Image Assessment Policies

The Image Assessment Policies service collection provides operations for managing container image assessment policies, exclusions, and policy groups. Create, update, delete, and retrieve policies and policy groups, manage exclusion conditions, and set policy precedence order.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
CreatePolicies create_policies	Create Image Assessment policies
CreatePolicyGroups create_policy_groups	Create Image Assessment Policy Group entities
DeletePolicy delete_policy	Delete Image Assessment Policy by policy UUID
DeletePolicyGroup delete_policy_group	Delete Image Assessment Policy Group entities
ReadPolicies read_policies	Get all Image Assessment policies
ReadPolicyExclusions read_policy_exclusions	Retrieve Image Assessment Policy Exclusion entities
ReadPolicyGroups read_policy_groups	Retrieve Image Assessment Policy Group entities
UpdatePolicies update_policies	Update Image Assessment Policy entities
UpdatePolicyExclusions update_policy_exclusions	Update Image Assessment Policy Exclusion entities
UpdatePolicyGroups update_policy_groups	Update Image Assessment Policy Group entities
UpdatePolicyPrecedence update_policy_precedence	Update Image Assessment Policy precedence

---

CreatePolicies

Create Image Assessment policies

Method POST

Route /container-security/entities/image-assessment-policies/v1

Scope Falcon Container Image: WRITE

PEP 8 create_policies

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

description body · string

Policy description.

name body · string

Policy name.

Code Examples

Python

PEP 8

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.create_policies(description="string", name="string")
print(response)

Operation ID

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.CreatePolicies(description="string", name="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "name": "string"
}

response = falcon.command("CreatePolicies", body=body_payload)
print(response)

PowerShell

New-FalconContainerPolicy -Name "string" -Description "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/image_assessment_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  name := "string"

  response, err := client.ImageAssessmentPolicies.CreatePolicies(
    &image_assessment_policies.CreatePoliciesParams{
      Body: &models.ModelsCreatePolicyRequest{
        Description: &description,
        Name: &name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.imageAssessmentPolicies.createPolicies(
  {
    description: "string",
    name: "string"
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::filevantage_api::create_policies;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::PoliciesCreateRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = PoliciesCreateRequest {
        name: Some("string".to_string()),
        ..Default::default()
    };

    let response = create_policies(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ImageAssessmentPolicies.new

body = Falcon::ModelsCreatePolicyRequest.new(
  description: 'string',
  name: 'string'
)

response = api.create_policies(body)

puts response

Responses

200 OK

[
  {
    "created_at": "string",
    "description": "string",
    "is_enabled": false,
    "name": "string",
    "policy_data": {},
    "policy_id": "string",
    "precedence": 0,
    "updated_at": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

CreatePolicyGroups

Create Image Assessment Policy Group entities

Method POST

Route /container-security/entities/image-assessment-policy-groups/v1

Scope Falcon Container Image: WRITE

PEP 8 create_policy_groups

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

description body · string

Policy group description.

name body · string

Policy group name.

policy_group_data body · object

Policy group conditions.

policy_id body · string

Policy ID to update.

conditions body · string

List of policy conditions to apply. Dictionary or list of dictionaries. Overridden if policy_group_data is supplied.

Code Examples

Python

PEP 8

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

policy_group_data = {
    "conditions": [
        {}
    ]
}

response = falcon.create_policy_groups(conditions="string",
                                       description="string",
                                       name="string",
                                       policy_group_data=policy_group_data,
                                       policy_id="string")
print(response)

Operation ID

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

policy_group_data = {
    "conditions": [
        {}
    ]
}

response = falcon.CreatePolicyGroups(conditions="string",
                                     description="string",
                                     name="string",
                                     policy_group_data=policy_group_data,
                                     policy_id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "name": "string",
    "policy_group_data": {
        "conditions": ["string"]
    },
    "policy_id": "string"
}

response = falcon.command("CreatePolicyGroups", body=body_payload)
print(response)

PowerShell

New-FalconContainerPolicyGroup -Name "string" `
  -PolicyId "string" `
  -Condition @{}

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/image_assessment_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  name := "string"
  policy_id := "string"

  response, err := client.ImageAssessmentPolicies.CreatePolicyGroups(
    &image_assessment_policies.CreatePolicyGroupsParams{
      Body: &models.ModelsCreateImageGroupRequest{
        Description: &description,
        Name: &name,
        PolicyGroupData: &struct{}{},
        PolicyID: &policy_id,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.imageAssessmentPolicies.createPolicyGroups(
  {
    description: "string",
    name: "string",
    policyGroupData: {
      conditions: []
    },
    policyId: "string"
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::image_assessment_policies_api::create_policy_groups;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ModelsCreateImageGroupRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ModelsCreateImageGroupRequest {
        description: Some("string".to_string()),
        name: Some("string".to_string()),
        ..Default::default()
    };

    let response = create_policy_groups(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ImageAssessmentPolicies.new

body = Falcon::ModelsCreateImageGroupRequest.new(
  description: 'string',
  name: 'string',
  policy_group_data: {
    conditions: []
  },
  policy_id: 'string'
)

response = api.create_policy_groups(body)

puts response

Responses

200 OK

[
  {
    "created_at": "string",
    "description": "string",
    "name": "string",
    "policy_group_data": {},
    "policy_uuid": "string",
    "updated_at": "string",
    "uuid": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

DeletePolicy

Delete Image Assessment Policy by policy UUID

Method DELETE

Route /container-security/entities/image-assessment-policies/v1

Scope Falcon Container Image: WRITE

PEP 8 delete_policy

Parameters

id query · string

Image Assessment Policy entity UUID

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.delete_policy(id="string")
print(response)

Operation ID

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.DeletePolicy(id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("DeletePolicy",
                          id="string")
print(response)

PowerShell

Remove-FalconContainerPolicy -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/image_assessment_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ImageAssessmentPolicies.DeletePolicy(
    &image_assessment_policies.DeletePolicyParams{
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.imageAssessmentPolicies.deletePolicy("string");  // id

console.log(response);

Rust

use rusty_falcon::apis::image_assessment_policies_api::delete_policy;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_policy(
        &falcon.cfg,  // configuration
        "string",  // id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ImageAssessmentPolicies.new

response = api.delete_policy('string')

puts response

Responses

200 OK

{}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

DeletePolicyGroup

Delete Image Assessment Policy Group entities

Method DELETE

Route /container-security/entities/image-assessment-policy-groups/v1

Scope Falcon Container Image: WRITE

PEP 8 delete_policy_group

Parameters

id query · string

Policy Image Group entity UUID

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.delete_policy_group(id="string")
print(response)

Operation ID

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.DeletePolicyGroup(id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("DeletePolicyGroup",
                          id="string")
print(response)

PowerShell

Remove-FalconContainerPolicyGroup -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/image_assessment_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ImageAssessmentPolicies.DeletePolicyGroup(
    &image_assessment_policies.DeletePolicyGroupParams{
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.imageAssessmentPolicies.deletePolicyGroup("string");  // id

console.log(response);

Rust

use rusty_falcon::apis::image_assessment_policies_api::delete_policy_group;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_policy_group(
        &falcon.cfg,  // configuration
        "string",  // id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ImageAssessmentPolicies.new

response = api.delete_policy_group('string')

puts response

Responses

200 OK

{}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadPolicies

Get all Image Assessment policies

Method GET

Route /container-security/entities/image-assessment-policies/v1

Scope Falcon Container Image: READ

PEP 8 read_policies

Code Examples

Python

PEP 8

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.read_policies()
print(response)

Operation ID

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.ReadPolicies()
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadPolicies")
print(response)

PowerShell

Get-FalconContainerPolicy

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/image_assessment_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ImageAssessmentPolicies.ReadPolicies(
    &image_assessment_policies.ReadPoliciesParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.imageAssessmentPolicies.readPolicies();

console.log(response);

Rust

use rusty_falcon::apis::image_assessment_policies_api::read_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_policies(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ImageAssessmentPolicies.new

response = api.read_policies

puts response

Responses

200 OK

[
  {
    "created_at": "string",
    "description": "string",
    "is_enabled": false,
    "name": "string",
    "policy_data": {},
    "policy_id": "string",
    "precedence": 0,
    "updated_at": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadPolicyExclusions

Retrieve Image Assessment Policy Exclusion entities

Method GET

Route /container-security/entities/image-assessment-policy-exclusions/v1

Scope Falcon Container Image: READ

PEP 8 read_policy_exclusions

Code Examples

Python

PEP 8

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.read_policy_exclusions()
print(response)

Operation ID

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.ReadPolicyExclusions()
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadPolicyExclusions")
print(response)

PowerShell

Get-FalconContainerPolicyExclusion

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/image_assessment_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ImageAssessmentPolicies.ReadPolicyExclusions(
    &image_assessment_policies.ReadPolicyExclusionsParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.imageAssessmentPolicies.readPolicyExclusions();

console.log(response);

Rust

use rusty_falcon::apis::image_assessment_policies_api::read_policy_exclusions;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_policy_exclusions(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ImageAssessmentPolicies.new

response = api.read_policy_exclusions

puts response

Responses

200 OK

[
  {
    "conditions": [],
    "created_at": "string",
    "description": "string",
    "name": "string",
    "policy_type_uuid": "string",
    "updated_at": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadPolicyGroups

Retrieve Image Assessment Policy Group entities

Method GET

Route /container-security/entities/image-assessment-policy-groups/v1

Scope Falcon Container Image: READ

PEP 8 read_policy_groups

Code Examples

Python

PEP 8

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.read_policy_groups()
print(response)

Operation ID

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.ReadPolicyGroups()
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadPolicyGroups")
print(response)

PowerShell

Get-FalconContainerPolicyGroup

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/image_assessment_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ImageAssessmentPolicies.ReadPolicyGroups(
    &image_assessment_policies.ReadPolicyGroupsParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.imageAssessmentPolicies.readPolicyGroups();

console.log(response);

Rust

use rusty_falcon::apis::image_assessment_policies_api::read_policy_groups;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_policy_groups(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ImageAssessmentPolicies.new

response = api.read_policy_groups

puts response

Responses

200 OK

[
  {
    "created_at": "string",
    "description": "string",
    "name": "string",
    "policy_group_data": {},
    "policy_uuid": "string",
    "updated_at": "string",
    "uuid": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

UpdatePolicies

Update Image Assessment Policy entities

Method PATCH

Route /container-security/entities/image-assessment-policies/v1

Scope Falcon Container Image: WRITE

PEP 8 update_policies

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

description body · string

Policy description.

is_enabled body · boolean

Flag indicating if the policy is enabled.

name body · string

Policy name.

policy_data body · object

Policy detail in JSON format.

id query · string

Image Assessment Policy entity UUID

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

rules body · string

List of rules for the policy. List of dictionaries or a single dictionary. Overridden if policy_data is supplied.

Code Examples

Python

PEP 8

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

policy_data = {
    "rules": [
        {
            "action": "string",
            "policy_rules_data": {
                "conditions": [
                    {}
                ]
            }
        }
    ]
}

response = falcon.update_policies(id="string",
                                  description="string",
                                  is_enabled=boolean,
                                  name="string",
                                  policy_data=policy_data,
                                  rules="string")
print(response)

Operation ID

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

policy_data = {
    "rules": [
        {
            "action": "string",
            "policy_rules_data": {
                "conditions": [
                    {}
                ]
            }
        }
    ]
}

response = falcon.UpdatePolicies(id="string",
                                 description="string",
                                 is_enabled=boolean,
                                 name="string",
                                 policy_data=policy_data,
                                 rules="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "is_enabled": boolean,
    "name": "string",
    "policy_data": {
        "rules": [
            {
                "action": "string",
                "policy_rules_data": {}
            }
        ]
    }
}

response = falcon.command("UpdatePolicies",
                          id="string",
                          body=body_payload)
print(response)

PowerShell

Edit-FalconContainerPolicy -Id "string" `
  -Name "string" `
  -Enabled $boolean

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/image_assessment_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  is_enabled := boolean
  name := "string"

  response, err := client.ImageAssessmentPolicies.UpdatePolicies(
    &image_assessment_policies.UpdatePoliciesParams{
      Body: &models.ModelsPatchPolicyRequest{
        Description: &description,
        IsEnabled: &is_enabled,
        Name: &name,
        PolicyData: &struct{}{},
      },
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.imageAssessmentPolicies.updatePolicies(
  "string",  // id
  {  // body
      description: "string",
      isEnabled: boolean,
      name: "string",
      policyData: {
        rules: [{
            action: "string",
            policyRulesData: {}
          }]
      }
  }
);

console.log(response);

Rust

use rusty_falcon::apis::filevantage_api::update_policies;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::PoliciesUpdateRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = PoliciesUpdateRequest {
        description: Some("string".to_string()),
        is_enabled: Some(boolean),
        name: Some("string".to_string()),
        ..Default::default()
    };

    let response = update_policies(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ImageAssessmentPolicies.new

body = Falcon::ModelsPatchPolicyRequest.new(
  description: 'string',
  is_enabled: boolean,
  name: 'string',
  policy_data: {
    rules: [{
        action: 'string',
        policy_rules_data: {}
      }]
  }
)

response = api.update_policies(body, 'string')

puts response

Responses

200 OK

[
  {
    "created_at": "string",
    "description": "string",
    "is_enabled": false,
    "name": "string",
    "policy_data": {},
    "policy_id": "string",
    "precedence": 0,
    "updated_at": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

UpdatePolicyExclusions

Update Image Assessment Policy Exclusion entities

Method POST

Route /container-security/entities/image-assessment-policy-exclusions/v1

Scope Falcon Container Image: WRITE

PEP 8 update_policy_exclusions

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

conditions body · array

List of conditions to apply to the exclusion policy.

description body · string

Condition description. Ignored if conditions list is provided.

prop body · string

Condition property. Ignored if conditions list is provided.

ttl body · integer

Condition time to live. Ignored if conditions list is provided.

value body · list of strings

Condition values. Ignored if conditions list is provided.

Code Examples

Python

PEP 8

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

conditions = [
    {
        "description": "string",
        "prop": "string",
        "ttl": 0,
        "value": [
            "string"
        ]
    }
]

response = falcon.update_policy_exclusions(conditions=conditions,
                                           description="string",
                                           prop="string",
                                           ttl=integer,
                                           value=["string"])
print(response)

Operation ID

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

conditions = [
    {
        "description": "string",
        "prop": "string",
        "ttl": 0,
        "value": [
            "string"
        ]
    }
]

response = falcon.UpdatePolicyExclusions(conditions=conditions,
                                         description="string",
                                         prop="string",
                                         ttl=integer,
                                         value=["string"])
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "conditions": [
        {
            "description": "string",
            "prop": "string",
            "ttl": integer,
            "value": ["string"]
        }
    ]
}

response = falcon.command("UpdatePolicyExclusions", body=body_payload)
print(response)

PowerShell

New-FalconContainerPolicyExclusion -Condition @{}

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/image_assessment_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  prop := "string"
  ttl := integer

  response, err := client.ImageAssessmentPolicies.UpdatePolicyExclusions(
    &image_assessment_policies.UpdatePolicyExclusionsParams{
      Body: &models.ModelsUpdateExclusionsRequest{
        Conditions: []interface{}{
          {
          Description: &description,
          Prop: &prop,
          Ttl: &ttl,
          Value: []string{"string"},
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.imageAssessmentPolicies.updatePolicyExclusions(
  {
    conditions: [{
        description: "string",
        prop: "string",
        ttl: integer,
        value: []
      }]
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::image_assessment_policies_api::update_policy_exclusions;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ModelsUpdateExclusionsRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ModelsUpdateExclusionsRequest {
        conditions: vec![ExclusionConditionRequest {
            prop: Some("string".to_string()),
            value: vec!["string".to_string()],
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = update_policy_exclusions(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ImageAssessmentPolicies.new

body = Falcon::ModelsUpdateExclusionsRequest.new(
  conditions: [{
      description: 'string',
      prop: 'string',
      ttl: integer,
      value: []
    }]
)

response = api.update_policy_exclusions(body)

puts response

Responses

200 OK

[
  {
    "conditions": [],
    "created_at": "string",
    "description": "string",
    "name": "string",
    "policy_type_uuid": "string",
    "updated_at": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

UpdatePolicyGroups

Update Image Assessment Policy Group entities

Method PATCH

Route /container-security/entities/image-assessment-policy-groups/v1

Scope Falcon Container Image: WRITE

PEP 8 update_policy_groups

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

description body · string

Policy group description.

name body · string

Policy group name.

policy_group_data body · object

List of policy conditions.

id query · string

Policy Image Group entity UUID

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

conditions body · string

List of policy conditions to apply. Dictionary or list of dictionaries. Overridden if policy_group_data is supplied.

Code Examples

Python

PEP 8

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

policy_group_data = {
    "conditions": [
        {}
    ]
}

response = falcon.update_policy_groups(conditions="string",
                                       description="string",
                                       id="string",
                                       name="string",
                                       policy_group_data=policy_group_data)
print(response)

Operation ID

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

policy_group_data = {
    "conditions": [
        {}
    ]
}

response = falcon.UpdatePolicyGroups(conditions="string",
                                     description="string",
                                     id="string",
                                     name="string",
                                     policy_group_data=policy_group_data)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "name": "string",
    "policy_group_data": {
        "conditions": ["string"]
    }
}

response = falcon.command("UpdatePolicyGroups",
                          id="string",
                          body=body_payload)
print(response)

PowerShell

Edit-FalconContainerPolicyGroup -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/image_assessment_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  name := "string"

  response, err := client.ImageAssessmentPolicies.UpdatePolicyGroups(
    &image_assessment_policies.UpdatePolicyGroupsParams{
      Body: &models.ModelsPatchImageGroupRequest{
        Description: &description,
        Name: &name,
        PolicyGroupData: &struct{}{},
      },
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.imageAssessmentPolicies.updatePolicyGroups(
  "string",  // id
  {  // body
      description: "string",
      name: "string",
      policyGroupData: {
        conditions: []
      }
  }
);

console.log(response);

Rust

use rusty_falcon::apis::image_assessment_policies_api::update_policy_groups;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ModelsPatchImageGroupRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ModelsPatchImageGroupRequest {
        description: Some("string".to_string()),
        name: Some("string".to_string()),
        ..Default::default()
    };

    let response = update_policy_groups(
        &falcon.cfg,  // configuration
        "string",  // id
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ImageAssessmentPolicies.new

body = Falcon::ModelsPatchImageGroupRequest.new(
  description: 'string',
  name: 'string',
  policy_group_data: {
    conditions: []
  }
)

response = api.update_policy_groups(body, 'string')

puts response

Responses

200 OK

[
  {
    "created_at": "string",
    "description": "string",
    "name": "string",
    "policy_group_data": {},
    "policy_uuid": "string",
    "updated_at": "string",
    "uuid": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

UpdatePolicyPrecedence

Update Image Assessment Policy precedence

Method POST

Route /container-security/entities/image-assessment-policy-precedence/v1

Scope Falcon Container Image: WRITE

PEP 8 update_policy_precedence

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

precedence body · array

List of policy IDs in precedence order.

Code Examples

Python

PEP 8

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_policy_precedence(precedence=id_list)
print(response)

Operation ID

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.UpdatePolicyPrecedence(precedence=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "precedence": ["string"]
}

response = falcon.command("UpdatePolicyPrecedence", body=body_payload)
print(response)

PowerShell

Set-FalconContainerPolicyPrecedence -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/image_assessment_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ImageAssessmentPolicies.UpdatePolicyPrecedence(
    &image_assessment_policies.UpdatePolicyPrecedenceParams{
      Body: &models.ModelsAPIPrecedenceRequest{
        Precedence: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.imageAssessmentPolicies.updatePolicyPrecedence(
  {
    precedence: []
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::filevantage_api::update_policy_precedence;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = update_policy_precedence(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ImageAssessmentPolicies.new

body = Falcon::ModelsAPIPrecedenceRequest.new(
  precedence: []
)

response = api.update_policy_precedence(body)

puts response

Responses

200 OK

[
  {
    "created_at": "string",
    "description": "string",
    "is_enabled": false,
    "name": "string",
    "policy_data": {},
    "policy_id": "string",
    "precedence": 0,
    "updated_at": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}