Image Assessment Policies

The Image Assessment Policies service collection provides operations for managing container image assessment policies, exclusions, and policy groups. Create, update, delete, and retrieve policies and policy groups, manage exclusion conditions, and set policy precedence order.

Language	Last Update
Python	v1.4.6
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

Operation	Description
ReadPolicies `read_policies`	Get all Image Assessment policies
CreatePolicies `create_policies`	Create Image Assessment policies
DeletePolicy `delete_policy`	Delete Image Assessment Policy by policy UUID
UpdatePolicies `update_policies`	Update Image Assessment Policy entities
ReadPolicyExclusions `read_policy_exclusions`	Retrieve Image Assessment Policy Exclusion entities
UpdatePolicyExclusions `update_policy_exclusions`	Update Image Assessment Policy Exclusion entities
ReadPolicyGroups `read_policy_groups`	Retrieve Image Assessment Policy Group entities
CreatePolicyGroups `create_policy_groups`	Create Image Assessment Policy Group entities
DeletePolicyGroup `delete_policy_group`	Delete Image Assessment Policy Group entities
UpdatePolicyGroups `update_policy_groups`	Update Image Assessment Policy Group entities
UpdatePolicyPrecedence `update_policy_precedence`	Update Image Assessment Policy precedence

ReadPolicies

Get all Image Assessment policies.

GET /container-security/entities/image-assessment-policies/v1

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 read_policies

Parameters

No keywords or arguments accepted.

Code Examples

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.read_policies()
print(response)

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.ReadPolicies()
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadPolicies")
print(response)

Get-FalconContainerPolicy

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/image_assessment_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ImageAssessmentPolicies.ReadPolicies(
    &image_assessment_policies.ReadPoliciesParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.imageAssessmentPolicies.readPolicies();

console.log(response);

use rusty_falcon::apis::image_assessment_policies_api::read_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_policies(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ImageAssessmentPolicies.new

response = api.read_policies

puts response

CreatePolicies

Create Image Assessment policies.

POST /container-security/entities/image-assessment-policies/v1

Scope Falcon Container Image: WRITE Consumes · Produces application/json

PEP 8 create_policies

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
description	body	string	Policy description.
name	body	string	Policy name.

Code Examples

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.create_policies(description="string", name="string")
print(response)

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.CreatePolicies(description="string", name="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "name": "string"
}

response = falcon.command("CreatePolicies", body=body_payload)
print(response)

New-FalconContainerPolicy -Name "string" -Description "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/image_assessment_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  name := "string"

  response, err := client.ImageAssessmentPolicies.CreatePolicies(
    &image_assessment_policies.CreatePoliciesParams{
      Body: &models.ModelsCreatePolicyRequest{
        Description: &description,
        Name: &name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.imageAssessmentPolicies.createPolicies(
  {
    description: "string",
    name: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::filevantage_api::create_policies;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::PoliciesCreateRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = PoliciesCreateRequest {
        name: Some("string".to_string()),
        ..Default::default()
    };

    let response = create_policies(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ImageAssessmentPolicies.new

body = Falcon::ModelsCreatePolicyRequest.new(
  description: 'string',
  name: 'string'
)

response = api.create_policies(body)

puts response

DeletePolicy

Delete Image Assessment Policy by policy UUID.

DELETE /container-security/entities/image-assessment-policies/v1

Scope Falcon Container Image: WRITE Consumes · Produces application/json

PEP 8 delete_policy

Parameters

Name	Type	Data type	Description
id	query	string	Image Assessment Policy entity UUID.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.delete_policy(id="string")
print(response)

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.DeletePolicy(id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("DeletePolicy",
                          id="string")
print(response)

Remove-FalconContainerPolicy -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/image_assessment_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ImageAssessmentPolicies.DeletePolicy(
    &image_assessment_policies.DeletePolicyParams{
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.imageAssessmentPolicies.deletePolicy("string");  // id

console.log(response);

use rusty_falcon::apis::image_assessment_policies_api::delete_policy;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_policy(
        &falcon.cfg,  // configuration
        "string",  // id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ImageAssessmentPolicies.new

response = api.delete_policy('string')

puts response

UpdatePolicies

Update Image Assessment Policy entities.

PATCH /container-security/entities/image-assessment-policies/v1

Scope Falcon Container Image: WRITE Consumes · Produces application/json

PEP 8 update_policies

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
description	body	string	Policy description.
id	query	string	Image Assessment Policy entity UUID.
is_enabled	query	boolean	Flag indicating if the policy is currently enabled.
name	body	string	Policy name.
parameters	query	dictionary	Full query string parameters payload in JSON format.
policy_data	body	dictionary	Image Assessment Policy rules in JSON format.

Code Examples

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.update_policies(id="string",
                                  description="string",
                                  is_enabled=boolean,
                                  name="string",
                                  policy_data={},
                                  rules=[{"key": "value"}])
print(response)

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.UpdatePolicies(id="string",
                                 description="string",
                                 is_enabled=boolean,
                                 name="string",
                                 policy_data={},
                                 rules=[{"key": "value"}])
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "is_enabled": boolean,
    "name": "string",
    "policy_data": {
        "rules": [
            {
                "action": "string",
                "policy_rules_data": {}
            }
        ]
    }
}

response = falcon.command("UpdatePolicies",
                          id="string",
                          body=body_payload)
print(response)

Edit-FalconContainerPolicy -Id "string" `
  -Name "string" `
  -Enabled $boolean

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/image_assessment_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  is_enabled := boolean
  name := "string"

  response, err := client.ImageAssessmentPolicies.UpdatePolicies(
    &image_assessment_policies.UpdatePoliciesParams{
      Body: &models.ModelsPatchPolicyRequest{
        Description: &description,
        IsEnabled: &is_enabled,
        Name: &name,
        PolicyData: &struct{}{},
      },
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.imageAssessmentPolicies.updatePolicies(
  "string",  // id
  {  // body
      description: "string",
      isEnabled: boolean,
      name: "string",
      policyData: {
        rules: [{
            action: "string",
            policyRulesData: {}
          }]
      }
  }
);

console.log(response);

use rusty_falcon::apis::filevantage_api::update_policies;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::PoliciesUpdateRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = PoliciesUpdateRequest {
        description: Some("string".to_string()),
        is_enabled: Some(boolean),
        name: Some("string".to_string()),
        ..Default::default()
    };

    let response = update_policies(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ImageAssessmentPolicies.new

body = Falcon::ModelsPatchPolicyRequest.new(
  description: 'string',
  is_enabled: boolean,
  name: 'string',
  policy_data: {
    rules: [{
        action: 'string',
        policy_rules_data: {}
      }]
  }
)

response = api.update_policies(body, 'string')

puts response

ReadPolicyExclusions

Retrieve Image Assessment Policy Exclusion entities.

GET /container-security/entities/image-assessment-policy-exclusions/v1

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 read_policy_exclusions

Parameters

No keywords or arguments accepted.

Code Examples

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.read_policy_exclusions()
print(response)

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.ReadPolicyExclusions()
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadPolicyExclusions")
print(response)

Get-FalconContainerPolicyExclusion

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/image_assessment_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ImageAssessmentPolicies.ReadPolicyExclusions(
    &image_assessment_policies.ReadPolicyExclusionsParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.imageAssessmentPolicies.readPolicyExclusions();

console.log(response);

use rusty_falcon::apis::image_assessment_policies_api::read_policy_exclusions;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_policy_exclusions(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ImageAssessmentPolicies.new

response = api.read_policy_exclusions

puts response

UpdatePolicyExclusions

Update Image Assessment Policy Exclusion entities.

POST /container-security/entities/image-assessment-policy-exclusions/v1

Scope Falcon Container Image: WRITE Consumes · Produces application/json

PEP 8 update_policy_exclusions

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
conditions	body	list of dictionaries	List of conditions to apply. Overrides other keywords if provided.
description	body	string	Condition description. Ignored if `conditions` keyword is used.
prop	body	string	Condition property. Ignored if `conditions` keyword is used.
ttl	body	integer	Condition time to live. Ignored if `conditions` keyword is used.
value	body	list of strings	Condition values. Ignored if `conditions` keyword is used.

Code Examples

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

conditions = [
    {
        "description": "string",
        "prop": "string",
        "ttl": 0,
        "value": [
            "string"
        ]
    }
]

response = falcon.update_policy_exclusions(conditions=conditions,
                                           description=["string"],
                                           prop=["string"],
                                           ttl=integer,
                                           value=["string"])
print(response)

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

conditions = [
    {
        "description": "string",
        "prop": "string",
        "ttl": 0,
        "value": [
            "string"
        ]
    }
]

response = falcon.UpdatePolicyExclusions(conditions=conditions,
                                         description=["string"],
                                         prop=["string"],
                                         ttl=integer,
                                         value=["string"])
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "conditions": [
        {
            "description": "string",
            "prop": "string",
            "ttl": integer,
            "value": ["string"]
        }
    ]
}

response = falcon.command("UpdatePolicyExclusions", body=body_payload)
print(response)

New-FalconContainerPolicyExclusion -Condition @{}

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/image_assessment_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  prop := "string"
  ttl := integer

  response, err := client.ImageAssessmentPolicies.UpdatePolicyExclusions(
    &image_assessment_policies.UpdatePolicyExclusionsParams{
      Body: &models.ModelsUpdateExclusionsRequest{
        Conditions: []interface{}{
          {
          Description: &description,
          Prop: &prop,
          Ttl: &ttl,
          Value: []string{"string"},
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.imageAssessmentPolicies.updatePolicyExclusions(
  {
    conditions: [{
        description: "string",
        prop: "string",
        ttl: integer,
        value: []
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::image_assessment_policies_api::update_policy_exclusions;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ModelsUpdateExclusionsRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ModelsUpdateExclusionsRequest {
        conditions: vec![ExclusionConditionRequest {
            prop: Some("string".to_string()),
            value: vec!["string".to_string()],
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = update_policy_exclusions(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ImageAssessmentPolicies.new

body = Falcon::ModelsUpdateExclusionsRequest.new(
  conditions: [{
      description: 'string',
      prop: 'string',
      ttl: integer,
      value: []
    }]
)

response = api.update_policy_exclusions(body)

puts response

ReadPolicyGroups

Retrieve Image Assessment Policy Group entities.

GET /container-security/entities/image-assessment-policy-groups/v1

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 read_policy_groups

Parameters

No keywords or arguments accepted.

Code Examples

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.read_policy_groups()
print(response)

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.ReadPolicyGroups()
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadPolicyGroups")
print(response)

Get-FalconContainerPolicyGroup

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/image_assessment_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ImageAssessmentPolicies.ReadPolicyGroups(
    &image_assessment_policies.ReadPolicyGroupsParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.imageAssessmentPolicies.readPolicyGroups();

console.log(response);

use rusty_falcon::apis::image_assessment_policies_api::read_policy_groups;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_policy_groups(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ImageAssessmentPolicies.new

response = api.read_policy_groups

puts response

CreatePolicyGroups

Create Image Assessment Policy Group entities.

POST /container-security/entities/image-assessment-policy-groups/v1

Scope Falcon Container Image: WRITE Consumes · Produces application/json

PEP 8 create_policy_groups

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
conditions	body	list of dictionaries	List of policy conditions to apply. Overriden if `policy_group_data` keyword is used.
description	body	string	Policy group description.
name	body	string	Policy group name.
policy_group_data	body	dictionary	Policy group data in JSON format. Overrides `conditions` keyword if provided.
policy_id	body	string	Policy ID.

Code Examples

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

policy_group_data = {
    "conditions": [
        {}
    ]
}

response = falcon.create_policy_groups(conditions=[{"key": "value"}],
                                       description="string",
                                       name="string",
                                       policy_group_data=policy_group_data,
                                       policy_id="string")
print(response)

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

policy_group_data = {
    "conditions": [
        {}
    ]
}

response = falcon.CreatePolicyGroups(conditions=[{"key": "value"}],
                                     description="string",
                                     name="string",
                                     policy_group_data=policy_group_data,
                                     policy_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "name": "string",
    "policy_group_data": {
        "conditions": ["string"]
    },
    "policy_id": "string"
}

response = falcon.command("CreatePolicyGroups", body=body_payload)
print(response)

New-FalconContainerPolicyGroup -Name "string" `
  -PolicyId "string" `
  -Condition @{}

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/image_assessment_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  name := "string"
  policy_id := "string"

  response, err := client.ImageAssessmentPolicies.CreatePolicyGroups(
    &image_assessment_policies.CreatePolicyGroupsParams{
      Body: &models.ModelsCreateImageGroupRequest{
        Description: &description,
        Name: &name,
        PolicyGroupData: &struct{}{},
        PolicyID: &policy_id,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.imageAssessmentPolicies.createPolicyGroups(
  {
    description: "string",
    name: "string",
    policyGroupData: {
      conditions: []
    },
    policyId: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::image_assessment_policies_api::create_policy_groups;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ModelsCreateImageGroupRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ModelsCreateImageGroupRequest {
        description: Some("string".to_string()),
        name: Some("string".to_string()),
        ..Default::default()
    };

    let response = create_policy_groups(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ImageAssessmentPolicies.new

body = Falcon::ModelsCreateImageGroupRequest.new(
  description: 'string',
  name: 'string',
  policy_group_data: {
    conditions: []
  },
  policy_id: 'string'
)

response = api.create_policy_groups(body)

puts response

DeletePolicyGroup

Delete Image Assessment Policy Group entities

DELETE /container-security/entities/image-assessment-policy-groups/v1

Scope Falcon Container Image: WRITE Consumes · Produces application/json

PEP 8 delete_policy_group

Parameters

Name	Type	Data type	Description
id	query	string	Policy Image group entity UUID.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.delete_policy_group(id="string")
print(response)

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.DeletePolicyGroup(id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("DeletePolicyGroup",
                          id="string")
print(response)

Remove-FalconContainerPolicyGroup -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/image_assessment_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ImageAssessmentPolicies.DeletePolicyGroup(
    &image_assessment_policies.DeletePolicyGroupParams{
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.imageAssessmentPolicies.deletePolicyGroup("string");  // id

console.log(response);

use rusty_falcon::apis::image_assessment_policies_api::delete_policy_group;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_policy_group(
        &falcon.cfg,  // configuration
        "string",  // id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ImageAssessmentPolicies.new

response = api.delete_policy_group('string')

puts response

UpdatePolicyGroups

Update Image Assessment Policy Group entities

PATCH /container-security/entities/image-assessment-policy-groups/v1

Scope Falcon Container Image: WRITE Consumes · Produces application/json

PEP 8 update_policy_groups

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
conditions	body	list of dictionaries	List of policy conditions to apply. Overriden if `policy_group_data` keyword is used.
description	body	string	Policy group description.
id	query	string	Policy Image group entity UUID.
name	body	string	Policy group name.
parameters	query	dictionary	Full query string parameters payload in JSON format.
policy_group_data	body	dictionary	Policy group data in JSON format. Overrides `conditions` keyword if provided.

Code Examples

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

policy_group_data = {
    "conditions": [
        {}
    ]
}

response = falcon.update_policy_groups(conditions=[{"key": "value"}],
                                       description="string",
                                       id="string",
                                       name="string",
                                       policy_group_data=policy_group_data)
print(response)

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

policy_group_data = {
    "conditions": [
        {}
    ]
}

response = falcon.UpdatePolicyGroups(conditions=[{"key": "value"}],
                                     description="string",
                                     id="string",
                                     name="string",
                                     policy_group_data=policy_group_data)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "name": "string",
    "policy_group_data": {
        "conditions": ["string"]
    }
}

response = falcon.command("UpdatePolicyGroups",
                          id="string",
                          body=body_payload)
print(response)

Edit-FalconContainerPolicyGroup -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/image_assessment_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  name := "string"

  response, err := client.ImageAssessmentPolicies.UpdatePolicyGroups(
    &image_assessment_policies.UpdatePolicyGroupsParams{
      Body: &models.ModelsPatchImageGroupRequest{
        Description: &description,
        Name: &name,
        PolicyGroupData: &struct{}{},
      },
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.imageAssessmentPolicies.updatePolicyGroups(
  "string",  // id
  {  // body
      description: "string",
      name: "string",
      policyGroupData: {
        conditions: []
      }
  }
);

console.log(response);

use rusty_falcon::apis::image_assessment_policies_api::update_policy_groups;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ModelsPatchImageGroupRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ModelsPatchImageGroupRequest {
        description: Some("string".to_string()),
        name: Some("string".to_string()),
        ..Default::default()
    };

    let response = update_policy_groups(
        &falcon.cfg,  // configuration
        "string",  // id
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ImageAssessmentPolicies.new

body = Falcon::ModelsPatchImageGroupRequest.new(
  description: 'string',
  name: 'string',
  policy_group_data: {
    conditions: []
  }
)

response = api.update_policy_groups(body, 'string')

puts response

UpdatePolicyPrecedence

Update Image Assessment Policy precedence

POST /container-security/entities/image-assessment-policy-precedence/v1

Scope Falcon Container Image: WRITE Consumes · Produces application/json

PEP 8 update_policy_precedence

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
precedence	body	string or list of strings	List of policy conditions to apply.

Code Examples

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_policy_precedence(precedence=id_list)
print(response)

from falconpy import ImageAssessmentPolicies

falcon = ImageAssessmentPolicies(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.UpdatePolicyPrecedence(precedence=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "precedence": ["string"]
}

response = falcon.command("UpdatePolicyPrecedence", body=body_payload)
print(response)

Set-FalconContainerPolicyPrecedence -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/image_assessment_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ImageAssessmentPolicies.UpdatePolicyPrecedence(
    &image_assessment_policies.UpdatePolicyPrecedenceParams{
      Body: &models.ModelsAPIPrecedenceRequest{
        Precedence: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.imageAssessmentPolicies.updatePolicyPrecedence(
  {
    precedence: []
}  // body
);

console.log(response);

use rusty_falcon::apis::filevantage_api::update_policy_precedence;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = update_policy_precedence(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ImageAssessmentPolicies.new

body = Falcon::ModelsAPIPrecedenceRequest.new(
  precedence: []
)

response = api.update_policy_precedence(body)

puts response

Image Assessment Policies

Table of Contents

ReadPolicies

Parameters

Code Examples

CreatePolicies

Parameters

Code Examples

DeletePolicy

Parameters

Code Examples

UpdatePolicies

Parameters

Code Examples

ReadPolicyExclusions

Parameters

Code Examples

UpdatePolicyExclusions

Parameters

Code Examples

ReadPolicyGroups

Parameters

Code Examples

CreatePolicyGroups

Parameters

Code Examples

DeletePolicyGroup

Parameters

Code Examples

UpdatePolicyGroups

Parameters

Code Examples

UpdatePolicyPrecedence

Parameters

Code Examples