Host Group

The Host Group service collection provides operations for creating and managing Host Groups in your CrowdStrike Falcon environment. Search for group members and groups, create, update, delete, and perform actions on Host Groups.

Language	Last Update
Python	v1.4.6
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

Operation	Description
queryCombinedGroupMembers `query_combined_group_members`	Search for members of a Host Group in your environment by providing a FQL filter and paging details. Returns a set of host details which match the filter criteria
queryCombinedHostGroups `query_combined_host_groups`	Search for Host Groups in your environment by providing a FQL filter and paging details. Returns a set of Host Groups which match the filter criteria
performGroupAction `perform_group_action`	Perform the specified action on the Host Groups specified in the request
getHostGroups `get_host_groups`	Retrieve a set of Host Groups by specifying their IDs
createHostGroups `create_host_groups`	Create Host Groups by specifying details about the group to create
deleteHostGroups `delete_host_groups`	Delete a set of Host Groups by specifying their IDs
updateHostGroups `update_host_groups`	Update Host Groups by specifying the ID of the group and details to update
queryGroupMembers `query_group_members`	Search for members of a Host Group in your environment by providing a FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria
queryHostGroups `query_host_groups`	Search for Host Groups in your environment by providing a FQL filter and paging details. Returns a set of Host Group IDs which match the filter criteria

queryCombinedGroupMembers

Search for members of a Host Group in your environment by providing a FQL filter and paging details. Returns a set of host details which match the filter criteria

GET /devices/combined/host-group-members/v1

Scope Host Groups: READ Consumes · Produces application/json

PEP 8 query_combined_group_members

Parameters

Name	Type	Data type	Description
filter	query	string	FQL query expression that should be used to limit the results.
limit	query	integer	Maximum number of records to return. Max: 5000.
offset	query	string	Starting index of overall result set from which to return ids.
id	query	string	The ID of the Host Group to search for members of.
sort	query	string	The property to sort by.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.query_combined_group_members(filter="string",
                                               id="string",
                                               limit=integer,
                                               offset="string",
                                               sort="string")
print(response)

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.queryCombinedGroupMembers(filter="string",
                                            id="string",
                                            limit=integer,
                                            offset="string",
                                            sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryCombinedGroupMembers",
                          id="string",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

Get-FalconHostGroupMember -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/host_group"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  iD := "string"
  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.HostGroup.QueryCombinedGroupMembers(
    &host_group.QueryCombinedGroupMembersParams{
      ID: &iD,
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hostGroup.queryCombinedGroupMembers(
  "string",  // id
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::host_group_api::query_combined_group_members;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_combined_group_members(
        &falcon.cfg,  // configuration
        Some("string"),  // id
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::HostGroup.new

response = api.query_combined_group_members(id: 'string',
                                            filter: 'string',
                                            offset: integer,
                                            limit: integer,
                                            sort: 'string')

puts response

queryCombinedHostGroups

Search for Host Groups in your environment by providing a FQL filter and paging details. Returns a set of Host Groups which match the filter criteria

GET /devices/combined/host-groups/v1

Scope Host Groups: READ Consumes · Produces application/json

PEP 8 query_combined_host_groups

Parameters

Name	Type	Data type	Description
filter	query	string	FQL query expression that should be used to limit the results.
limit	query	integer	Maximum number of records to return. Max: 5000.
offset	query	string	Starting index of overall result set from which to return ids.
sort	query	string	The property to sort by.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.query_combined_host_groups(filter="string",
                                             limit=integer,
                                             offset=integer,
                                             sort="string")
print(response)

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.queryCombinedHostGroups(filter="string",
                                          limit=integer,
                                          offset=integer,
                                          sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryCombinedHostGroups",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

Get-FalconHostGroup -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/host_group"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.HostGroup.QueryCombinedHostGroups(
    &host_group.QueryCombinedHostGroupsParams{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hostGroup.queryCombinedHostGroups(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::host_group_api::query_combined_host_groups;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_combined_host_groups(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::HostGroup.new

response = api.query_combined_host_groups(filter: 'string',
                                          offset: integer,
                                          limit: integer,
                                          sort: 'string')

puts response

performGroupAction

Perform the specified action on the Host Groups specified in the request

POST /devices/entities/host-group-actions/v1

Scope Host Groups: WRITE Consumes · Produces application/json

PEP 8 perform_group_action

Parameters

Name	Type	Data type	Description
action_name	query	string	The action to be performed. Allowed values: `add-hosts`, `disable-hostname-check`, `remove-hosts`
action_parameters	body	list of dictionaries	Action specific parameters. Multiple action parameters may be specified. Use with the `add-hosts` and `remove-hosts` actions. Use the `value` parameter to specify host IDs to add or remove. Example: [{“name”: “filter”, “value”: “(device_id:[‘ID1’, ‘ID2’,‘ID3’])”}]
body	body	dictionary	Full body payload in JSON format.
filter	body (action_parameters)	string	Filter to use to specify hosts to apply this action to. FQL formatted string. Overridden if `action_parameters` is specified.
ids	body	string or list of strings	The ID(s) of the Host Group to perform the action against.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.perform_group_action(action_name="string",
                                       disable_hostname_check=boolean,
                                       filter="string",
                                       ids=id_list)
print(response)

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.performGroupAction(action_name="string",
                                     disable_hostname_check=boolean,
                                     filter="string",
                                     ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "action_parameters": [
        {
            "name": "string",
            "value": "string"
        }
    ],
    "ids": ["string"]
}

response = falcon.command("performGroupAction",
                          action_name="string",
                          disable_hostname_check=boolean,
                          body=body_payload)
print(response)

Invoke-FalconHostGroupAction -Name "string" `
  -Id "string" `
  -HostId @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/host_group"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"
  value := "string"
  disableHostnameCheck := boolean

  response, err := client.HostGroup.PerformGroupAction(
    &host_group.PerformGroupActionParams{
      Body: &models.MsaEntityActionRequestV2{
        ActionParameters: []interface{}{
          {
          Name: &name,
          Value: &value,
          },
        },
        Ids: []string{"string"},
      },
      ActionName: "string",
      DisableHostnameCheck: &disableHostnameCheck,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hostGroup.performGroupAction(
  "string",  // actionName
  {  // body
      actionParameters: [{
          name: "string",
          value: "string"
        }],
      ids: []
  },
  boolean  // disableHostnameCheck
);

console.log(response);

use rusty_falcon::apis::host_group_api::perform_group_action;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaEntityActionRequestV2;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaEntityActionRequestV2 {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = perform_group_action(
        &falcon.cfg,  // configuration
        "string",  // action_name
        body,  // body
        Some(boolean),  // disable_hostname_check
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::HostGroup.new

body = Falcon::MsaEntityActionRequestV2.new(
  action_parameters: [{
      name: 'string',
      value: 'string'
    }],
  ids: []
)

response = api.perform_group_action(body, 'string')

puts response

getHostGroups

Retrieve a set of Host Groups by specifying their IDs

GET /devices/entities/host-groups/v1

Scope Host Groups: READ Consumes · Produces application/json

PEP 8 get_host_groups

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The ID(s) of the Host Groups to retrieve.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_host_groups(ids=id_list)
print(response)

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getHostGroups(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getHostGroups",
                          ids=id_list)
print(response)

Get-FalconHostGroup -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/host_group"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.HostGroup.GetHostGroups(
    &host_group.GetHostGroupsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hostGroup.getHostGroups(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::host_group_api::get_host_groups;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_host_groups(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::HostGroup.new

response = api.get_host_groups(['ID1', 'ID2', 'ID3'])

puts response

createHostGroups

Create Host Groups by specifying details about the group to create

POST /devices/entities/host-groups/v1

Scope Host Groups: WRITE Consumes · Produces application/json

PEP 8 create_host_groups

Parameters

Name	Type	Data type	Description
assignment_rule	body	string	Assignment rule to apply.
body	body	dictionary	Full body payload in JSON format.
description	body	string	Description for the host group.
group_type	body	string	Type of Host Group to create. Allowed Values: `dynamic`, `static`, `staticByID`. Case-sensitive.
name	body	string	The name of the Host Group.

Code Examples

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.create_host_groups(assignment_rule="string",
                                     description="string",
                                     group_type="string",
                                     name="string")
print(response)

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.createHostGroups(assignment_rule="string",
                                   description="string",
                                   group_type="string",
                                   name="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "assignment_rule": "string",
            "description": "string",
            "group_type": "string",
            "name": "string"
        }
    ]
}

response = falcon.command("createHostGroups", body=body_payload)
print(response)

New-FalconHostGroup -GroupType "string" -Name "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/host_group"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  assignment_rule := "string"
  description := "string"
  group_type := "string"
  name := "string"

  response, err := client.HostGroup.CreateHostGroups(
    &host_group.CreateHostGroupsParams{
      Body: &models.HostGroupsCreateGroupsReqV1{
        Resources: []interface{}{
          {
          AssignmentRule: &assignment_rule,
          Description: &description,
          GroupType: &group_type,
          Name: &name,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hostGroup.createHostGroups(
  {
    resources: [{
        assignmentRule: "string",
        description: "string",
        groupType: "string",
        name: "string"
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::host_group_api::create_host_groups;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::HostGroupsCreateGroupsReqV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = HostGroupsCreateGroupsReqV1 {
        resources: vec![CreateGroupReqV1 {
            group_type: Some("string".to_string()),
            name: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = create_host_groups(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::HostGroup.new

body = Falcon::HostGroupsCreateGroupsReqV1.new(
  resources: [{
      assignment_rule: 'string',
      description: 'string',
      group_type: 'string',
      name: 'string'
    }]
)

response = api.create_host_groups(body)

puts response

deleteHostGroups

Delete a set of Host Groups by specifying their IDs

DELETE /devices/entities/host-groups/v1

Scope Host Groups: WRITE Consumes · Produces application/json

PEP 8 delete_host_groups

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The ID(s) of the Host Groups to delete.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_host_groups(ids=id_list)
print(response)

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteHostGroups(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deleteHostGroups",
                          ids=id_list)
print(response)

Remove-FalconHostGroup -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/host_group"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.HostGroup.DeleteHostGroups(
    &host_group.DeleteHostGroupsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hostGroup.deleteHostGroups(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::host_group_api::delete_host_groups;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_host_groups(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::HostGroup.new

response = api.delete_host_groups(['ID1', 'ID2', 'ID3'])

puts response

updateHostGroups

Update Host Groups by specifying the ID of the group and details to update

PATCH /devices/entities/host-groups/v1

Scope Host Groups: WRITE Consumes · Produces application/json

PEP 8 update_host_groups

Parameters

Name	Type	Data type	Description
assignment_rule	body	string	Assignment rule to apply.
body	body	dictionary	Full body payload in JSON format.
description	body	string	Description for the host group.
id	body	string	The ID of the Host Group to update.
name	body	string	The name of the Host Group.

Code Examples

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.update_host_groups(assignment_rule="string",
                                     description="string",
                                     id="string",
                                     name="string")
print(response)

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.updateHostGroups(assignment_rule="string",
                                   description="string",
                                   id="string",
                                   name="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "assignment_rule": "string",
            "description": "string",
            "id": "string",
            "name": "string"
        }
    ]
}

response = falcon.command("updateHostGroups", body=body_payload)
print(response)

Edit-FalconHostGroup -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/host_group"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  assignment_rule := "string"
  description := "string"
  id := "string"
  name := "string"

  response, err := client.HostGroup.UpdateHostGroups(
    &host_group.UpdateHostGroupsParams{
      Body: &models.HostGroupsUpdateGroupsReqV1{
        Resources: []interface{}{
          {
          AssignmentRule: &assignment_rule,
          Description: &description,
          ID: &id,
          Name: &name,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hostGroup.updateHostGroups(
  {
    resources: [{
        assignmentRule: "string",
        description: "string",
        id: "string",
        name: "string"
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::host_group_api::update_host_groups;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::HostGroupsUpdateGroupsReqV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = HostGroupsUpdateGroupsReqV1 {
        resources: vec![UpdateGroupReqV1 {
            id: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = update_host_groups(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::HostGroup.new

body = Falcon::HostGroupsUpdateGroupsReqV1.new(
  resources: [{
      assignment_rule: 'string',
      description: 'string',
      id: 'string',
      name: 'string'
    }]
)

response = api.update_host_groups(body)

puts response

queryGroupMembers

Search for members of a Host Group in your environment by providing a FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria

GET /devices/queries/host-group-members/v1

Scope Host Groups: READ Consumes · Produces application/json

PEP 8 query_group_members

Parameters

Name	Type	Data type	Description
filter	query	string	FQL query expression that should be used to limit the results.
limit	query	integer	Maximum number of records to return. Max: 5000.
offset	query	string	Starting index of overall result set from which to return ids.
id	query	string	The ID of the Host Group to search for members of.
sort	query	string	The property to sort by.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.query_group_members(filter="string",
                                      id="string",
                                      limit=integer,
                                      offset="string",
                                      sort="string")
print(response)

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.queryGroupMembers(filter="string",
                                    id="string",
                                    limit=integer,
                                    offset="string",
                                    sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryGroupMembers",
                          id="string",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

Get-FalconHostGroupMember -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/host_group"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  iD := "string"
  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.HostGroup.QueryGroupMembers(
    &host_group.QueryGroupMembersParams{
      ID: &iD,
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hostGroup.queryGroupMembers(
  "string",  // id
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::host_group_api::query_group_members;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_group_members(
        &falcon.cfg,  // configuration
        Some("string"),  // id
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::HostGroup.new

response = api.query_group_members(id: 'string',
                                   filter: 'string',
                                   offset: integer,
                                   limit: integer,
                                   sort: 'string')

puts response

queryHostGroups

Search for Host Groups in your environment by providing a FQL filter and paging details. Returns a set of Host Group IDs which match the filter criteria

GET /devices/queries/host-groups/v1

Scope Host Groups: READ Consumes · Produces application/json

PEP 8 query_host_groups

Parameters

Name	Type	Data type	Description
filter	query	string	FQL query expression that should be used to limit the results.
limit	query	integer	Maximum number of records to return. Max: 5000.
offset	query	string	Starting index of overall result set from which to return ids.
sort	query	string	The property to sort by.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.query_host_groups(filter="string",
                                    limit=integer,
                                    offset="string",
                                    sort="string")
print(response)

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.queryHostGroups(filter="string",
                                  limit=integer,
                                  offset="string",
                                  sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryHostGroups",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

Get-FalconHostGroup -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/host_group"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.HostGroup.QueryHostGroups(
    &host_group.QueryHostGroupsParams{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hostGroup.queryHostGroups(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::host_group_api::query_host_groups;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_host_groups(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::HostGroup.new

response = api.query_host_groups(filter: 'string',
                                 offset: integer,
                                 limit: integer,
                                 sort: 'string')

puts response

Host Group

Table of Contents

queryCombinedGroupMembers

Parameters

Code Examples

queryCombinedHostGroups

Parameters

Code Examples

performGroupAction

Parameters

Code Examples

getHostGroups

Parameters

Code Examples

createHostGroups

Parameters

Code Examples

deleteHostGroups

Parameters

Code Examples

updateHostGroups

Parameters

Code Examples

queryGroupMembers

Parameters

Code Examples

queryHostGroups

Parameters

Code Examples