Host Group

The Host Group service collection provides operations for creating and managing Host Groups in your CrowdStrike Falcon environment. Search for group members and groups, create, update, delete, and perform actions on Host Groups.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

Operation	Description
createHostGroups `create_host_groups`	Create Host Groups by specifying details about the group to create
deleteHostGroups `delete_host_groups`	Delete a set of Host Groups by specifying their IDs
getHostGroups `get_host_groups`	Retrieve a set of Host Groups by specifying their IDs
performGroupAction `perform_group_action`	Perform the specified action on the Host Groups specified in the request
queryCombinedGroupMembers `query_combined_group_members`	Search for members of a Host Group in your environment by providing an FQL filter and paging details.
queryCombinedHostGroups `query_combined_host_groups`	Search for Host Groups in your environment by providing an FQL filter and paging details.
queryGroupMembers `query_group_members`	Search for members of a Host Group in your environment by providing an FQL filter and paging details.
queryHostGroups `query_host_groups`	Search for Host Groups in your environment by providing an FQL filter and paging details.
updateHostGroups `update_host_groups`	Update Host Groups by specifying the ID of the group and details to update

createHostGroups

Create Host Groups by specifying details about the group to create

Method POST

Route /devices/entities/host-groups/v1

Scope Host groups: WRITE

PEP 8 create_host_groups

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

A collection of device groups to create

assignment_rule body · string

Assignment rule to apply.

description body · string

Description of the host group.

group_type body · string

Type of Host Group to create.

name body · string

The Host Group name.

Code Examples

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.create_host_groups(assignment_rule="string",
                                     description="string",
                                     group_type="string",
                                     name="string")
print(response)

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.createHostGroups(assignment_rule="string",
                                   description="string",
                                   group_type="string",
                                   name="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "assignment_rule": "string",
            "description": "string",
            "group_type": "string",
            "name": "string"
        }
    ]
}

response = falcon.command("createHostGroups", body=body_payload)
print(response)

New-FalconHostGroup -GroupType "string" -Name "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/host_group"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  assignment_rule := "string"
  description := "string"
  group_type := "string"
  name := "string"

  response, err := client.HostGroup.CreateHostGroups(
    &host_group.CreateHostGroupsParams{
      Body: &models.HostGroupsCreateGroupsReqV1{
        Resources: []interface{}{
          {
          AssignmentRule: &assignment_rule,
          Description: &description,
          GroupType: &group_type,
          Name: &name,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hostGroup.createHostGroups(
  {
    resources: [{
        assignmentRule: "string",
        description: "string",
        groupType: "string",
        name: "string"
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::host_group_api::create_host_groups;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::HostGroupsCreateGroupsReqV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = HostGroupsCreateGroupsReqV1 {
        resources: vec![CreateGroupReqV1 {
            group_type: Some("string".to_string()),
            name: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = create_host_groups(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::HostGroup.new

body = Falcon::HostGroupsCreateGroupsReqV1.new(
  resources: [{
      assignment_rule: 'string',
      description: 'string',
      group_type: 'string',
      name: 'string'
    }]
)

response = api.create_host_groups(body)

puts response

Responses

[
  {
    "assignment_rule": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "group_type": "string",
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "assignment_rule": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "group_type": "string",
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "assignment_rule": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "group_type": "string",
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string"
    }
  ]
}

deleteHostGroups

Delete a set of Host Groups by specifying their IDs

Method DELETE

Route /devices/entities/host-groups/v1

Scope Host groups: WRITE

PEP 8 delete_host_groups

Parameters

ids query · string or list of strings

The IDs of the Host Groups to delete

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_host_groups(ids=id_list)
print(response)

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteHostGroups(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deleteHostGroups",
                          ids=id_list)
print(response)

Remove-FalconHostGroup -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/host_group"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.HostGroup.DeleteHostGroups(
    &host_group.DeleteHostGroupsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hostGroup.deleteHostGroups(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::host_group_api::delete_host_groups;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_host_groups(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::HostGroup.new

response = api.delete_host_groups(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

getHostGroups

Retrieve a set of Host Groups by specifying their IDs

Method GET

Route /devices/entities/host-groups/v1

Scope Host groups: READ

PEP 8 get_host_groups

Parameters

ids query · string or list of strings

The IDs of the Host Groups to return

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_host_groups(ids=id_list)
print(response)

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getHostGroups(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getHostGroups",
                          ids=id_list)
print(response)

Get-FalconHostGroup -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/host_group"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.HostGroup.GetHostGroups(
    &host_group.GetHostGroupsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hostGroup.getHostGroups(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::host_group_api::get_host_groups;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_host_groups(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::HostGroup.new

response = api.get_host_groups(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "assignment_rule": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "group_type": "string",
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "assignment_rule": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "group_type": "string",
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "assignment_rule": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "group_type": "string",
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "assignment_rule": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "group_type": "string",
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string"
    }
  ]
}

performGroupAction

Perform the specified action on the Host Groups specified in the request

Method POST

Route /devices/entities/host-group-actions/v1

Scope Host groups: WRITE

PEP 8 perform_group_action

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

action_parameters body · array

List of dictionaries containing action specific parameter settings.

ids body · array

List of host group IDs to perform an action against.

action_name query · string

The action to perform

Available values (2)

add-hosts remove-hosts

disable_hostname_check query · boolean

Bool to disable hostname check on add-member

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

filter body · string

Filter to use to specify hosts to apply this action to. FQL formatted string. Overridden if action_parameters is specified.

Code Examples

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

action_parameters = [
    {
        "name": "filter",
        "value": "string"
    }
]

response = falcon.perform_group_action(action_name="string",
                                       action_parameters=action_parameters,
                                       disable_hostname_check=boolean,
                                       filter="string",
                                       ids=id_list)
print(response)

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

action_parameters = [
    {
        "name": "filter",
        "value": "string"
    }
]

response = falcon.performGroupAction(action_name="string",
                                     action_parameters=action_parameters,
                                     disable_hostname_check=boolean,
                                     filter="string",
                                     ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "action_parameters": [
        {
            "name": "string",
            "value": "string"
        }
    ],
    "ids": ["string"]
}

response = falcon.command("performGroupAction",
                          action_name="string",
                          disable_hostname_check=boolean,
                          body=body_payload)
print(response)

Invoke-FalconHostGroupAction -Name "string" `
  -Id "string" `
  -HostId @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/host_group"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"
  value := "string"
  disableHostnameCheck := boolean

  response, err := client.HostGroup.PerformGroupAction(
    &host_group.PerformGroupActionParams{
      Body: &models.MsaEntityActionRequestV2{
        ActionParameters: []interface{}{
          {
          Name: &name,
          Value: &value,
          },
        },
        Ids: []string{"string"},
      },
      ActionName: "string",
      DisableHostnameCheck: &disableHostnameCheck,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hostGroup.performGroupAction(
  "string",  // actionName
  {  // body
      actionParameters: [{
          name: "string",
          value: "string"
        }],
      ids: []
  },
  boolean  // disableHostnameCheck
);

console.log(response);

use rusty_falcon::apis::host_group_api::perform_group_action;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaEntityActionRequestV2;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaEntityActionRequestV2 {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = perform_group_action(
        &falcon.cfg,  // configuration
        "string",  // action_name
        body,  // body
        Some(boolean),  // disable_hostname_check
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::HostGroup.new

body = Falcon::MsaEntityActionRequestV2.new(
  action_parameters: [{
      name: 'string',
      value: 'string'
    }],
  ids: []
)

response = api.perform_group_action(body, 'string')

puts response

Responses

[
  {
    "assignment_rule": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "group_type": "string",
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "assignment_rule": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "group_type": "string",
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "assignment_rule": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "group_type": "string",
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "assignment_rule": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "group_type": "string",
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string"
    }
  ]
}

queryCombinedGroupMembers

Search for members of a Host Group in your environment by providing an FQL filter and paging details.

Method GET

Route /devices/combined/host-group-members/v1

Scope Host groups: READ

PEP 8 query_combined_group_members

Parameters

id query · string

The ID of the Host Group to search for members of

filter query · string

FQL query expression that should be used to limit the results.

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return. [1-5000]

sort query · string

The property to sort by.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.query_combined_group_members(filter="string",
                                               id="string",
                                               limit=integer,
                                               offset=integer,
                                               sort="string")
print(response)

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.queryCombinedGroupMembers(filter="string",
                                            id="string",
                                            limit=integer,
                                            offset=integer,
                                            sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryCombinedGroupMembers",
                          id="string",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

Get-FalconHostGroupMember -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/host_group"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  iD := "string"
  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.HostGroup.QueryCombinedGroupMembers(
    &host_group.QueryCombinedGroupMembersParams{
      ID: &iD,
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hostGroup.queryCombinedGroupMembers(
  "string",  // id
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::host_group_api::query_combined_group_members;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_combined_group_members(
        &falcon.cfg,  // configuration
        Some("string"),  // id
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::HostGroup.new

response = api.query_combined_group_members(id: 'string',
                                            filter: 'string',
                                            offset: integer,
                                            limit: integer,
                                            sort: 'string')

puts response

Responses

[
  {
    "agent_load_flags": "string",
    "agent_local_time": "string",
    "agent_version": "string",
    "base_image_version": "string",
    "bios_manufacturer": "string",
    "bios_version": "string",
    "build_number": "string",
    "chassis_type": "string",
    "chassis_type_desc": "string",
    "cid": "string",
    "cloud_service_compartment_id": "string",
    "config_id_base": "string",
    "config_id_build": "string",
    "config_id_platform": "string",
    "connection_ip": "string",
    "connection_mac_address": "string",
    "cpu_signature": "string",
    "cpu_vendor": "string",
    "criticality": "string",
    "default_gateway_ip": "string",
    "deployment_type": "string",
    "detection_suppression_status": "string",
    "device_id": "string",
    "device_policies": {},
    "email": "string",
    "external_ip": "string",
    "filesystem_containment_status": "string",
    "first_login_timestamp": "string",
    "first_login_user": "string",
    "first_seen": "string",
    "group_hash": "string",
    "groups": [],
    "host_deleted_status": "string",
    "host_hidden_status": "string",
    "host_utc_offset": "string",
    "hostname": "string",
    "instance_id": "string",
    "internet_exposure": "string",
    "k8s_cluster_git_version": "string",
    "k8s_cluster_id": "string",
    "k8s_cluster_version": "string",
    "kernel_version": "string",
    "last_login_timestamp": "string",
    "last_login_uid": "string",
    "last_login_user": "string",
    "last_login_user_sid": "string",
    "last_reboot": "string",
    "last_seen": "string",
    "license_activation_state": "string",
    "linux_sensor_mode": "string",
    "local_ip": "string",
    "mac_address": "string",
    "machine_domain": "string",
    "major_version": "string",
    "managed_apps": {},
    "meta": {},
    "migration_completed_time": "string",
    "minor_version": "string",
    "modified_timestamp": "string",
    "notes": [],
    "os_build": "string",
    "os_product_name": "string",
    "os_version": "string",
    "ou": [],
    "platform_id": "string",
    "platform_name": "string",
    "pod_annotations": [],
    "pod_host_ip4": "string",
    "pod_host_ip6": "string",
    "pod_hostname": "string",
    "pod_id": "string",
    "pod_ip4": "string",
    "pod_ip6": "string",
    "pod_labels": [],
    "pod_name": "string",
    "pod_namespace": "string",
    "pod_service_account_name": "string",
    "pointer_size": "string",
    "policies": [],
    "product_type": "string",
    "product_type_desc": "string",
    "provision_status": "string",
    "reduced_functionality_mode": "string",
    "release_group": "string",
    "rtr_state": "string",
    "safe_mode": "string",
    "serial_number": "string",
    "service_pack_major": "string",
    "service_pack_minor": "string",
    "service_provider": "string",
    "service_provider_account_id": "string",
    "site_name": "string",
    "slow_changing_modified_timestamp": "string",
    "status": "string",
    "system_manufacturer": "string",
    "system_product_name": "string",
    "tags": [],
    "zone_group": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "agent_load_flags": "string",
      "agent_local_time": "string",
      "agent_version": "string",
      "base_image_version": "string",
      "bios_manufacturer": "string",
      "bios_version": "string",
      "build_number": "string",
      "chassis_type": "string",
      "chassis_type_desc": "string",
      "cid": "string",
      "cloud_service_compartment_id": "string",
      "config_id_base": "string",
      "config_id_build": "string",
      "config_id_platform": "string",
      "connection_ip": "string",
      "connection_mac_address": "string",
      "cpu_signature": "string",
      "cpu_vendor": "string",
      "criticality": "string",
      "default_gateway_ip": "string",
      "deployment_type": "string",
      "detection_suppression_status": "string",
      "device_id": "string",
      "device_policies": {},
      "email": "string",
      "external_ip": "string",
      "filesystem_containment_status": "string",
      "first_login_timestamp": "string",
      "first_login_user": "string",
      "first_seen": "string",
      "group_hash": "string",
      "groups": [],
      "host_deleted_status": "string",
      "host_hidden_status": "string",
      "host_utc_offset": "string",
      "hostname": "string",
      "instance_id": "string",
      "internet_exposure": "string",
      "k8s_cluster_git_version": "string",
      "k8s_cluster_id": "string",
      "k8s_cluster_version": "string",
      "kernel_version": "string",
      "last_login_timestamp": "string",
      "last_login_uid": "string",
      "last_login_user": "string",
      "last_login_user_sid": "string",
      "last_reboot": "string",
      "last_seen": "string",
      "license_activation_state": "string",
      "linux_sensor_mode": "string",
      "local_ip": "string",
      "mac_address": "string",
      "machine_domain": "string",
      "major_version": "string",
      "managed_apps": {},
      "meta": {},
      "migration_completed_time": "string",
      "minor_version": "string",
      "modified_timestamp": "string",
      "notes": [],
      "os_build": "string",
      "os_product_name": "string",
      "os_version": "string",
      "ou": [],
      "platform_id": "string",
      "platform_name": "string",
      "pod_annotations": [],
      "pod_host_ip4": "string",
      "pod_host_ip6": "string",
      "pod_hostname": "string",
      "pod_id": "string",
      "pod_ip4": "string",
      "pod_ip6": "string",
      "pod_labels": [],
      "pod_name": "string",
      "pod_namespace": "string",
      "pod_service_account_name": "string",
      "pointer_size": "string",
      "policies": [],
      "product_type": "string",
      "product_type_desc": "string",
      "provision_status": "string",
      "reduced_functionality_mode": "string",
      "release_group": "string",
      "rtr_state": "string",
      "safe_mode": "string",
      "serial_number": "string",
      "service_pack_major": "string",
      "service_pack_minor": "string",
      "service_provider": "string",
      "service_provider_account_id": "string",
      "site_name": "string",
      "slow_changing_modified_timestamp": "string",
      "status": "string",
      "system_manufacturer": "string",
      "system_product_name": "string",
      "tags": [],
      "zone_group": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "agent_load_flags": "string",
      "agent_local_time": "string",
      "agent_version": "string",
      "base_image_version": "string",
      "bios_manufacturer": "string",
      "bios_version": "string",
      "build_number": "string",
      "chassis_type": "string",
      "chassis_type_desc": "string",
      "cid": "string",
      "cloud_service_compartment_id": "string",
      "config_id_base": "string",
      "config_id_build": "string",
      "config_id_platform": "string",
      "connection_ip": "string",
      "connection_mac_address": "string",
      "cpu_signature": "string",
      "cpu_vendor": "string",
      "criticality": "string",
      "default_gateway_ip": "string",
      "deployment_type": "string",
      "detection_suppression_status": "string",
      "device_id": "string",
      "device_policies": {},
      "email": "string",
      "external_ip": "string",
      "filesystem_containment_status": "string",
      "first_login_timestamp": "string",
      "first_login_user": "string",
      "first_seen": "string",
      "group_hash": "string",
      "groups": [],
      "host_deleted_status": "string",
      "host_hidden_status": "string",
      "host_utc_offset": "string",
      "hostname": "string",
      "instance_id": "string",
      "internet_exposure": "string",
      "k8s_cluster_git_version": "string",
      "k8s_cluster_id": "string",
      "k8s_cluster_version": "string",
      "kernel_version": "string",
      "last_login_timestamp": "string",
      "last_login_uid": "string",
      "last_login_user": "string",
      "last_login_user_sid": "string",
      "last_reboot": "string",
      "last_seen": "string",
      "license_activation_state": "string",
      "linux_sensor_mode": "string",
      "local_ip": "string",
      "mac_address": "string",
      "machine_domain": "string",
      "major_version": "string",
      "managed_apps": {},
      "meta": {},
      "migration_completed_time": "string",
      "minor_version": "string",
      "modified_timestamp": "string",
      "notes": [],
      "os_build": "string",
      "os_product_name": "string",
      "os_version": "string",
      "ou": [],
      "platform_id": "string",
      "platform_name": "string",
      "pod_annotations": [],
      "pod_host_ip4": "string",
      "pod_host_ip6": "string",
      "pod_hostname": "string",
      "pod_id": "string",
      "pod_ip4": "string",
      "pod_ip6": "string",
      "pod_labels": [],
      "pod_name": "string",
      "pod_namespace": "string",
      "pod_service_account_name": "string",
      "pointer_size": "string",
      "policies": [],
      "product_type": "string",
      "product_type_desc": "string",
      "provision_status": "string",
      "reduced_functionality_mode": "string",
      "release_group": "string",
      "rtr_state": "string",
      "safe_mode": "string",
      "serial_number": "string",
      "service_pack_major": "string",
      "service_pack_minor": "string",
      "service_provider": "string",
      "service_provider_account_id": "string",
      "site_name": "string",
      "slow_changing_modified_timestamp": "string",
      "status": "string",
      "system_manufacturer": "string",
      "system_product_name": "string",
      "tags": [],
      "zone_group": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "agent_load_flags": "string",
      "agent_local_time": "string",
      "agent_version": "string",
      "base_image_version": "string",
      "bios_manufacturer": "string",
      "bios_version": "string",
      "build_number": "string",
      "chassis_type": "string",
      "chassis_type_desc": "string",
      "cid": "string",
      "cloud_service_compartment_id": "string",
      "config_id_base": "string",
      "config_id_build": "string",
      "config_id_platform": "string",
      "connection_ip": "string",
      "connection_mac_address": "string",
      "cpu_signature": "string",
      "cpu_vendor": "string",
      "criticality": "string",
      "default_gateway_ip": "string",
      "deployment_type": "string",
      "detection_suppression_status": "string",
      "device_id": "string",
      "device_policies": {},
      "email": "string",
      "external_ip": "string",
      "filesystem_containment_status": "string",
      "first_login_timestamp": "string",
      "first_login_user": "string",
      "first_seen": "string",
      "group_hash": "string",
      "groups": [],
      "host_deleted_status": "string",
      "host_hidden_status": "string",
      "host_utc_offset": "string",
      "hostname": "string",
      "instance_id": "string",
      "internet_exposure": "string",
      "k8s_cluster_git_version": "string",
      "k8s_cluster_id": "string",
      "k8s_cluster_version": "string",
      "kernel_version": "string",
      "last_login_timestamp": "string",
      "last_login_uid": "string",
      "last_login_user": "string",
      "last_login_user_sid": "string",
      "last_reboot": "string",
      "last_seen": "string",
      "license_activation_state": "string",
      "linux_sensor_mode": "string",
      "local_ip": "string",
      "mac_address": "string",
      "machine_domain": "string",
      "major_version": "string",
      "managed_apps": {},
      "meta": {},
      "migration_completed_time": "string",
      "minor_version": "string",
      "modified_timestamp": "string",
      "notes": [],
      "os_build": "string",
      "os_product_name": "string",
      "os_version": "string",
      "ou": [],
      "platform_id": "string",
      "platform_name": "string",
      "pod_annotations": [],
      "pod_host_ip4": "string",
      "pod_host_ip6": "string",
      "pod_hostname": "string",
      "pod_id": "string",
      "pod_ip4": "string",
      "pod_ip6": "string",
      "pod_labels": [],
      "pod_name": "string",
      "pod_namespace": "string",
      "pod_service_account_name": "string",
      "pointer_size": "string",
      "policies": [],
      "product_type": "string",
      "product_type_desc": "string",
      "provision_status": "string",
      "reduced_functionality_mode": "string",
      "release_group": "string",
      "rtr_state": "string",
      "safe_mode": "string",
      "serial_number": "string",
      "service_pack_major": "string",
      "service_pack_minor": "string",
      "service_provider": "string",
      "service_provider_account_id": "string",
      "site_name": "string",
      "slow_changing_modified_timestamp": "string",
      "status": "string",
      "system_manufacturer": "string",
      "system_product_name": "string",
      "tags": [],
      "zone_group": "string"
    }
  ]
}

queryCombinedHostGroups

Search for Host Groups in your environment by providing an FQL filter and paging details.

Method GET

Route /devices/combined/host-groups/v1

Scope Host groups: READ

PEP 8 query_combined_host_groups

Parameters

filter query · string

FQL query expression that should be used to limit the results.

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return. [1-5000]

sort query · string

The property to sort by.

Available values (12)

`created_by.asc`	`created_by.desc`	`created_timestamp.asc`
`created_timestamp.desc`	`group_type.asc`	`group_type.desc`
`modified_by.asc`	`modified_by.desc`	`modified_timestamp.asc`
`modified_timestamp.desc`	`name.asc`	`name.desc`

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.query_combined_host_groups(filter="string",
                                             limit=integer,
                                             offset=integer,
                                             sort="string")
print(response)

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.queryCombinedHostGroups(filter="string",
                                          limit=integer,
                                          offset=integer,
                                          sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryCombinedHostGroups",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

Get-FalconHostGroup -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/host_group"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.HostGroup.QueryCombinedHostGroups(
    &host_group.QueryCombinedHostGroupsParams{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hostGroup.queryCombinedHostGroups(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::host_group_api::query_combined_host_groups;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_combined_host_groups(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::HostGroup.new

response = api.query_combined_host_groups(filter: 'string',
                                          offset: integer,
                                          limit: integer,
                                          sort: 'string')

puts response

Responses

[
  {
    "assignment_rule": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "group_type": "string",
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "assignment_rule": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "group_type": "string",
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "assignment_rule": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "group_type": "string",
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string"
    }
  ]
}

queryGroupMembers

Search for members of a Host Group in your environment by providing an FQL filter and paging details.

Method GET

Route /devices/queries/host-group-members/v1

Scope Host groups: READ

PEP 8 query_group_members

Parameters

id query · string

The ID of the Host Group to search for members of

filter query · string

FQL query expression that should be used to limit the results.

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return. [1-5000]

sort query · string

The property to sort by.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.query_group_members(filter="string",
                                      id="string",
                                      limit=integer,
                                      offset=integer,
                                      sort="string")
print(response)

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.queryGroupMembers(filter="string",
                                    id="string",
                                    limit=integer,
                                    offset=integer,
                                    sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryGroupMembers",
                          id="string",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

Get-FalconHostGroupMember -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/host_group"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  iD := "string"
  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.HostGroup.QueryGroupMembers(
    &host_group.QueryGroupMembersParams{
      ID: &iD,
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hostGroup.queryGroupMembers(
  "string",  // id
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::host_group_api::query_group_members;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_group_members(
        &falcon.cfg,  // configuration
        Some("string"),  // id
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::HostGroup.new

response = api.query_group_members(id: 'string',
                                   filter: 'string',
                                   offset: integer,
                                   limit: integer,
                                   sort: 'string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

queryHostGroups

Search for Host Groups in your environment by providing an FQL filter and paging details.

Method GET

Route /devices/queries/host-groups/v1

Scope Host groups: READ

PEP 8 query_host_groups

Parameters

filter query · string

FQL query expression that should be used to limit the results.

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return. [1-5000]

sort query · string

The property to sort by.

Available values (12)

`created_by.asc`	`created_by.desc`	`created_timestamp.asc`
`created_timestamp.desc`	`group_type.asc`	`group_type.desc`
`modified_by.asc`	`modified_by.desc`	`modified_timestamp.asc`
`modified_timestamp.desc`	`name.asc`	`name.desc`

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.query_host_groups(filter="string",
                                    limit=integer,
                                    offset=integer,
                                    sort="string")
print(response)

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.queryHostGroups(filter="string",
                                  limit=integer,
                                  offset=integer,
                                  sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryHostGroups",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

Get-FalconHostGroup -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/host_group"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.HostGroup.QueryHostGroups(
    &host_group.QueryHostGroupsParams{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hostGroup.queryHostGroups(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::host_group_api::query_host_groups;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_host_groups(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::HostGroup.new

response = api.query_host_groups(filter: 'string',
                                 offset: integer,
                                 limit: integer,
                                 sort: 'string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

updateHostGroups

Update Host Groups by specifying the ID of the group and details to update

Method PATCH

Route /devices/entities/host-groups/v1

Scope Host groups: WRITE

PEP 8 update_host_groups

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

A collection of groups to update

assignment_rule body · string

Assignment rule to apply.

description body · string

Description of the host group.

id body · string

Host Group ID to be updated.

name body · string

The Host Group name.

Code Examples

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.update_host_groups(assignment_rule="string",
                                     description="string",
                                     id="string",
                                     name="string")
print(response)

from falconpy import HostGroup

falcon = HostGroup(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.updateHostGroups(assignment_rule="string",
                                   description="string",
                                   id="string",
                                   name="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "assignment_rule": "string",
            "description": "string",
            "id": "string",
            "name": "string"
        }
    ]
}

response = falcon.command("updateHostGroups", body=body_payload)
print(response)

Edit-FalconHostGroup -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/host_group"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  assignment_rule := "string"
  description := "string"
  id := "string"
  name := "string"

  response, err := client.HostGroup.UpdateHostGroups(
    &host_group.UpdateHostGroupsParams{
      Body: &models.HostGroupsUpdateGroupsReqV1{
        Resources: []interface{}{
          {
          AssignmentRule: &assignment_rule,
          Description: &description,
          ID: &id,
          Name: &name,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hostGroup.updateHostGroups(
  {
    resources: [{
        assignmentRule: "string",
        description: "string",
        id: "string",
        name: "string"
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::host_group_api::update_host_groups;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::HostGroupsUpdateGroupsReqV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = HostGroupsUpdateGroupsReqV1 {
        resources: vec![UpdateGroupReqV1 {
            id: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = update_host_groups(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::HostGroup.new

body = Falcon::HostGroupsUpdateGroupsReqV1.new(
  resources: [{
      assignment_rule: 'string',
      description: 'string',
      id: 'string',
      name: 'string'
    }]
)

response = api.update_host_groups(body)

puts response

Responses

[
  {
    "assignment_rule": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "group_type": "string",
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "assignment_rule": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "group_type": "string",
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "assignment_rule": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "group_type": "string",
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "assignment_rule": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "group_type": "string",
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string"
    }
  ]
}

Host Group

Table of Contents

createHostGroups

Parameters

deleteHostGroups

Parameters

getHostGroups

Parameters

performGroupAction

Parameters

queryCombinedGroupMembers

Parameters

queryCombinedHostGroups

Parameters

queryGroupMembers

Parameters

queryHostGroups

Parameters

updateHostGroups

Parameters