "total_events": 0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

ListReposV1

Lists available repositories

Method GET

Route /loggingapi/combined/repos/v1

Scope App Logs: READ

PEP 8 list_repos

Parameters

check_test_data query · boolean

Include whether test data is present in the application repository

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import FoundryLogScale

falcon = FoundryLogScale(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.list_repos(check_test_data=boolean)
print(response)

Operation ID

from falconpy import FoundryLogScale

falcon = FoundryLogScale(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.ListReposV1(check_test_data=boolean)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ListReposV1",
                          check_test_data=boolean)
print(response)

PowerShell

Get-FalconFoundryRepository

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/foundry_logscale"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  checkTestData := boolean

  response, err := client.FoundryLogscale.ListRepos(
    &foundry_logscale.ListReposParams{
      CheckTestData: &checkTestData,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.foundryLogscale.listRepos(boolean);  // checkTestData

console.log(response);

Rust

use rusty_falcon::apis::foundry_logscale_api::list_repos_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = list_repos_v1(
        &falcon.cfg,  // configuration
        Some(boolean),  // check_test_data
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FoundryLogscale.new

response = api.list_repos_v1(check_test_data: boolean)

puts response

Responses

200 OK

[
  {
    "connections": [],
    "description": "string",
    "display_name": "string",
    "has_test_data": false,
    "id": "string",
    "name": "string",
    "name_contracted": "string",
    "size": 0,
    "type_name": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

ListViewV1

List available views

Method GET

Route /loggingapi/entities/views/v1

Scope App Logs: READ

PEP 8 list_views

Parameters

check_test_data query · boolean

Include whether test data is present in the application repository

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import FoundryLogScale

falcon = FoundryLogScale(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.list_views(check_test_data=boolean)
print(response)

Operation ID

from falconpy import FoundryLogScale

falcon = FoundryLogScale(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.ListViewV1(check_test_data=boolean)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ListViewV1",
                          check_test_data=boolean)
print(response)

PowerShell

Get-FalconFoundryView

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/foundry_logscale"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  checkTestData := boolean

  response, err := client.FoundryLogscale.ListViews(
    &foundry_logscale.ListViewsParams{
      CheckTestData: &checkTestData,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.foundryLogscale.listViews(boolean);  // checkTestData

console.log(response);

Rust

use rusty_falcon::apis::foundry_logscale_api::list_view_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = list_view_v1(
        &falcon.cfg,  // configuration
        Some(boolean),  // check_test_data
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FoundryLogscale.new

response = api.list_view_v1(check_test_data: boolean)

puts response

Responses

200 OK

[
  {
    "connections": [],
    "description": "string",
    "display_name": "string",
    "has_test_data": false,
    "id": "string",
    "name": "string",
    "name_contracted": "string",
    "size": 0,
    "type_name": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}