Skip to content

Host Migration

The Host Migration service collection provides operations for creating and managing device migration jobs in your CrowdStrike Falcon environment. Aggregate host migration and migration data, perform actions on host migrations and migration jobs, retrieve host migration details, get migration destinations, create migrations, and query migration IDs.

LanguageLast Update
Pythonv1.6.5
PowerShellv2.2.9
Gov0.22.0
TypeScriptv0.6.0
Rustv0.7.1
Rubyv1.4.0


OperationDescription
CreateMigrationV1
create_migration
Create a device migration job.
GetHostMigrationIDsV1
query_host_migration_ids
Query host migration IDs.
GetHostMigrationsV1
get_host_migration_details
Get host migration details.
GetMigrationDestinationsV1
get_migration_destination
Get destinations for a migration.
GetMigrationIDsV1
query_migration_jobs
Query migration jobs.
GetMigrationsV1
get_migration_job_details
Get migration job details.
HostMigrationAggregatesV1
aggregate_host_migration
Get host migration aggregates as specified via json in request body.
HostMigrationsActionsV1
perform_host_migration_action
Perform an action on host migrations.
MigrationAggregatesV1
aggregate_migration
Get migration aggregates as specified via json in request body.
MigrationsActionsV1
perform_migration_job_action
Perform an action on a migration job.

Create a device migration job.

Method POST
Route /host-migration/entities/migrations/v1
Scope Host Migration: WRITE
PEP 8 create_migration
body body · dictionary
Full body payload as JSON formatted dictionary.
device_ids body · array
filter body · string
name body · string
target_cid body · string
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.create_migration(device_ids=["string"],
filter="string",
name="string",
target_cid="string")
print(response)
[
{
"hosts_errored": 0,
"hosts_queued": 0,
"migration_id": "string"
}
]


Query host migration IDs.

Method GET
Route /host-migration/queries/host-migrations/v1
Scope Host Migration: READ
PEP 8 query_host_migration_ids
id query · string
The migration job to query
offset query · integer
The offset to start retrieving records from
limit query · integer
The maximum records to return. [1-10000]
sort query · string
The property to sort by.
Available values (33)
id|ascid|descid
hostname|aschostname|deschostname
target_cid|asctarget_cid|desctarget_cid
source_cid|ascsource_cid|descsource_cid
created_time|asccreated_time|desccreated_time
host_migration_id|aschost_migration_id|deschost_migration_id
groups|ascgroups|descgroups
hostgroups|aschostgroups|deschostgroups
static_host_groups|ascstatic_host_groups|descstatic_host_groups
status|ascstatus|descstatus
migration_id|ascmigration_id|descmigration_id
filter query · string
The filter expression that should be used to limit the results. Valid fields: id, hostname, target_cid, source_cid, created_time, host_migration_id, groups, hostgroups, static_host_groups, status, migration_id
Available values (11)
idhostnametarget_cid
source_cidcreated_timehost_migration_id
groupshostgroupsstatic_host_groups
statusmigration_id
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.query_host_migration_ids(filter="string",
id="string",
limit=integer,
offset=integer,
sort="string")
print(response)
[
"string"
]


Get host migration details.

Method POST
Route /host-migration/entities/host-migrations/GET/v1
Scope Host Migration: READ
PEP 8 get_host_migration_details
body body · dictionary
Full body payload as JSON formatted dictionary.
ids body · array
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_host_migration_details(ids=["string"])
print(response)
[
{
"created_time": "string",
"events": [],
"host_migration_id": "string",
"hostgroups": [],
"hostname": "string",
"migration_id": "string",
"platform": "string",
"source_cid": "string",
"source_device_id": "string",
"status": "string",
"status_details": "string",
"target_cid": "string",
"target_device_id": "string",
"updated_time": "string"
}
]


Get destinations for a migration.

Method POST
Route /host-migration/entities/migration-destinations/GET/v1
Scope Host Migration: READ
PEP 8 get_migration_destination
body body · dictionary
Full body payload as JSON formatted dictionary.
device_ids body · array
filter body · string
Available values (11)
groupshostgroupsstatic_host_groups
hostnamestatustarget_cid
source_cidmigration_idid
host_migration_idcreated_time
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_migration_destination(device_ids=["string"],
filter="string")
print(response)
[
{
"cid": "string",
"name": "string"
}
]


Query migration jobs.

Method GET
Route /host-migration/queries/migrations/v1
Scope Host Migration: READ
PEP 8 query_migration_jobs
offset query · integer
The offset to start retrieving records from
limit query · integer
The maximum records to return. [1-10000]
sort query · string
The property to sort by.
Available values (24)
name|ascname|descname
id|ascid|descid
migration_id|ascmigration_id|descmigration_id
target_cid|asctarget_cid|desctarget_cid
status|ascstatus|descstatus
migration_status|ascmigration_status|descmigration_status
created_by|asccreated_by|desccreated_by
created_time|asccreated_time|desccreated_time
filter query · string
The filter expression that should be used to limit the results. Valid fields: status, migration_status, created_by, created_time, name, id, migration_id, target_cid
Available values (8)
statusmigration_statuscreated_by
created_timenameid
migration_idtarget_cid
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.query_migration_jobs(filter="string",
limit=integer,
offset=integer,
sort="string")
print(response)
[
"string"
]


Get migration job details.

Method GET
Route /host-migration/entities/migrations/v1
Scope Host Migration: READ
PEP 8 get_migration_job_details
ids query · string or list of strings
The migration jobs of interest.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_migration_job_details(ids=id_list)
print(response)
[
{
"canceled_by": "string",
"completed_time": "string",
"created_by": "string",
"created_time": "string",
"migration_id": "string",
"migration_status": "string",
"name": "string",
"started_time": "string",
"target_cid": "string",
"total_hosts": 0,
"updated_by": "string",
"updated_time": "string"
}
]


Get host migration aggregates as specified via json in request body.

Method POST
Route /host-migration/aggregates/host-migrations/v1
Scope Host Migration: WRITE
PEP 8 aggregate_host_migration
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
exclude body · string
extended_bounds body · object
field body · string
filter body · string
filters_spec body · object
from body · integer
include body · string
interval body · string
Available values (6)
yearmonthweek
dayhourminute
max_doc_count body · integer
min_doc_count body · integer
missing body · string
name body · string
percents body · array
q body · string
ranges body · array
size body · integer
sort body · string
Available values (2)
_count
sort by document count
_term
sort by the string value alphabetically
sub_aggregates body · array
time_zone body · string
type body · string
Available values (10)
date_histogram
Aggregates counts on a specified time interval. Requires use of “interval” field.
date_range
Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
terms
Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
range
Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.
cardinality
Returns the count of distinct values in a specified field.
max
Returns the maximum value of a specified field.
min
Returns the minimum value of a specified field.
avg
Returns the average value of the specified field.
sum
Returns the total sum of all values for the specified field.
percentiles
Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
date_ranges = [
{
"from": "string",
"to": "string"
}
]
extended_bounds = {
"max": "string",
"min": "string"
}
filters_spec = {
"filters": {},
"other_bucket": boolean,
"other_bucket_key": "string"
}
ranges = [
{
"from": integer,
"to": integer
}
]
sub_aggregates = [
{
"date_ranges": [
{
"from": "string",
"to": "string"
}
],
"exclude": "string",
"extended_bounds": {
"max": "string",
"min": "string"
},
"field": "string",
"filter": "string",
"filters_spec": {
"filters": {},
"other_bucket": boolean,
"other_bucket_key": "string"
},
"from": integer,
"include": "string",
"interval": "string",
"max_doc_count": integer,
"min_doc_count": integer,
"missing": "string",
"name": "string",
"percents": ["string"],
"q": "string",
"ranges": [
{
"from": integer,
"to": integer
}
],
"size": integer,
"sort": "string",
"sub_aggregates": [
{
"date_ranges": ["string"],
"exclude": "string",
"extended_bounds": {},
"field": "string",
"filter": "string",
"filters_spec": {},
"from": integer,
"include": "string",
"interval": "string",
"max_doc_count": integer,
"min_doc_count": integer,
"missing": "string",
"name": "string",
"percents": ["string"],
"q": "string",
"ranges": ["string"],
"size": integer,
"sort": "string",
"sub_aggregates": ["string"],
"time_zone": "string",
"type": "string"
}
],
"time_zone": "string",
"type": "string"
}
]
response = falcon.aggregate_host_migration(date_ranges=date_ranges,
exclude="string",
extended_bounds=extended_bounds,
field="string",
filter="string",
filters_spec=filters_spec,
from=integer,
include="string",
interval="string",
max_doc_count=integer,
min_doc_count=integer,
missing="string",
name="string",
percents=["string"],
q="string",
ranges=ranges,
size=integer,
sort="string",
sub_aggregates=sub_aggregates,
time_zone="string",
type="string")
print(response)
[
{
"buckets": [],
"doc_count_error_upper_bound": 0,
"hits": {},
"name": "string",
"sum_other_doc_count": 0
}
]


Perform an action on host migrations.

Method POST
Route /host-migration/entities/host-migrations-actions/v1
Scope Host Migration: WRITE
PEP 8 perform_host_migration_action
body body · dictionary
Full body payload as JSON formatted dictionary.
action_parameters body · array
filter body · string
Available values (11)
groupshostgroupsstatic_host_groups
hostnamestatustarget_cid
source_cidmigration_idid
host_migration_idcreated_time
ids body · array
id query · string
The migration job to perform actions on
action_name query · string
The action to perform
Available values (3)
remove_hostsremove_host_groupsadd_host_groups
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.perform_host_migration_action(id="string",
action_name="string")
print(response)
[
"string"
]


Get migration aggregates as specified via json in request body.

Method POST
Route /host-migration/aggregates/migrations/v1
Scope Host Migration: WRITE
PEP 8 aggregate_migration
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
exclude body · string
extended_bounds body · object
field body · string
filter body · string
filters_spec body · object
from body · integer
include body · string
interval body · string
Available values (6)
yearmonthweek
dayhourminute
max_doc_count body · integer
min_doc_count body · integer
missing body · string
name body · string
percents body · array
q body · string
ranges body · array
size body · integer
sort body · string
Available values (2)
_count
sort by document count
_term
sort by the string value alphabetically
sub_aggregates body · array
time_zone body · string
type body · string
Available values (10)
date_histogram
Aggregates counts on a specified time interval. Requires use of “interval” field.
date_range
Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
terms
Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
range
Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.
cardinality
Returns the count of distinct values in a specified field.
max
Returns the maximum value of a specified field.
min
Returns the minimum value of a specified field.
avg
Returns the average value of the specified field.
sum
Returns the total sum of all values for the specified field.
percentiles
Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
date_ranges = [
{
"from": "string",
"to": "string"
}
]
extended_bounds = {
"max": "string",
"min": "string"
}
filters_spec = {
"filters": {},
"other_bucket": boolean,
"other_bucket_key": "string"
}
ranges = [
{
"from": integer,
"to": integer
}
]
sub_aggregates = [
{
"date_ranges": [
{
"from": "string",
"to": "string"
}
],
"exclude": "string",
"extended_bounds": {
"max": "string",
"min": "string"
},
"field": "string",
"filter": "string",
"filters_spec": {
"filters": {},
"other_bucket": boolean,
"other_bucket_key": "string"
},
"from": integer,
"include": "string",
"interval": "string",
"max_doc_count": integer,
"min_doc_count": integer,
"missing": "string",
"name": "string",
"percents": ["string"],
"q": "string",
"ranges": [
{
"from": integer,
"to": integer
}
],
"size": integer,
"sort": "string",
"sub_aggregates": [
{
"date_ranges": ["string"],
"exclude": "string",
"extended_bounds": {},
"field": "string",
"filter": "string",
"filters_spec": {},
"from": integer,
"include": "string",
"interval": "string",
"max_doc_count": integer,
"min_doc_count": integer,
"missing": "string",
"name": "string",
"percents": ["string"],
"q": "string",
"ranges": ["string"],
"size": integer,
"sort": "string",
"sub_aggregates": ["string"],
"time_zone": "string",
"type": "string"
}
],
"time_zone": "string",
"type": "string"
}
]
response = falcon.aggregate_migration(date_ranges=date_ranges,
exclude="string",
extended_bounds=extended_bounds,
field="string",
filter="string",
filters_spec=filters_spec,
from=integer,
include="string",
interval="string",
max_doc_count=integer,
min_doc_count=integer,
missing="string",
name="string",
percents=["string"],
q="string",
ranges=ranges,
size=integer,
sort="string",
sub_aggregates=sub_aggregates,
time_zone="string",
type="string")
print(response)
[
{
"buckets": [],
"doc_count_error_upper_bound": 0,
"hits": {},
"name": "string",
"sum_other_doc_count": 0
}
]


Perform an action on a migration job.

Method POST
Route /host-migration/entities/migrations-actions/v1
Scope Host Migration: WRITE
PEP 8 perform_migration_job_action
body body · dictionary
Full body payload as JSON formatted dictionary.
action_parameters body · array
filter body · string
Available values (11)
groupshostgroupsstatic_host_groups
hostnamestatustarget_cid
source_cidmigration_idid
host_migration_idcreated_time
ids body · array
action_name query · string
The action to perform
Available values (4)
delete_migrationrename_migrationstart_migration
cancel_migration
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.perform_migration_job_action(action_name="string")
print(response)
[
"string"
]