Identity Protection

The Identity Protection service collection provides operations for managing identity-based security across your environment. Retrieve sensor aggregates, get device details, search sensors by filter, execute GraphQL queries for entities and incidents, and manage identity protection policy rules.

Language	Last Update
Python	v1.6.6
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.7.0
Rust	v0.7.1
Ruby	v1.4.0

This service collection has code examples posted to the repository.

---

---

Table of Contents

Operation	Description
delete_policy_rules delete_policy_rules	Delete policy rules
get_policy_rules get_policy_rules	Get policy rules
get_policy_rules_query query_policy_rules	Query policy rule IDs
GetSensorAggregates get_sensor_aggregates	Get sensor aggregates as specified via json in request body.
GetSensorDetails get_sensor_details	Get details on one or more sensors by providing device IDs in a POST body.
post_graphql graphql	Identity Protection GraphQL API.
post_policy_rules create_policy_rule	Create policy rule
QuerySensorsByFilter query_sensors	Search for sensors in your environment by hostname, IP, and other criteria.

---

delete_policy_rules

Delete policy rules

Method DELETE

Route /identity-protection/entities/policy-rules/v1

Scope Identity Protection Policy Rules: WRITE

PEP 8 delete_policy_rules

Parameters

ids query · string or list of strings

Rule IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import IdentityProtection

falcon = IdentityProtection(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_policy_rules(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("delete_policy_rules",
                          ids=id_list)
print(response)

PowerShell

Remove-FalconIdentityRule -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/identity_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.IdentityProtection.APIPreemptProxyDeletePolicyRules(
    &identity_protection.APIPreemptProxyDeletePolicyRulesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.identityProtection.apiPreemptProxyDeletePolicyRules(new Set(["ID1", "ID2", "ID3"]));  // ids

console.log(response);

Rust

use rusty_falcon::apis::identity_protection_api::api_preempt_proxy_delete_policy_rules;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = api_preempt_proxy_delete_policy_rules(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::IdentityProtection.new

response = api.api_preempt_proxy_delete_policy_rules(['ID1', 'ID2', 'ID3'])

puts response

Responses

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

get_policy_rules

Get policy rules

Method GET

Route /identity-protection/entities/policy-rules/v1

Scope Identity Protection Policy Rules: READ

PEP 8 get_policy_rules

Parameters

ids query · string or list of strings

Rule IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import IdentityProtection

falcon = IdentityProtection(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_policy_rules(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_policy_rules",
                          ids=id_list)
print(response)

PowerShell

Get-FalconIdentityRule -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/identity_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.IdentityProtection.APIPreemptProxyGetPolicyRules(
    &identity_protection.APIPreemptProxyGetPolicyRulesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.identityProtection.apiPreemptProxyGetPolicyRules(new Set(["ID1", "ID2", "ID3"]));  // ids

console.log(response);

Rust

use rusty_falcon::apis::identity_protection_api::api_preempt_proxy_get_policy_rules;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = api_preempt_proxy_get_policy_rules(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::IdentityProtection.new

response = api.api_preempt_proxy_get_policy_rules(['ID1', 'ID2', 'ID3'])

puts response

Responses

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

get_policy_rules_query

Query policy rule IDs

Method GET

Route /identity-protection/queries/policy-rules/v1

Scope Identity Protection Policy Rules: READ

PEP 8 query_policy_rules

Parameters

enabled query · boolean

Whether the rule is enabled

simulation_mode query · boolean

Whether the rule is in simulation mode

name query · string

Rule name

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import IdentityProtection

falcon = IdentityProtection(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.query_policy_rules(enabled=boolean,
                                     simulation_mode=boolean,
                                     name="string")
print(response)

Operation ID

from falconpy import IdentityProtection

falcon = IdentityProtection(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.get_policy_rules_query(enabled=boolean,
                                         simulation_mode=boolean,
                                         name="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("get_policy_rules_query",
                          enabled=boolean,
                          simulation_mode=boolean,
                          name="string")
print(response)

PowerShell

Get-FalconIdentityRule

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/identity_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  enabled := boolean
  simulationMode := boolean
  name := "string"

  response, err := client.IdentityProtection.APIPreemptProxyGetPolicyRulesQuery(
    &identity_protection.APIPreemptProxyGetPolicyRulesQueryParams{
      Enabled: &enabled,
      SimulationMode: &simulationMode,
      Name: &name,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.identityProtection.apiPreemptProxyGetPolicyRulesQuery(
  boolean,  // enabled
  boolean,  // simulationMode
  "string"  // name
);

console.log(response);

Rust

use rusty_falcon::apis::identity_protection_api::api_preempt_proxy_get_policy_rules_query;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = api_preempt_proxy_get_policy_rules_query(
        &falcon.cfg,  // configuration
        Some(boolean),  // enabled
        Some(boolean),  // simulation_mode
        Some("string"),  // name
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::IdentityProtection.new

response = api.api_preempt_proxy_get_policy_rules_query(enabled: boolean,
                                                        simulation_mode: boolean,
                                                        name: 'string')

puts response

Responses

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

GetSensorAggregates

Get sensor aggregates as specified via json in request body.

Method POST

Route /identity-protection/aggregates/devices/GET/v1

Scope Identity Protection Entities: READ

PEP 8 get_sensor_aggregates

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

date_ranges body · array

If peforming a date range query specify the from and to date ranges. These can be in common date formats like 2019-07-18 or now.

exclude body · string

Fields to exclude.

extended_bounds body · object

field body · string

Term you want to aggregate on. If doing a date_range query, this is the date field you want to apply the date ranges to.

filter body · string

Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.

filters_spec body · object

from body · integer

include body · string

Fields to include.

interval body · string

Available values (6)

year	month	week
day	hour	minute

max_doc_count body · integer

Maximum number of documents.

min_doc_count body · integer

Minimum number of documents.

missing body · string

name body · string

Scan name.

percents body · array

q body · string

FQL syntax.

ranges body · array

size body · integer

sort body · string

FQL syntax.

Available values (2)

_count

sort by document count

_term

sort by the string value alphabetically

sub_aggregates body · array

time_zone body · string

type body · string

Available values (10)

date_histogram

Aggregates counts on a specified time interval. Requires use of “interval” field.

date_range

Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.

terms

Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.

range

Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.

cardinality

Returns the count of distinct values in a specified field.

max

Returns the maximum value of a specified field.

min

Returns the minimum value of a specified field.

avg

Returns the average value of the specified field.

sum

Returns the total sum of all values for the specified field.

percentiles

Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.

Code Examples

Python

PEP 8

from falconpy import IdentityProtection

falcon = IdentityProtection(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

ranges = [
    {
        "From": 0,
        "To": 0
    }
]

response = falcon.get_sensor_aggregates(date_ranges=date_ranges,
                                        exclude="string",
                                        field="string",
                                        filter="string",
                                        from=integer,
                                        include="string",
                                        interval="string",
                                        max_doc_count=integer,
                                        min_doc_count=integer,
                                        missing="string",
                                        name="string",
                                        q="string",
                                        ranges=ranges,
                                        size=integer,
                                        sort="string",
                                        sub_aggregates=["string"],
                                        time_zone="string",
                                        type="string")
print(response)

Operation ID

from falconpy import IdentityProtection

falcon = IdentityProtection(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

ranges = [
    {
        "From": 0,
        "To": 0
    }
]

response = falcon.GetSensorAggregates(date_ranges=date_ranges,
                                      exclude="string",
                                      field="string",
                                      filter="string",
                                      from=integer,
                                      include="string",
                                      interval="string",
                                      max_doc_count=integer,
                                      min_doc_count=integer,
                                      missing="string",
                                      name="string",
                                      q="string",
                                      ranges=ranges,
                                      size=integer,
                                      sort="string",
                                      sub_aggregates=["string"],
                                      time_zone="string",
                                      type="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "date_ranges": [
        {
            "from": "string",
            "to": "string"
        }
    ],
    "exclude": "string",
    "extended_bounds": {
        "max": "string",
        "min": "string"
    },
    "field": "string",
    "filter": "string",
    "filters_spec": {
        "filters": {},
        "other_bucket": boolean,
        "other_bucket_key": "string"
    },
    "from": integer,
    "include": "string",
    "interval": "string",
    "max_doc_count": integer,
    "min_doc_count": integer,
    "missing": "string",
    "name": "string",
    "percents": ["string"],
    "q": "string",
    "ranges": [
        {
            "from": integer,
            "to": integer
        }
    ],
    "size": integer,
    "sort": "string",
    "sub_aggregates": [
        {
            "date_ranges": [
                {
                    "from": "string",
                    "to": "string"
                }
            ],
            "exclude": "string",
            "extended_bounds": {
                "max": "string",
                "min": "string"
            },
            "field": "string",
            "filter": "string",
            "filters_spec": {
                "filters": {},
                "other_bucket": boolean,
                "other_bucket_key": "string"
            },
            "from": integer,
            "include": "string",
            "interval": "string",
            "max_doc_count": integer,
            "min_doc_count": integer,
            "missing": "string",
            "name": "string",
            "percents": ["string"],
            "q": "string",
            "ranges": [
                {
                    "from": integer,
                    "to": integer
                }
            ],
            "size": integer,
            "sort": "string",
            "sub_aggregates": [
                {
                    "date_ranges": ["string"],
                    "exclude": "string",
                    "extended_bounds": {},
                    "field": "string",
                    "filter": "string",
                    "filters_spec": {},
                    "from": integer,
                    "include": "string",
                    "interval": "string",
                    "max_doc_count": integer,
                    "min_doc_count": integer,
                    "missing": "string",
                    "name": "string",
                    "percents": ["string"],
                    "q": "string",
                    "ranges": ["string"],
                    "size": integer,
                    "sort": "string",
                    "sub_aggregates": ["string"],
                    "time_zone": "string",
                    "type": "string"
                }
            ],
            "time_zone": "string",
            "type": "string"
        }
    ],
    "time_zone": "string",
    "type": "string"
}

response = falcon.command("GetSensorAggregates", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/identity_entities"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  from := "string"
  to := "string"
  exclude := "string"
  max := "string"
  min := "string"
  field := "string"
  filter := "string"
  otherBucket := boolean
  otherBucketKey := "string"
  from2 := int32(0)
  include := "string"
  interval := "string"
  missing := "string"
  name := "string"
  q := "string"
  from3 := float64(0)
  to2 := float64(0)
  size := int32(0)
  sort := "string"
  exclude2 := "string"
  field2 := "string"
  filter2 := "string"
  from4 := int32(0)
  include2 := "string"
  interval2 := "string"
  missing2 := "string"
  name2 := "string"
  q2 := "string"
  size2 := int32(0)
  sort2 := "string"
  timeZone := "string"
  typeVar := "string"
  timeZone2 := "string"
  typeVar2 := "string"

  response, err := client.IdentityEntities.GetSensorAggregates(
    &identity_entities.GetSensorAggregatesParams{
      Body: &models.MsaAggregateQueryRequest{
        DateRanges: []*models.MsaDateRangeSpec{
          {
            From: &from,
            To: &to,
          },
        },
        Exclude: &exclude,
        ExtendedBounds: &models.MsaExtendedBoundsSpec{
          Max: &max,
          Min: &min,
        },
        Field: &field,
        Filter: &filter,
        FiltersSpec: &models.MsaAPIFiltersSpec{
          Filters: map[string]string{},
          OtherBucket: &otherBucket,
          OtherBucketKey: &otherBucketKey,
        },
        From: &from2,
        Include: &include,
        Interval: &interval,
        MaxDocCount: integer,
        MinDocCount: integer,
        Missing: &missing,
        Name: &name,
        Percents: []float64{integer},
        Q: &q,
        Ranges: []*models.MsaRangeSpec{
          {
            From: &from3,
            To: &to2,
          },
        },
        Size: &size,
        Sort: &sort,
        SubAggregates: []*models.MsaAggregateQueryRequest{
          {
            DateRanges: []*models.MsaDateRangeSpec{},
            Exclude: &exclude2,
            ExtendedBounds: &models.MsaExtendedBoundsSpec{},
            Field: &field2,
            Filter: &filter2,
            FiltersSpec: &models.MsaAPIFiltersSpec{},
            From: &from4,
            Include: &include2,
            Interval: &interval2,
            MaxDocCount: integer,
            MinDocCount: integer,
            Missing: &missing2,
            Name: &name2,
            Percents: []float64{integer},
            Q: &q2,
            Ranges: []*models.MsaRangeSpec{},
            Size: &size2,
            Sort: &sort2,
            SubAggregates: []*models.MsaAggregateQueryRequest{},
            TimeZone: &timeZone,
            Type: &typeVar,
          },
        },
        TimeZone: &timeZone2,
        Type: &typeVar2,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.identityEntities.getSensorAggregates(
  {
    dateRanges: [{
        from: "string",
        to: "string"
      }],
    exclude: "string",
    extendedBounds: {
      max: "string",
      min: "string"
    },
    field: "string",
    filter: "string",
    filtersSpec: {
      filters: {},
      otherBucket: boolean,
      otherBucketKey: "string"
    },
    from: integer,
    include: "string",
    interval: "string",
    maxDocCount: integer,
    minDocCount: integer,
    missing: "string",
    name: "string",
    percents: [],
    q: "string",
    ranges: [{
        from: integer,
        to: integer
      }],
    size: integer,
    sort: "string",
    subAggregates: [{
        dateRanges: [{
            from: "string",
            to: "string"
          }],
        exclude: "string",
        extendedBounds: {
          max: "string",
          min: "string"
        },
        field: "string",
        filter: "string",
        filtersSpec: {
          filters: {},
          otherBucket: boolean,
          otherBucketKey: "string"
        },
        from: integer,
        include: "string",
        interval: "string",
        maxDocCount: integer,
        minDocCount: integer,
        missing: "string",
        name: "string",
        percents: [],
        q: "string",
        ranges: [{
            from: integer,
            to: integer
          }],
        size: integer,
        sort: "string",
        subAggregates: [{
            dateRanges: [],
            exclude: "string",
            field: "string",
            filter: "string",
            filtersSpec: {
              filters: {},
              otherBucket: boolean,
              otherBucketKey: "string"
            },
            from: integer,
            include: "string",
            interval: "string",
            maxDocCount: integer,
            minDocCount: integer,
            missing: "string",
            name: "string",
            percents: [],
            q: "string",
            ranges: [],
            size: integer,
            sort: "string",
            subAggregates: [],
            timeZone: "string",
            type: "string"
          }],
        timeZone: "string",
        type: "string"
      }],
    timeZone: "string",
    type: "string"
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::identity_entities_api::get_sensor_aggregates;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaAggregateQueryRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaAggregateQueryRequest {
        date_ranges: vec![rusty_falcon::models::MsaDateRangeSpec {
            from: "string".to_string(),
            to: "string".to_string(),
            ..Default::default()
        }],
        exclude: "string".to_string(),
        field: "string".to_string(),
        filter: "string".to_string(),
        from: integer,
        include: "string".to_string(),
        interval: "string".to_string(),
        missing: "string".to_string(),
        name: "string".to_string(),
        q: "string".to_string(),
        ranges: vec![rusty_falcon::models::MsaRangeSpec {
            from: number,
            to: number,
            ..Default::default()
        }],
        size: integer,
        sort: "string".to_string(),
        sub_aggregates: vec![rusty_falcon::models::MsaAggregateQueryRequest {
            date_ranges: vec![rusty_falcon::models::MsaDateRangeSpec {
                from: "string".to_string(),
                to: "string".to_string(),
                ..Default::default()
            }],
            exclude: "string".to_string(),
            field: "string".to_string(),
            filter: "string".to_string(),
            from: integer,
            include: "string".to_string(),
            interval: "string".to_string(),
            missing: "string".to_string(),
            name: "string".to_string(),
            q: "string".to_string(),
            ranges: vec![rusty_falcon::models::MsaRangeSpec {
                from: number,
                to: number,
                ..Default::default()
            }],
            size: integer,
            sort: "string".to_string(),
            sub_aggregates: vec![rusty_falcon::models::MsaAggregateQueryRequest {
                date_ranges: vec![],
                exclude: "string".to_string(),
                field: "string".to_string(),
                filter: "string".to_string(),
                from: integer,
                include: "string".to_string(),
                interval: "string".to_string(),
                missing: "string".to_string(),
                name: "string".to_string(),
                q: "string".to_string(),
                ranges: vec![],
                size: integer,
                sort: "string".to_string(),
                sub_aggregates: vec![],
                time_zone: "string".to_string(),
                r#type: "string".to_string(),
                ..Default::default()
            }],
            time_zone: "string".to_string(),
            r#type: "string".to_string(),
            ..Default::default()
        }],
        time_zone: "string".to_string(),
        r#type: "string".to_string(),
        ..Default::default()
    };

    let response = get_sensor_aggregates(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::IdentityEntities.new

body = Falcon::MsaAggregateQueryRequest.new(
  date_ranges: [{
      from: 'string',
      to: 'string'
    }],
  exclude: 'string',
  extended_bounds: {
    max: 'string',
    min: 'string'
  },
  field: 'string',
  filter: 'string',
  filters_spec: {
    filters: {},
    other_bucket: boolean,
    other_bucket_key: 'string'
  },
  from: integer,
  include: 'string',
  interval: 'string',
  max_doc_count: integer,
  min_doc_count: integer,
  missing: 'string',
  name: 'string',
  percents: [],
  q: 'string',
  ranges: [{
      From: integer,
      To: integer
    }],
  size: integer,
  sort: 'string',
  sub_aggregates: [{
      date_ranges: [{
          from: 'string',
          to: 'string'
        }],
      exclude: 'string',
      extended_bounds: {
        max: 'string',
        min: 'string'
      },
      field: 'string',
      filter: 'string',
      filters_spec: {
        filters: {},
        other_bucket: boolean,
        other_bucket_key: 'string'
      },
      from: integer,
      include: 'string',
      interval: 'string',
      max_doc_count: integer,
      min_doc_count: integer,
      missing: 'string',
      name: 'string',
      percents: [],
      q: 'string',
      ranges: [{
          From: integer,
          To: integer
        }],
      size: integer,
      sort: 'string',
      sub_aggregates: [{
          date_ranges: [],
          exclude: 'string',
          extended_bounds: {},
          field: 'string',
          filter: 'string',
          filters_spec: {},
          from: integer,
          include: 'string',
          interval: 'string',
          max_doc_count: integer,
          min_doc_count: integer,
          missing: 'string',
          name: 'string',
          percents: [],
          q: 'string',
          ranges: [],
          size: integer,
          sort: 'string',
          sub_aggregates: [],
          time_zone: 'string',
          type: 'string'
        }],
      time_zone: 'string',
      type: 'string'
    }],
  time_zone: 'string',
  type: 'string'
)

response = api.get_sensor_aggregates(body)

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

GetSensorDetails

Get details on one or more sensors by providing device IDs in a POST body.

Method POST

Route /identity-protection/entities/devices/GET/v1

Scope Identity Protection Entities: READ

PEP 8 get_sensor_details

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

ids body · array

Sensor ID(s) to retrieve. (Max: 5,000)

Code Examples

Python

PEP 8

from falconpy import IdentityProtection

falcon = IdentityProtection(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_sensor_details(ids=id_list)
print(response)

Operation ID

from falconpy import IdentityProtection

falcon = IdentityProtection(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetSensorDetails(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "ids": ["string"]
}

response = falcon.command("GetSensorDetails", body=body_payload)
print(response)

PowerShell

Get-FalconIdentityHost -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/identity_entities"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.IdentityEntities.GetSensorDetails(
    &identity_entities.GetSensorDetailsParams{
      Body: &models.MsaIdsRequest{
        Ids: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.identityEntities.getSensorDetails(
  {
    ids: []
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::identity_entities_api::get_sensor_details;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaIdsRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaIdsRequest {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = get_sensor_details(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::IdentityEntities.new

body = Falcon::MsaIdsRequest.new(
  ids: []
)

response = api.get_sensor_details(body)

puts response

Responses

200 OK

[
  {
    "agent_version": "string",
    "cid": "string",
    "device_id": "string",
    "directory_auditing": "string",
    "group_policy_object": "string",
    "heartbeat_time": 0,
    "hostname": "string",
    "idp_policy_id": "string",
    "idp_policy_name": "string",
    "kerberos_config": "string",
    "ldap_config": "string",
    "ldaps_config": "string",
    "local_ip": "string",
    "machine_domain": "string",
    "new_enforcement_mode": "string",
    "ntlm_config": "string",
    "os_version": "string",
    "rdp_to_dc_config": "string",
    "smb_to_dc_config": "string",
    "status": "string",
    "status_causes": [],
    "ti_enabled": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

post_graphql

Identity Protection GraphQL API.

Method POST

Route /identity-protection/combined/graphql/v1

Scope Identity Protection GraphQL: WRITE

PEP 8 graphql

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

query body · string

JSON-similar string. (GraphQL syntax)

variables body · string

variables to use for interpolation. Currently using a non-standard body payload format. Example payload:

Code Examples

Python

PEP 8

from falconpy import IdentityProtection

falcon = IdentityProtection(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.graphql(query="string", variables="string")
print(response)

Operation ID

from falconpy import IdentityProtection

falcon = IdentityProtection(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.post_graphql(query="string", variables="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "query": "string"
}

response = falcon.command("post_graphql", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/identity_protection"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  query := "string"

  response, err := client.IdentityProtection.APIPreemptProxyPostGraphql(
    &identity_protection.APIPreemptProxyPostGraphqlParams{
      Body: &models.SwaggerGraphQLQuery{
        Query: &query,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.identityProtection.apiPreemptProxyPostGraphql(
  {
    query: "string"
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::identity_protection_api::api_preempt_proxy_post_graphql;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::SwaggerGraphQlQuery;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = SwaggerGraphQlQuery {
        query: "string".to_string(),
        ..Default::default()
    };

    let response = api_preempt_proxy_post_graphql(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::IdentityProtection.new

body = Falcon::SwaggerGraphQLQuery.new(
  query: 'string'
)

response = api.api_preempt_proxy_post_graphql(body)

puts response

Responses

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

post_policy_rules

Create policy rule

Method POST

Route /identity-protection/entities/policy-rules/v1

Scope Identity Protection Policy Rules: WRITE

PEP 8 create_policy_rule

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

action body · string

Action to perform.

activity body · object

Activities that trigger the policy.

destination body · object

Activity destination.

enabled body · boolean

Flag indicating if the policy rule should be enabled.

name body · string

Policy rule name.

simulation_mode body · boolean

Simulate the policy action instead of actually taking action. simulationMode will also be accepted for this argument.

simulationMode body · boolean

Simulate the policy action instead of actually taking action. simulationMode will also be accepted for this argument.

SimulationMode body · boolean

Simulate the policy action instead of actually taking action. simulationMode will also be accepted for this argument.

source_endpoint body · object

Source endpoint details. sourceEndpoint will also be accepted for this argument.

sourceEndpoint body · object

Source endpoint details. sourceEndpoint will also be accepted for this argument.

SourceEndpoint body · object

Source endpoint details. sourceEndpoint will also be accepted for this argument.

source_user body · object

Source user details. sourceUser will also be accepted for this argument.

sourceUser body · object

Source user details. sourceUser will also be accepted for this argument.

SourceUser body · object

Source user details. sourceUser will also be accepted for this argument.

trigger body · string

Policy rule trigger.

Code Examples

Python

PEP 8

from falconpy import IdentityProtection

falcon = IdentityProtection(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

activity = {
    "accessType": {
        "exclude": [
            "string"
        ],
        "include": [
            "string"
        ]
    },
    "accessTypeCustom": {
        "exclude": [
            "string"
        ],
        "include": [
            "string"
        ]
    }
}

destination = {
    "entityId": {
        "exclude": [
            "string"
        ],
        "include": [
            "string"
        ]
    },
    "groupMembership": {
        "exclude": [
            "string"
        ],
        "include": [
            "string"
        ]
    }
}

response = falcon.create_policy_rule(action="string",
                                     activity=activity,
                                     destination=destination,
                                     enabled=boolean,
                                     name="string",
                                     simulation_mode="string",
                                     source_endpoint="string",
                                     source_user="string",
                                     trigger="string")
print(response)

Operation ID

from falconpy import IdentityProtection

falcon = IdentityProtection(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

activity = {
    "accessType": {
        "exclude": [
            "string"
        ],
        "include": [
            "string"
        ]
    },
    "accessTypeCustom": {
        "exclude": [
            "string"
        ],
        "include": [
            "string"
        ]
    }
}

destination = {
    "entityId": {
        "exclude": [
            "string"
        ],
        "include": [
            "string"
        ]
    },
    "groupMembership": {
        "exclude": [
            "string"
        ],
        "include": [
            "string"
        ]
    }
}

response = falcon.post_policy_rules(action="string",
                                    activity=activity,
                                    destination=destination,
                                    enabled=boolean,
                                    name="string",
                                    simulation_mode="string",
                                    source_endpoint="string",
                                    source_user="string",
                                    trigger="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "action": "string",
    "activity": {
        "access_type": {
            "exclude": ["string"],
            "include": ["string"]
        },
        "access_type_custom": {
            "exclude": ["string"],
            "include": ["string"]
        }
    },
    "destination": {
        "entity_id": {
            "exclude": ["string"],
            "include": ["string"]
        },
        "group_membership": {
            "exclude": ["string"],
            "include": ["string"]
        }
    },
    "enabled": boolean,
    "name": "string",
    "simulation_mode": boolean,
    "source_endpoint": {
        "entity_id": {
            "exclude": ["string"],
            "include": ["string"]
        },
        "group_membership": {
            "exclude": ["string"],
            "include": ["string"]
        }
    },
    "source_user": {
        "entity_id": {
            "exclude": ["string"],
            "include": ["string"]
        },
        "group_membership": {
            "exclude": ["string"],
            "include": ["string"]
        }
    },
    "trigger": "string"
}

response = falcon.command("post_policy_rules", body=body_payload)
print(response)

PowerShell

New-FalconIdentityRule -Name "string" `
  -Action "string" `
  -Trigger "string" `
  -Enabled $boolean `
  -SimulationMode $boolean

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/identity_protection"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  action := "string"
  enabled := boolean
  name := "string"
  simulationMode := boolean
  trigger := "string"

  response, err := client.IdentityProtection.APIPreemptProxyPostPolicyRules(
    &identity_protection.APIPreemptProxyPostPolicyRulesParams{
      Body: &models.TypesPolicyRulesCreateBody{
        Action: &action,
        Activity: &models.Activity{
          AccessType: &models.TypesPolicyRulesCondition{},
          AccessTypeCustom: &models.TypesPolicyRulesCondition{},
        },
        Destination: &models.Destination{
          EntityID: &models.TypesPolicyRulesCondition{},
          GroupMembership: &models.TypesPolicyRulesCondition{},
        },
        Enabled: &enabled,
        Name: &name,
        SimulationMode: &simulationMode,
        SourceEndpoint: &models.SourceEndpoint{
          EntityID: &models.TypesPolicyRulesCondition{},
          GroupMembership: &models.TypesPolicyRulesCondition{},
        },
        SourceUser: &models.SourceUser{
          EntityID: &models.TypesPolicyRulesCondition{},
          GroupMembership: &models.TypesPolicyRulesCondition{},
        },
        Trigger: &trigger,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.identityProtection.apiPreemptProxyPostPolicyRules(
  {
    action: "string",
    activity: {
      accessType: {
        exclude: [],
        include: []
      },
      accessTypeCustom: {
        exclude: [],
        include: []
      }
    },
    destination: {
      entityId: {
        exclude: [],
        include: []
      },
      groupMembership: {
        exclude: [],
        include: []
      }
    },
    enabled: boolean,
    name: "string",
    simulationMode: boolean,
    sourceEndpoint: {
      entityId: {
        exclude: [],
        include: []
      },
      groupMembership: {
        exclude: [],
        include: []
      }
    },
    sourceUser: {
      entityId: {
        exclude: [],
        include: []
      },
      groupMembership: {
        exclude: [],
        include: []
      }
    },
    trigger: "string"
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::identity_protection_api::api_preempt_proxy_post_policy_rules;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::TypesPolicyRulesCreateBody;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = TypesPolicyRulesCreateBody {
        action: "string".to_string(),
        enabled: boolean,
        name: "string".to_string(),
        simulation_mode: boolean,
        trigger: "string".to_string(),
        ..Default::default()
    };

    let response = api_preempt_proxy_post_policy_rules(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::IdentityProtection.new

body = Falcon::TypesPolicyRulesCreateBody.new(
  action: 'string',
  activity: {
    accessType: {
      exclude: [],
      include: []
    },
    accessTypeCustom: {
      exclude: [],
      include: []
    }
  },
  destination: {
    entityId: {
      exclude: [],
      include: []
    },
    groupMembership: {
      exclude: [],
      include: []
    }
  },
  enabled: boolean,
  name: 'string',
  simulation_mode: boolean,
  source_endpoint: {
    entityId: {
      exclude: [],
      include: []
    },
    groupMembership: {
      exclude: [],
      include: []
    }
  },
  source_user: {
    entityId: {
      exclude: [],
      include: []
    },
    groupMembership: {
      exclude: [],
      include: []
    }
  },
  trigger: 'string'
)

response = api.api_preempt_proxy_post_policy_rules(body)

puts response

Responses

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

QuerySensorsByFilter

Search for sensors in your environment by hostname, IP, and other criteria.

Method GET

Route /identity-protection/queries/devices/v1

Scope Identity Protection Entities: READ

PEP 8 query_sensors

Parameters

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return. [1-200]

sort query · string

The property to sort by (e.g. status.desc or hostname.asc)

filter query · string

The filter expression that should be used to limit the results.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import IdentityProtection

falcon = IdentityProtection(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.query_sensors(filter="string",
                                limit=integer,
                                offset=integer,
                                sort="string")
print(response)

Operation ID

from falconpy import IdentityProtection

falcon = IdentityProtection(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.QuerySensorsByFilter(filter="string",
                                       limit=integer,
                                       offset=integer,
                                       sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QuerySensorsByFilter",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string")
print(response)

PowerShell

Get-FalconIdentityHost -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/identity_entities"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.IdentityEntities.QuerySensorsByFilter(
    &identity_entities.QuerySensorsByFilterParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.identityEntities.querySensorsByFilter(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string"  // filter
);

console.log(response);

Rust

use rusty_falcon::apis::identity_entities_api::query_sensors_by_filter;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_sensors_by_filter(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::IdentityEntities.new

response = api.query_sensors_by_filter(offset: integer,
                                       limit: integer,
                                       sort: 'string',
                                       filter: 'string')

puts response

Responses

200 OK

[
  "string"
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}