Hosts

The Hosts service collection provides operations for managing and investigating endpoints across your CrowdStrike Falcon environment. Search for devices using FQL formatted filters. Retrieve detailed host information, check online status, and review login and network address history. Take action on hosts by containing compromised endpoints, suppressing detections, or hiding and restoring devices. Manage Falcon Grouping Tags to organize your fleet.

Language	Last Update
Python	v1.6.1
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

Table of Contents

Operation	Description
CombinedDevicesByFilter query_devices_by_filter_combined	Search for hosts. Returns full device records.
CombinedHiddenDevicesByFilter query_hidden_devices_combined	Search for hidden hosts. Returns full device records.
entities_perform_action perform_group_action	Perform actions on prevention policy IDs.
GetDeviceDetails get_device_details	Get details on one or more hosts by AID. redirect recommended
GetDeviceDetailsV1 get_device_details_v1	Get details on one or more hosts by AID. deprecated
GetDeviceDetailsV2 get_device_details_v2	Get details on one or more hosts by AID.
GetOnlineState_V1 get_online_state	Get online status for one or more hosts.
PerformActionV2 perform_action	Contain, lift containment, delete, or restore a host.
PostDeviceDetailsV2 post_device_details_v2	Get details on one or more hosts by AID.
QueryDeviceLoginHistory query_device_login_history_v1	Retrieve recent login sessions (v1).
QueryDeviceLoginHistoryV2 query_device_login_history_v2	Retrieve recent login sessions for devices.
QueryDevicesByFilter query_devices_by_filter	Search for hosts by platform, hostname, IP, and other criteria.
QueryDevicesByFilterScroll query_devices_by_filter_scroll	Search for hosts with continuous pagination.
QueryGetNetworkAddressHistoryV1 query_network_address_history	Retrieve IP and MAC address history.
QueryHiddenDevices query_hidden_devices	Retrieve hidden hosts matching filter criteria.
UpdateDeviceTags update_device_tags	Append or remove Falcon Grouping Tags.

---

CombinedDevicesByFilter

Search for hosts in your environment by platform, hostname, IP, and other criteria. Returns full device records.

GET /devices/combined/devices/v1

Scope Hosts: READ Consumes · Produces application/json

PEP 8 query_devices_by_filter_combined

Parameters

Name	Type	Data type	Description
filter	query	string	The filter expression that should be used to limit the results.
fields	query	string	The fields to return, comma delimited.
limit	query	integer	The maximum records to return. [1-10000]
offset	query	string	The offset to page from, provided from the previous call as the “next” value.
sort	query	string	The property to sort by (e.g. status.desc or hostname.asc).
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

Python

PEP 8

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.query_devices_by_filter_combined(filter="string",
                                                   limit=integer,
                                                   offset="string",
                                                   sort="string")
print(response)

Operation ID

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.CombinedDevicesByFilter(filter="string",
                                          limit=integer,
                                          offset="string",
                                          sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("CombinedDevicesByFilter",
                          offset="string",
                          limit=integer,
                          sort="string",
                          filter="string",
                          fields="string")
print(response)

PowerShell

Get-FalconHost -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/hosts"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := "string"
  limit := int64(0)
  sort := "string"
  filter := "string"
  fields := "string"

  response, err := client.Hosts.CombinedDevicesByFilter(
    &hosts.CombinedDevicesByFilterParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Fields: &fields,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hosts.combinedDevicesByFilter(
  "string",  // offset
  integer,  // limit
  "string",  // sort
  "string",  // filter
  "string"  // fields
);

console.log(response);

Rust

use rusty_falcon::apis::hosts_api::combined_devices_by_filter;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = combined_devices_by_filter(
        &falcon.cfg,  // configuration
        Some("string"),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
        Some("string"),  // fields
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Hosts.new

response = api.combined_devices_by_filter(offset: 'string',
                                          limit: integer,
                                          sort: 'string',
                                          filter: 'string',
                                          fields: 'string')

puts response

---

CombinedHiddenDevicesByFilter

Search for hidden hosts in your environment by platform, hostname, IP, and other criteria. Returns full device records.

GET /devices/combined/devices-hidden/v1

Scope Hosts: READ Consumes · Produces application/json

PEP 8 query_hidden_devices_combined

Parameters

Name	Type	Data type	Description
limit	query	integer	The maximum records to return. [1-10000]
filter	query	string	The filter expression that should be used to limit the results.
fields	query	string	The fields to return, comma delimited.
offset	query	string	The offset to page from, provided from the previous call as the “next” value.
sort	query	string	The property to sort by (e.g. status.desc or hostname.asc).
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

Python

PEP 8

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.query_hidden_devices_combined(filter="string",
                                                fields="string",
                                                limit=integer,
                                                offset="string",
                                                sort="string")
print(response)

Operation ID

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.CombinedHiddenDevicesByFilter(filter="string",
                                                fields="string",
                                                limit=integer,
                                                offset="string",
                                                sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("CombinedHiddenDevicesByFilter",
                          offset="string",
                          limit=integer,
                          sort="string",
                          filter="string",
                          fields="string")
print(response)

PowerShell

Get-FalconHost -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/hosts"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := "string"
  limit := int64(0)
  sort := "string"
  filter := "string"
  fields := "string"

  response, err := client.Hosts.CombinedHiddenDevicesByFilter(
    &hosts.CombinedHiddenDevicesByFilterParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Fields: &fields,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hosts.combinedHiddenDevicesByFilter(
  "string",  // offset
  integer,  // limit
  "string",  // sort
  "string",  // filter
  "string"  // fields
);

console.log(response);

Rust

use rusty_falcon::apis::hosts_api::combined_hidden_devices_by_filter;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = combined_hidden_devices_by_filter(
        &falcon.cfg,  // configuration
        Some("string"),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
        Some("string"),  // fields
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Hosts.new

response = api.combined_hidden_devices_by_filter(offset: 'string',
                                                 limit: integer,
                                                 sort: 'string',
                                                 filter: 'string',
                                                 fields: 'string')

puts response

---

Not available in the PowerShell SDK.

entities_perform_action

Performs the specified action on the provided prevention policy IDs.

POST /devices/entities/group-actions/v1

Scope Hosts: WRITE Consumes · Produces application/json

PEP 8 perform_group_action

Parameters

Name	Type	Data type	Description
action_name	query	string	Action to perform: add_group_member, remove_all, remove_group_member
action_parameters	query	dictionary	Dictionary containing the name and value for the action parameter.
body	body	dictionary	Full body payload in JSON format.
disablehostnamecheck	query	boolean	Flag to skip hostname check when using add_group_member.
ids	body	string or list of strings	Group ID(s) to perform action against.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

Python

PEP 8

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

action_parameters = [
    {
        "name": "string",
        "value": "string"
    }
]

response = falcon.perform_group_action(action_name="string",
                                       action_parameters=action_parameters,
                                       disable_hostname_check=boolean,
                                       ids=id_list)
print(response)

Operation ID

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

action_parameters = [
    {
        "name": "string",
        "value": "string"
    }
]

response = falcon.entities_perform_action(action_name="string",
                                          action_parameters=action_parameters,
                                          disable_hostname_check=boolean,
                                          ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "action_parameters": [
        {
            "name": "string",
            "value": "string"
        }
    ]
}

response = falcon.command("entities_perform_action",
                          ids=id_list,
                          action_name="string",
                          disable_hostname_check=boolean,
                          body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/hosts"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"
  value := "string"
  disableHostnameCheck := boolean

  response, err := client.Hosts.EntitiesPerformAction(
    &hosts.EntitiesPerformActionParams{
      Body: &models.MsaEntityActionRequest{
        ActionParameters: []interface{}{
          {
          Name: &name,
          Value: &value,
          },
        },
      },
      Ids: []string{"ID1", "ID2", "ID3"},
      ActionName: "string",
      DisableHostnameCheck: &disableHostnameCheck,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hosts.entitiesPerformAction(
  ["ID1", "ID2", "ID3"],  // ids
  "string",  // actionName
  {  // body
      actionParameters: [{
          name: "string",
          value: "string"
        }]
  },
  boolean  // disableHostnameCheck
);

console.log(response);

Rust

Examples coming soon.

Ruby

Examples coming soon.

---

This operation is available in the Python SDK only.

GetDeviceDetails

Get details on one or more hosts by providing agent IDs (AID). redirect recommended

Starting in v1.2.0 all methods for this operation redirect to the new PostDeviceDetailsV2 operation. In prior versions, this operation ID represented a GET operation, whereas now it is a POST operation.

POST /devices/entities/devices/v2

Scope Hosts: READ Consumes · Produces application/json

PEP 8 get_device_details (or post_device_details_v2)

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
ids	body	string or list of strings	The host agent IDs used to get details on. Maximum: 5000.

Code Examples

Python

Examples coming soon.

PowerShell

Examples coming soon.

Go

Examples coming soon.

TypeScript

Examples coming soon.

Rust

Examples coming soon.

Ruby

Examples coming soon.

---

This operation is available in the Python SDK only.

GetDeviceDetailsV1

Get details on one or more hosts by providing agent IDs (AID). deprecated

This operation is deprecated and scheduled to be removed from the API.

GET /devices/entities/devices/v1

Scope Hosts: READ Consumes · Produces application/json

PEP 8 get_device_details_v1

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The host agent IDs used to get details on. Maximum: 500
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

Python

Examples coming soon.

PowerShell

Examples coming soon.

Go

Examples coming soon.

TypeScript

Examples coming soon.

Rust

Examples coming soon.

Ruby

Examples coming soon.

---

Not available in the PowerShell SDK.

GetDeviceDetailsV2

Get details on one or more hosts by providing agent IDs (AID).

GET /devices/entities/devices/v2

Scope Hosts: READ Consumes · Produces application/json

PEP 8 get_device_details_v2

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The host agent IDs used to get details on. Maximum: 100
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

Python

PEP 8

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_device_details_v2(ids=id_list)
print(response)

Operation ID

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetDeviceDetailsV2(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetDeviceDetailsV2",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/hosts"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Hosts.GetDeviceDetailsV2(
    &hosts.GetDeviceDetailsV2Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hosts.getDeviceDetailsV2(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::hosts_api::get_device_details_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_device_details_v2(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Hosts.new

response = api.get_device_details_v2(['ID1', 'ID2', 'ID3'])

puts response

---

GetOnlineState_V1

Get the online status for one or more hosts by specifying each host’s unique ID.

GET /devices/entities/online-state/v1

Scope Hosts: READ Consumes · Produces application/json

PEP 8 get_online_state

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The host AIDs used to retrieve state details for.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

Python

PEP 8

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_online_state(ids=id_list)
print(response)

Operation ID

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetOnlineState_V1(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetOnlineState_V1",
                          ids=id_list)
print(response)

PowerShell

Get-FalconHost -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/hosts"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Hosts.GetOnlineStateV1(
    &hosts.GetOnlineStateV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hosts.getOnlineStateV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

Examples coming soon.

---

PerformActionV2

Take various actions on the hosts in your environment. Contain or lift containment on a host. Delete or restore a host.

POST /devices/entities/devices-actions/v2

Scope Hosts: WRITE Consumes · Produces application/json

PEP 8 perform_action

Parameters

Name	Type	Data type	Description
action_name	query	string	Specify one of: contain, detection_suppress, detection_unsuppress, lift_containment, hide_host, unhide_host
body	body	dictionary	The host agent ID (AID) of the host you want to impact. Provide in JSON format: “ids”: [“123456789”]
ids	body	string or list of strings	The host agent IDs. Maximum: 100
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

Python

PEP 8

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.perform_action(action_name="string",
                                 ids=id_list,
                                 note="string")
print(response)

Operation ID

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.PerformActionV2(action_name="string",
                                  ids=id_list,
                                  note="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "action_parameters": [
        {
            "name": "string",
            "value": "string"
        }
    ],
    "ids": ["string"]
}

response = falcon.command("PerformActionV2",
                          action_name="string",
                          body=body_payload)
print(response)

PowerShell

Invoke-FalconHostAction -Name "string" -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/hosts"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"
  value := "string"

  response, err := client.Hosts.PerformActionV2(
    &hosts.PerformActionV2Params{
      Body: &models.MsaEntityActionRequestV2{
        ActionParameters: []interface{}{
          {
          Name: &name,
          Value: &value,
          },
        },
        Ids: []string{"string"},
      },
      ActionName: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hosts.performActionV2(
  "string",  // actionName
  {  // body
      actionParameters: [{
          name: "string",
          value: "string"
        }],
      ids: []
  }
);

console.log(response);

Rust

use rusty_falcon::apis::hosts_api::perform_action_v2;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaEntityActionRequestV2;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaEntityActionRequestV2 {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = perform_action_v2(
        &falcon.cfg,  // configuration
        "string",  // action_name
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Hosts.new

body = Falcon::MsaEntityActionRequestV2.new(
  action_parameters: [{
      name: 'string',
      value: 'string'
    }],
  ids: []
)

response = api.perform_action_v2(body, 'string')

puts response

---

PostDeviceDetailsV2

Get details on one or more hosts by providing agent IDs (AID).

Starting in v1.2.0 this operation is redirected to from methods previously providing the GetDeviceDetails operation.

POST /devices/entities/devices/v2

Scope Hosts: READ Consumes · Produces application/json

PEP 8 post_device_details_v2 (or get_device_details)

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
ids	body	string or list of strings	The host agent IDs used to get details on. Maximum: 5000

Code Examples

Python

PEP 8

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_device_details(ids=id_list)
print(response)

Operation ID

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.PostDeviceDetailsV2(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "ids": ["string"]
}

response = falcon.command("PostDeviceDetailsV2", body=body_payload)
print(response)

PowerShell

Get-FalconHost -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/hosts"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Hosts.PostDeviceDetailsV2(
    &hosts.PostDeviceDetailsV2Params{
      Body: &models.MsaIdsRequest{
        Ids: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hosts.postDeviceDetailsV2(
  {
    ids: []
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::hosts_api::post_device_details_v2;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaIdsRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaIdsRequest {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = post_device_details_v2(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Hosts.new

body = Falcon::MsaIdsRequest.new(
  ids: []
)

response = api.post_device_details_v2(body)

puts response

---

Not available in the PowerShell SDK.

QueryDeviceLoginHistory

Retrieve details about recent login sessions for a set of devices (v1).

POST /devices/combined/devices/login-history/v1

Scope Devices: READ Consumes · Produces application/json

PEP 8 query_device_login_history_v1

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload as a JSON formatted dictionary.

Code Examples

Python

PEP 8

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.query_device_login_history_v1(ids=id_list)
print(response)

Operation ID

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.QueryDeviceLoginHistory(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "ids": ["string"]
}

response = falcon.command("QueryDeviceLoginHistory", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/hosts"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Hosts.QueryDeviceLoginHistory(
    &hosts.QueryDeviceLoginHistoryParams{
      Body: &models.MsaIdsRequest{
        Ids: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hosts.queryDeviceLoginHistory(
  {
    ids: []
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::hosts_api::query_device_login_history;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaIdsRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaIdsRequest {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = query_device_login_history(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Hosts.new

body = Falcon::MsaIdsRequest.new(
  ids: []
)

response = api.query_device_login_history(body)

puts response

---

QueryDeviceLoginHistoryV2

Retrieve details about recent login sessions for a set of devices.

POST /devices/combined/devices/login-history/v2

Scope Hosts: READ Consumes · Produces application/json

PEP 8 query_device_login_history_v2

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload with ids array.
ids	body	string or list of strings	The host agent IDs to query.
limit	query	integer	Maximum results to return. Default: 10, Max: 100
from	query	string	The inclusive beginning of the time window.
to	query	string	The inclusive end of the time window.

Code Examples

Python

PEP 8

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.query_device_login_history_v2(ids=id_list,
                                                limit=integer,
                                                from="string",
                                                to="string")
print(response)

Operation ID

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.QueryDeviceLoginHistoryV2(ids=id_list,
                                            limit=integer,
                                            from="string",
                                            to="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "ids": ["string"]
}

response = falcon.command("QueryDeviceLoginHistoryV2",
                          limit=integer,
                          from="string",
                          to="string",
                          body=body_payload)
print(response)

PowerShell

Get-FalconHost -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/hosts"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  from := "string"
  to := "string"

  response, err := client.Hosts.QueryDeviceLoginHistoryV2(
    &hosts.QueryDeviceLoginHistoryV2Params{
      Body: &models.MsaIdsRequest{
        Ids: []string{"string"},
      },
      Limit: &limit,
      From: &from,
      To: &to,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hosts.queryDeviceLoginHistoryV2(
  {  // body
      ids: []
  },
  integer,  // limit
  "string",  // from
  "string"  // to
);

console.log(response);

Rust

use rusty_falcon::apis::hosts_api::query_device_login_history_v2;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaIdsRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaIdsRequest {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = query_device_login_history_v2(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Hosts.new

body = Falcon::MsaIdsRequest.new(
  ids: []
)

response = api.query_device_login_history_v2(body)

puts response

---

Not available in the PowerShell SDK.

QueryDevicesByFilter

Search for hosts in your environment by platform, hostname, IP, and other criteria.

GET /devices/queries/devices/v1

Scope Hosts: READ Consumes · Produces application/json

PEP 8 query_devices_by_filter

Parameters

Name	Type	Data type	Description
offset	query	integer	The offset to start retrieving records from.
limit	query	integer	The maximum records to return. [1-5000]
sort	query	string	The property to sort by (e.g. status.desc or hostname.asc).
filter	query	string	The filter expression that should be used to limit the results.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Available Filters

For more detail regarding filters and their usage, review the Falcon Query Language documentation.

Name	Type	Description
device_id	String	The ID of the device.
agent_version	String	CrowdStrike agent version.
bios_manufacturer	String	BIOS manufacturer name.
bios_version	String	BIOS version.
cpu_signature	String	The CPU signature of the device.
deployment_type	String	Linux deployment type: Standard, DaemonSet
external_ip	IP Address	External IP of the device.
first_seen	Timestamp	First connection to Falcon (UTC).
hostname	String	Machine name. Supports wildcard (*) search.
last_login_timestamp	Timestamp	User logon event timestamp.
last_seen	Timestamp	Most recent connection to Falcon (UTC).
linux_sensor_mode	String	Linux sensor mode: Kernel Mode, User Mode
local_ip	IP Address	Device’s local IP address.
mac_address	String	MAC address of the device.
machine_domain	String	Active Directory domain name.
modified_timestamp	Timestamp	Last machine record update.
os_version	String	Operating system version.
platform_name	String	OS platform: Windows, Mac, Linux
product_type_desc	String	Product type: Workstation, Server, Domain Controller
reduced_functionality_mode	String	RFM status: yes, no
serial_number	String	Serial number of the device.
status	String	Containment status: normal, containment_pending, contained, lift_containment_pending
tags	String	Falcon grouping tags.

Code Examples

Python

PEP 8

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.query_devices_by_filter(filter="string",
                                          limit=integer,
                                          offset=integer,
                                          sort="string")
print(response)

Operation ID

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.QueryDevicesByFilter(filter="string",
                                       limit=integer,
                                       offset=integer,
                                       sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryDevicesByFilter",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/hosts"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.Hosts.QueryDevicesByFilter(
    &hosts.QueryDevicesByFilterParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hosts.queryDevicesByFilter(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string"  // filter
);

console.log(response);

Rust

use rusty_falcon::apis::hosts_api::query_devices_by_filter;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_devices_by_filter(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Hosts.new

response = api.query_devices_by_filter(offset: integer,
                                       limit: integer,
                                       sort: 'string',
                                       filter: 'string')

puts response

---

QueryDevicesByFilterScroll

Search for hosts in your environment by platform, hostname, IP, and other criteria with continuous pagination capability (based on offset pointer which expires after 2 minutes with no maximum limit).

GET /devices/queries/devices-scroll/v1

Scope Hosts: READ Consumes · Produces application/json

PEP 8 query_devices_by_filter_scroll

Parameters

Name	Type	Data type	Description
offset	query	string	The offset to page from, for the next result set.
limit	query	integer	The maximum records to return. [1-10000]
sort	query	string	The property to sort by (e.g. status.desc or hostname.asc).
filter	query	string	The filter expression that should be used to limit the results.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Available Filters

Same filter set as QueryDevicesByFilter.

Code Examples

Python

PEP 8

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.query_devices_by_filter_scroll(filter="string",
                                                 limit=integer,
                                                 offset="string",
                                                 sort="string")
print(response)

Operation ID

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.QueryDevicesByFilterScroll(filter="string",
                                             limit=integer,
                                             offset="string",
                                             sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryDevicesByFilterScroll",
                          offset="string",
                          limit=integer,
                          sort="string",
                          filter="string")
print(response)

PowerShell

Get-FalconHost -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/hosts"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := "string"
  limit := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.Hosts.QueryDevicesByFilterScroll(
    &hosts.QueryDevicesByFilterScrollParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hosts.queryDevicesByFilterScroll(
  "string",  // offset
  integer,  // limit
  "string",  // sort
  "string"  // filter
);

console.log(response);

Rust

use rusty_falcon::apis::hosts_api::query_devices_by_filter_scroll;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_devices_by_filter_scroll(
        &falcon.cfg,  // configuration
        Some("string"),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Hosts.new

response = api.query_devices_by_filter_scroll(offset: 'string',
                                              limit: integer,
                                              sort: 'string',
                                              filter: 'string')

puts response

---

QueryGetNetworkAddressHistoryV1

Retrieve history of IP and MAC addresses of devices.

POST /devices/combined/devices/network-address-history/v1

Scope Hosts: READ Consumes · Produces application/json

PEP 8 query_network_address_history

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload with ids array.
ids	body	string or list of strings	The host agent IDs to query.

Code Examples

Python

PEP 8

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.query_network_address_history(ids=id_list)
print(response)

Operation ID

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.QueryGetNetworkAddressHistoryV1(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "ids": ["string"]
}

response = falcon.command("QueryGetNetworkAddressHistoryV1", body=body_payload)
print(response)

PowerShell

Get-FalconHost -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/hosts"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Hosts.QueryGetNetworkAddressHistoryV1(
    &hosts.QueryGetNetworkAddressHistoryV1Params{
      Body: &models.MsaIdsRequest{
        Ids: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hosts.queryGetNetworkAddressHistoryV1(
  {
    ids: []
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::hosts_api::query_get_network_address_history_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaIdsRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaIdsRequest {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = query_get_network_address_history_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Hosts.new

body = Falcon::MsaIdsRequest.new(
  ids: []
)

response = api.query_get_network_address_history_v1(body)

puts response

---

QueryHiddenDevices

Retrieve hidden hosts that match the provided filter criteria.

GET /devices/queries/devices-hidden/v1

Scope Hosts: READ Consumes · Produces application/json

PEP 8 query_hidden_devices

Parameters

Name	Type	Data type	Description
offset	query	integer	The offset to start retrieving records from.
limit	query	integer	The maximum records to return. [1-5000]
sort	query	string	The property to sort by (e.g. status.desc or hostname.asc).
filter	query	string	The filter expression that should be used to limit the results.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

Python

PEP 8

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.query_hidden_devices(filter="string",
                                       limit=integer,
                                       offset=integer,
                                       sort="string")
print(response)

Operation ID

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.QueryHiddenDevices(filter="string",
                                     limit=integer,
                                     offset=integer,
                                     sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryHiddenDevices",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string")
print(response)

PowerShell

Get-FalconHost -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/hosts"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.Hosts.QueryHiddenDevices(
    &hosts.QueryHiddenDevicesParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hosts.queryHiddenDevices(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string"  // filter
);

console.log(response);

Rust

use rusty_falcon::apis::hosts_api::query_hidden_devices;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_hidden_devices(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Hosts.new

response = api.query_hidden_devices(offset: integer,
                                    limit: integer,
                                    sort: 'string',
                                    filter: 'string')

puts response

---

UpdateDeviceTags

Append or remove one or more Falcon Grouping Tags on one or more hosts.

PATCH /devices/entities/devices/tags/v1

Scope Hosts: WRITE Consumes · Produces application/json

PEP 8 update_device_tags

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload containing all parameters in JSON format. (Uber class only)
action_name	body	string	The action to perform: add or remove.
ids	body	string or list of strings	The AID of the host(s) to update.
tags	body	string or list of strings	The tags to adjust on the host.

Code Examples

Python

PEP 8

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_device_tags(action_name="string",
                                     ids=id_list,
                                     tags=id_list)
print(response)

Operation ID

from falconpy import Hosts

falcon = Hosts(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.UpdateDeviceTags(action_name="string",
                                   ids=id_list,
                                   tags=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "action": "string",
    "device_ids": ["string"],
    "tags": ["string"]
}

response = falcon.command("UpdateDeviceTags", body=body_payload)
print(response)

PowerShell

Remove-FalconGroupingTag -Tag @("ID1", "ID2") -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/hosts"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  action := "string"

  response, err := client.Hosts.UpdateDeviceTags(
    &hosts.UpdateDeviceTagsParams{
      Body: &models.DeviceapiUpdateDeviceTagsRequestV1{
        Action: &action,
        DeviceIds: []string{"string"},
        Tags: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.hosts.updateDeviceTags(
  {
    action: "string",
    deviceIds: [],
    tags: []
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::hosts_api::update_device_tags;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DeviceapiUpdateDeviceTagsRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DeviceapiUpdateDeviceTagsRequestV1 {
        action: Some("string".to_string()),
        device_ids: vec!["string".to_string()],
        tags: vec!["string".to_string()],
        ..Default::default()
    };

    let response = update_device_tags(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Hosts.new

body = Falcon::DeviceapiUpdateDeviceTagsRequestV1.new(
  action: 'string',
  device_ids: [],
  tags: []
)

response = api.update_device_tags(body)

puts response