IOA Exclusions

The IOA Exclusions service collection provides operations for managing Indicator of Attack exclusion rules. Create, update, delete, and query standard IOA exclusions, as well as manage Self Service IOA Exclusions including aggregates, reports, matched rules, and default rule retrieval.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

This service collection has code examples posted to the repository.

Operation	Description
createIOAExclusionsV1 `create_exclusions`	Create the IOA exclusions
deleteIOAExclusionsV1 `delete_exclusions`	Delete the IOA exclusions by id
getIOAExclusionsV1 `get_exclusions`	Get a set of IOA Exclusions by specifying their IDs
queryIOAExclusionsV1 `query_exclusions`	Search for IOA exclusions.
ss-ioa-exclusions.aggregates.v2 `get_ss_exclusion_aggregates`	Get Self Service IOA Exclusion aggregates as specified via json in the request body.
ss-ioa-exclusions.create.v2 `create_ss_exclusions`	Create new Self Service IOA Exclusions.
ss-ioa-exclusions.delete.v2 `delete_ss_exclusions`	Delete the Self Service IOA Exclusions rule by id.
ss-ioa-exclusions.get-reports.v2 `get_ss_exclusion_reports_v2`	Create a report of Self Service IOA Exclusions scoped by the given filters
ss-ioa-exclusions.get.v2 `get_ss_exclusion_rules_v2`	Get the Self Service IOA Exclusions rules by id.
ss-ioa-exclusions.matched-rule.v2 `get_ss_exclusion_matched_rules`	Get Self Service IOA Exclusions rules for matched IFN/CLI for child, parent and grandparent
ss-ioa-exclusions.new-rules.v2 `get_default_ss_exclusions`	Get defaults for Self Service IOA Exclusions based on provided IFN/CLI for child, parent and grandparent.
ss-ioa-exclusions.search.v2 `query_ss_exclusions`	Search for Self Service IOA Exclusions.
ss-ioa-exclusions.update.v2 `update_ss_exclusions`	Update the Self Service IOA Exclusions rule by id.
updateIOAExclusionsV1 `update_exclusions`	Update the IOA exclusions

createIOAExclusionsV1

Create the IOA exclusions

Method POST

Route /policy/entities/ioa-exclusions/v1

Scope IOA Exclusions: WRITE

PEP 8 create_exclusions

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

cl_regex body · string

Command line regex value for the exclusion.

comment body · string

Comment describing why the exclusion is entered.

description body · string

Description of the exclusion.

detection_json body · string

Detection JSON payload for the exclusion.

groups body · array

Group IDs to exclude.

ifn_regex body · string

Image file name regex value for the exclusion.

name body · string

Name of the exclusion.

pattern_id body · string

Pattern ID associated with the exclusion.

pattern_name body · string

Pattern name associated with the exclusion.

Code Examples

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.create_exclusions(cl_regex="string",
                                    comment="string",
                                    description="string",
                                    detection_json="string",
                                    groups=id_list,
                                    ifn_regex="string",
                                    name="string",
                                    pattern_id="string",
                                    pattern_name="string")
print(response)

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.createIOAExclusionsV1(cl_regex="string",
                                        comment="string",
                                        description="string",
                                        detection_json="string",
                                        groups=id_list,
                                        ifn_regex="string",
                                        name="string",
                                        pattern_id="string",
                                        pattern_name="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "cl_regex": "string",
    "comment": "string",
    "description": "string",
    "detection_json": "string",
    "groups": ["string"],
    "ifn_regex": "string",
    "name": "string",
    "pattern_id": "string",
    "pattern_name": "string"
}

response = falcon.command("createIOAExclusionsV1", body=body_payload)
print(response)

New-FalconIoaExclusion -Name "string" `
  -PatternId "string" `
  -PatternName "string" `
  -ClRegex "string" `
  -IfnRegex "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioa_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cl_regex := "string"
  comment := "string"
  description := "string"
  detection_json := "string"
  ifn_regex := "string"
  name := "string"
  pattern_id := "string"
  pattern_name := "string"

  response, err := client.IoaExclusions.CreateIOAExclusionsV1(
    &ioa_exclusions.CreateIOAExclusionsV1Params{
      Body: &models.IoaExclusionsIoaExclusionCreateReqV1{
        ClRegex: &cl_regex,
        Comment: &comment,
        Description: &description,
        DetectionJson: &detection_json,
        Groups: []string{"string"},
        IfnRegex: &ifn_regex,
        Name: &name,
        PatternID: &pattern_id,
        PatternName: &pattern_name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioaExclusions.createIOAExclusionsV1(
  {
    clRegex: "string",
    comment: "string",
    description: "string",
    detectionJson: "string",
    groups: [],
    ifnRegex: "string",
    name: "string",
    patternId: "string",
    patternName: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::ioa_exclusions_api::create_ioa_exclusions_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::IoaExclusionsIoaExclusionCreateReqV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = IoaExclusionsIoaExclusionCreateReqV1 {
        cl_regex: Some("string".to_string()),
        description: Some("string".to_string()),
        detection_json: Some("string".to_string()),
        groups: vec!["string".to_string()],
        ifn_regex: Some("string".to_string()),
        name: Some("string".to_string()),
        pattern_id: Some("string".to_string()),
        pattern_name: Some("string".to_string()),
        ..Default::default()
    };

    let response = create_ioa_exclusions_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::IoaExclusions.new

body = Falcon::IoaExclusionsIoaExclusionCreateReqV1.new(
  cl_regex: 'string',
  comment: 'string',
  description: 'string',
  detection_json: 'string',
  groups: [],
  ifn_regex: 'string',
  name: 'string',
  pattern_id: 'string',
  pattern_name: 'string'
)

response = api.create_ioa_exclusions_v1(body)

puts response

Responses

[
  {
    "applied_globally": false,
    "cl_regex": "string",
    "created_by": "string",
    "created_on": "string",
    "description": "string",
    "detection_json": "string",
    "groups": [],
    "id": "string",
    "ifn_regex": "string",
    "last_modified": "string",
    "modified_by": "string",
    "name": "string",
    "pattern_id": "string",
    "pattern_name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "applied_globally": false,
      "cl_regex": "string",
      "created_by": "string",
      "created_on": "string",
      "description": "string",
      "detection_json": "string",
      "groups": [],
      "id": "string",
      "ifn_regex": "string",
      "last_modified": "string",
      "modified_by": "string",
      "name": "string",
      "pattern_id": "string",
      "pattern_name": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "applied_globally": false,
      "cl_regex": "string",
      "created_by": "string",
      "created_on": "string",
      "description": "string",
      "detection_json": "string",
      "groups": [],
      "id": "string",
      "ifn_regex": "string",
      "last_modified": "string",
      "modified_by": "string",
      "name": "string",
      "pattern_id": "string",
      "pattern_name": "string"
    }
  ]
}

deleteIOAExclusionsV1

Delete the IOA exclusions by id

Method DELETE

Route /policy/entities/ioa-exclusions/v1

Scope IOA Exclusions: WRITE

PEP 8 delete_exclusions

Parameters

ids query · string or list of strings

The ids of the exclusions to delete

comment query · string

Explains why this exclusions was deleted

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_exclusions(comment="string", ids=id_list)
print(response)

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteIOAExclusionsV1(comment="string", ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deleteIOAExclusionsV1",
                          ids=id_list,
                          comment="string")
print(response)

Remove-FalconIoaExclusion -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioa_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"

  response, err := client.IoaExclusions.DeleteIOAExclusionsV1(
    &ioa_exclusions.DeleteIOAExclusionsV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Comment: &comment,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioaExclusions.deleteIOAExclusionsV1(
  ["ID1", "ID2", "ID3"],  // ids
  "string"  // comment
);

console.log(response);

use rusty_falcon::apis::ioa_exclusions_api::delete_ioa_exclusions_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_ioa_exclusions_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
        Some("string"),  // comment
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::IoaExclusions.new

response = api.delete_ioa_exclusions_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

getIOAExclusionsV1

Get a set of IOA Exclusions by specifying their IDs

Method GET

Route /policy/entities/ioa-exclusions/v1

Scope IOA Exclusions: READ

PEP 8 get_exclusions

Parameters

ids query · string or list of strings

The ids of the exclusions to retrieve

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_exclusions(ids=id_list)
print(response)

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getIOAExclusionsV1(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getIOAExclusionsV1",
                          ids=id_list)
print(response)

Get-FalconIoaExclusion -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioa_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.IoaExclusions.GetIOAExclusionsV1(
    &ioa_exclusions.GetIOAExclusionsV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioaExclusions.getIOAExclusionsV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::ioa_exclusions_api::get_ioa_exclusions_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_ioa_exclusions_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::IoaExclusions.new

response = api.get_ioa_exclusions_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "applied_globally": false,
    "cl_regex": "string",
    "created_by": "string",
    "created_on": "string",
    "description": "string",
    "detection_json": "string",
    "groups": [],
    "id": "string",
    "ifn_regex": "string",
    "last_modified": "string",
    "modified_by": "string",
    "name": "string",
    "pattern_id": "string",
    "pattern_name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "applied_globally": false,
      "cl_regex": "string",
      "created_by": "string",
      "created_on": "string",
      "description": "string",
      "detection_json": "string",
      "groups": [],
      "id": "string",
      "ifn_regex": "string",
      "last_modified": "string",
      "modified_by": "string",
      "name": "string",
      "pattern_id": "string",
      "pattern_name": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "applied_globally": false,
      "cl_regex": "string",
      "created_by": "string",
      "created_on": "string",
      "description": "string",
      "detection_json": "string",
      "groups": [],
      "id": "string",
      "ifn_regex": "string",
      "last_modified": "string",
      "modified_by": "string",
      "name": "string",
      "pattern_id": "string",
      "pattern_name": "string"
    }
  ]
}

queryIOAExclusionsV1

Search for IOA exclusions.

Method GET

Route /policy/queries/ioa-exclusions/v1

Scope IOA Exclusions: READ

PEP 8 query_exclusions

Parameters

filter query · string

The filter expression that should be used to limit the results. FQL syntax. Available filters:

Available values (8)

`name`	`pattern_id`	`pattern_name`
`applied_globally`	`created_on`	`created_by`
`last_modified`	`modified_by`

ifn_regex query · string

The ifn_regex expression to filter exclusions by, used alongside expressions specified in the filter query parameter.

cl_regex query · string

The cl_regex expression to filter exclusions by, used alongside expressions specified in the filter query parameter.

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return. [1-500]

sort query · string

The property to sort by. FQL syntax. (e.g. last_behavior.asc) Available sort fields:

Available values (16)

`applied_globally.asc`	`applied_globally.desc`	`created_by.asc`
`created_by.desc`	`created_on.asc`	`created_on.desc`
`last_modified.asc`	`last_modified.desc`	`modified_by.asc`
`modified_by.desc`	`name.asc`	`name.desc`
`pattern_id.asc`	`pattern_id.desc`	`pattern_name.asc`
`pattern_name.desc`

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.query_exclusions(cl_regex="string",
                                   filter="string",
                                   ifn_regex="string",
                                   limit=integer,
                                   offset=integer,
                                   sort="string")
print(response)

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.queryIOAExclusionsV1(cl_regex="string",
                                       filter="string",
                                       ifn_regex="string",
                                       limit=integer,
                                       offset=integer,
                                       sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryIOAExclusionsV1",
                          filter="string",
                          ifn_regex="string",
                          cl_regex="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

Get-FalconIoaExclusion -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioa_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  ifnRegex := "string"
  clRegex := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.IoaExclusions.QueryIOAExclusionsV1(
    &ioa_exclusions.QueryIOAExclusionsV1Params{
      Filter: &filter,
      IfnRegex: &ifnRegex,
      ClRegex: &clRegex,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioaExclusions.queryIOAExclusionsV1(
  "string",  // filter
  "string",  // ifnRegex
  "string",  // clRegex
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::ioa_exclusions_api::query_ioa_exclusions_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_ioa_exclusions_v1(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // ifn_regex
        Some("string"),  // cl_regex
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::IoaExclusions.new

response = api.query_ioa_exclusions_v1(filter: 'string',
                                       ifn_regex: 'string',
                                       cl_regex: 'string',
                                       offset: integer,
                                       limit: integer,
                                       sort: 'string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

ss-ioa-exclusions.aggregates.v2

Get Self Service IOA Exclusion aggregates as specified via json in the request body.

Method POST

Route /exclusions/aggregates/ss-ioa-exclusions/GET/v2

Scope IOA Exclusions: WRITE

PEP 8 get_ss_exclusion_aggregates

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

date_ranges body · array

Date range timeframe.

exclude body · string

Fields to exclude from results.

extended_bounds body · object

Extended bounds for histogram aggregations.

field body · string

Field to aggregate on.

filter body · string

filters_spec body · object

Additional filter specifications.

from body · integer

Starting index of overall result set.

include body · string

Fields to include in results.

interval body · string

max_doc_count body · integer

Maximum number of documents per bucket.

min_doc_count body · integer

Minimum number of documents per bucket.

missing body · string

Value to use for documents missing the field.

name body · string

Name of the aggregation.

percents body · array

Percentile values to calculate.

q body · string

Full text search query.

ranges body · array

Range boundaries for range aggregations.

size body · integer

Maximum number of records to return.

sort body · string

The field to sort on.

sub_aggregates body · array

Nested aggregation definitions.

time_zone body · string

Time zone for date histogram aggregations.

type body · string

Type of aggregation to perform.

ifn_regex query · string

The ifn_regex expression to filter exclusion aggregations by, used alongside filter expressions provided in the request body.

cl_regex query · string

The cl_regex expression to filter exclusion aggregations by, used alongside filter expressions provided in the request body.

parent_ifn_regex query · string

The parent_ifn_regex expression to filter exclusion aggregations by, used alongside filter expressions provided in the request body.

parent_cl_regex query · string

The parent_cl_regex expression to filter exclusion aggregations by, used alongside filter expressions provided in the request body.

grandparent_ifn_regex query · string

The grandparent_ifn_regex expression to filter exclusion aggregations by, used alongside filter expressions provided in the request body.

grandparent_cl_regex query · string

The grandparent_cl_regex expression to filter exclusion aggregations by, used alongside filter expressions provided in the request body.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

extended_bounds = {
    "max": "string",
    "min": "string"
}

filters_spec = {
    "filters": {
        "additionalProp1": "string",
        "additionalProp2": "string",
        "additionalProp3": "string"
    },
    "other_bucket": True,
    "other_bucket_key": "string"
}

ranges = [
    {
        "From": 0,
        "To": 0
    }
]

response = falcon.get_ss_exclusion_aggregates(ifn_regex="string",
                                              cl_regex="string",
                                              parent_ifn_regex="string",
                                              parent_cl_regex="string",
                                              grandparent_ifn_regex="string",
                                              grandparent_cl_regex="string",
                                              date_ranges=date_ranges,
                                              exclude="string",
                                              extended_bounds=extended_bounds,
                                              field="string",
                                              filters_spec=filters_spec,
                                              from=integer,
                                              include="string",
                                              max_doc_count=integer,
                                              min_doc_count=integer,
                                              missing="string",
                                              name="string",
                                              percents=[integer],
                                              q="string",
                                              ranges=ranges,
                                              size=integer,
                                              sort="string",
                                              sub_aggregates=["string"],
                                              time_zone="string",
                                              type="string")
print(response)

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

extended_bounds = {
    "max": "string",
    "min": "string"
}

filters_spec = {
    "filters": {
        "additionalProp1": "string",
        "additionalProp2": "string",
        "additionalProp3": "string"
    },
    "other_bucket": True,
    "other_bucket_key": "string"
}

ranges = [
    {
        "From": 0,
        "To": 0
    }
]

response = falcon.ss_ioa_exclusions_aggregates_v2(ifn_regex="string",
                                                  cl_regex="string",
                                                  parent_ifn_regex="string",
                                                  parent_cl_regex="string",
                                                  grandparent_ifn_regex="string",
                                                  grandparent_cl_regex="string",
                                                  date_ranges=date_ranges,
                                                  exclude="string",
                                                  extended_bounds=extended_bounds,
                                                  field="string",
                                                  filters_spec=filters_spec,
                                                  from=integer,
                                                  include="string",
                                                  max_doc_count=integer,
                                                  min_doc_count=integer,
                                                  missing="string",
                                                  name="string",
                                                  percents=[integer],
                                                  q="string",
                                                  ranges=ranges,
                                                  size=integer,
                                                  sort="string",
                                                  sub_aggregates=["string"],
                                                  time_zone="string",
                                                  type="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "date_ranges": [
        {
            "from": "string",
            "to": "string"
        }
    ],
    "exclude": "string",
    "extended_bounds": {
        "max": "string",
        "min": "string"
    },
    "field": "string",
    "filter": "string",
    "filters_spec": {
        "filters": {},
        "other_bucket": boolean,
        "other_bucket_key": "string"
    },
    "from": integer,
    "include": "string",
    "interval": "string",
    "max_doc_count": integer,
    "min_doc_count": integer,
    "missing": "string",
    "name": "string",
    "percents": ["string"],
    "q": "string",
    "ranges": [
        {
            "from": integer,
            "to": integer
        }
    ],
    "size": integer,
    "sort": "string",
    "sub_aggregates": [
        {
            "date_ranges": [
                {
                    "from": "string",
                    "to": "string"
                }
            ],
            "exclude": "string",
            "extended_bounds": {
                "max": "string",
                "min": "string"
            },
            "field": "string",
            "filter": "string",
            "filters_spec": {
                "filters": {},
                "other_bucket": boolean,
                "other_bucket_key": "string"
            },
            "from": integer,
            "include": "string",
            "interval": "string",
            "max_doc_count": integer,
            "min_doc_count": integer,
            "missing": "string",
            "name": "string",
            "percents": ["string"],
            "q": "string",
            "ranges": [
                {
                    "from": integer,
                    "to": integer
                }
            ],
            "size": integer,
            "sort": "string",
            "sub_aggregates": [
                {
                    "date_ranges": ["string"],
                    "exclude": "string",
                    "extended_bounds": {},
                    "field": "string",
                    "filter": "string",
                    "filters_spec": {},
                    "from": integer,
                    "include": "string",
                    "interval": "string",
                    "max_doc_count": integer,
                    "min_doc_count": integer,
                    "missing": "string",
                    "name": "string",
                    "percents": ["string"],
                    "q": "string",
                    "ranges": ["string"],
                    "size": integer,
                    "sort": "string",
                    "sub_aggregates": ["string"],
                    "time_zone": "string",
                    "type": "string"
                }
            ],
            "time_zone": "string",
            "type": "string"
        }
    ],
    "time_zone": "string",
    "type": "string"
}

response = falcon.command("ss_ioa_exclusions_aggregates_v2",
                          ifn_regex="string",
                          cl_regex="string",
                          parent_ifn_regex="string",
                          parent_cl_regex="string",
                          grandparent_ifn_regex="string",
                          grandparent_cl_regex="string",
                          body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioa_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  from := "string"
  to := "string"
  exclude := "string"
  field := "string"
  filter := "string"
  from := integer
  include := "string"
  interval := "string"
  max_doc_count := integer
  min_doc_count := integer
  missing := "string"
  name := "string"
  q := "string"
  From := integer
  To := integer
  size := integer
  sort := "string"
  time_zone := "string"
  typeVar := "string"
  ifnRegex := "string"
  clRegex := "string"
  parentIfnRegex := "string"
  parentClRegex := "string"
  grandparentIfnRegex := "string"
  grandparentClRegex := "string"

  response, err := client.IoaExclusions.SsIoaExclusionsAggregatesV2(
    &ioa_exclusions.SsIoaExclusionsAggregatesV2Params{
      Body: &models.MsaAggregateQueryRequest{
        DateRanges: []interface{}{
          {
          From: &from,
          To: &to,
          },
        },
        Exclude: &exclude,
        ExtendedBounds: &struct{}{},
        Field: &field,
        Filter: &filter,
        FiltersSpec: &struct{}{},
        From: &from,
        Include: &include,
        Interval: &interval,
        MaxDocCount: &max_doc_count,
        MinDocCount: &min_doc_count,
        Missing: &missing,
        Name: &name,
        Percents: []interface{}{},
        Q: &q,
        Ranges: []interface{}{
          {
          From: &From,
          To: &To,
          },
        },
        Size: &size,
        Sort: &sort,
        SubAggregates: []interface{}{
          {
          DateRanges: []interface{}{
            {
            From: &from,
            To: &to,
            },
          },
          Exclude: &exclude,
          ExtendedBounds: &struct{}{},
          Field: &field,
          Filter: &filter,
          FiltersSpec: &struct{}{},
          From: &from,
          Include: &include,
          Interval: &interval,
          MaxDocCount: &max_doc_count,
          MinDocCount: &min_doc_count,
          Missing: &missing,
          Name: &name,
          Percents: []interface{}{},
          Q: &q,
          Ranges: []interface{}{
            {
            From: &From,
            To: &To,
            },
          },
          Size: &size,
          Sort: &sort,
          SubAggregates: []interface{}{
            {
            DateRanges: []interface{}{},
            Exclude: &exclude,
            ExtendedBounds: &struct{}{},
            Field: &field,
            Filter: &filter,
            FiltersSpec: &struct{}{},
            From: &from,
            Include: &include,
            Interval: &interval,
            MaxDocCount: &max_doc_count,
            MinDocCount: &min_doc_count,
            Missing: &missing,
            Name: &name,
            Percents: []interface{}{},
            Q: &q,
            Ranges: []interface{}{},
            Size: &size,
            Sort: &sort,
            SubAggregates: []interface{}{},
            TimeZone: &time_zone,
            Type: &typeVar,
            },
          },
          TimeZone: &time_zone,
          Type: &typeVar,
          },
        },
        TimeZone: &time_zone,
        Type: &typeVar,
      },
      IfnRegex: &ifnRegex,
      ClRegex: &clRegex,
      ParentIfnRegex: &parentIfnRegex,
      ParentClRegex: &parentClRegex,
      GrandparentIfnRegex: &grandparentIfnRegex,
      GrandparentClRegex: &grandparentClRegex,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioaExclusions.ssIoaExclusionsAggregatesV2(
  {  // body
      dateRanges: [{
          from: "string",
          to: "string"
        }],
      exclude: "string",
      extendedBounds: {
        max: "string",
        min: "string"
      },
      field: "string",
      filter: "string",
      filtersSpec: {
        filters: {},
        otherBucket: boolean,
        otherBucketKey: "string"
      },
      from: integer,
      include: "string",
      interval: "string",
      maxDocCount: integer,
      minDocCount: integer,
      missing: "string",
      name: "string",
      percents: [],
      q: "string",
      ranges: [{
          From: integer,
          To: integer
        }],
      size: integer,
      sort: "string",
      subAggregates: [{
          dateRanges: [{
              from: "string",
              to: "string"
            }],
          exclude: "string",
          extendedBounds: {
            max: "string",
            min: "string"
          },
          field: "string",
          filter: "string",
          filtersSpec: {
            filters: {},
            otherBucket: boolean,
            otherBucketKey: "string"
          },
          from: integer,
          include: "string",
          interval: "string",
          maxDocCount: integer,
          minDocCount: integer,
          missing: "string",
          name: "string",
          percents: [],
          q: "string",
          ranges: [{
              From: integer,
              To: integer
            }],
          size: integer,
          sort: "string",
          subAggregates: [{
              dateRanges: [],
              exclude: "string",
              extendedBounds: {},
              field: "string",
              filter: "string",
              filtersSpec: {},
              from: integer,
              include: "string",
              interval: "string",
              maxDocCount: integer,
              minDocCount: integer,
              missing: "string",
              name: "string",
              percents: [],
              q: "string",
              ranges: [],
              size: integer,
              sort: "string",
              subAggregates: [],
              timeZone: "string",
              type: "string"
            }],
          timeZone: "string",
          type: "string"
        }],
      timeZone: "string",
      type: "string"
  },
  "string",  // ifnRegex
  "string",  // clRegex
  "string",  // parentIfnRegex
  "string",  // parentClRegex
  "string",  // grandparentIfnRegex
  "string"  // grandparentClRegex
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::IoaExclusions.new

body = {
  date_ranges: [{
      from: 'string',
      to: 'string'
    }],
  exclude: 'string',
  extended_bounds: {
    max: 'string',
    min: 'string'
  },
  field: 'string',
  filter: 'string',
  filters_spec: {
    filters: {},
    other_bucket: boolean,
    other_bucket_key: 'string'
  },
  from: integer,
  include: 'string',
  interval: 'string',
  max_doc_count: integer,
  min_doc_count: integer,
  missing: 'string',
  name: 'string',
  percents: [],
  q: 'string',
  ranges: [{
      From: integer,
      To: integer
    }],
  size: integer,
  sort: 'string',
  sub_aggregates: [{
      date_ranges: [{
          from: 'string',
          to: 'string'
        }],
      exclude: 'string',
      extended_bounds: {
        max: 'string',
        min: 'string'
      },
      field: 'string',
      filter: 'string',
      filters_spec: {
        filters: {},
        other_bucket: boolean,
        other_bucket_key: 'string'
      },
      from: integer,
      include: 'string',
      interval: 'string',
      max_doc_count: integer,
      min_doc_count: integer,
      missing: 'string',
      name: 'string',
      percents: [],
      q: 'string',
      ranges: [{
          From: integer,
          To: integer
        }],
      size: integer,
      sort: 'string',
      sub_aggregates: [{
          date_ranges: [],
          exclude: 'string',
          extended_bounds: {},
          field: 'string',
          filter: 'string',
          filters_spec: {},
          from: integer,
          include: 'string',
          interval: 'string',
          max_doc_count: integer,
          min_doc_count: integer,
          missing: 'string',
          name: 'string',
          percents: [],
          q: 'string',
          ranges: [],
          size: integer,
          sort: 'string',
          sub_aggregates: [],
          time_zone: 'string',
          type: 'string'
        }],
      time_zone: 'string',
      type: 'string'
    }],
  time_zone: 'string',
  type: 'string'
}

response = api.ss_ioa_exclusions_aggregates_v2(body)

puts response

Responses

[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ss-ioa-exclusions.create.v2

Create new Self Service IOA Exclusions.

Method POST

Route /exclusions/entities/ss-ioa-exclusions/v2

Scope IOA Exclusions: WRITE

PEP 8 create_ss_exclusions

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

exclusions body · array

List of exclusion definitions to create.

Code Examples

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

exclusions = [
    {
        "cl_regex": "string",
        "comment": "string",
        "description": "string",
        "detection_json": "string",
        "grandparent_cl_regex": "string",
        "grandparent_ifn_regex": "string",
        "host_groups": [
            "string"
        ],
        "ifn_regex": "string",
        "name": "string",
        "parent_cl_regex": "string",
        "parent_ifn_regex": "string",
        "pattern_id": "string",
        "pattern_name": "string"
    }
]

response = falcon.create_ss_exclusions(exclusions=exclusions)
print(response)

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

exclusions = [
    {
        "cl_regex": "string",
        "comment": "string",
        "description": "string",
        "detection_json": "string",
        "grandparent_cl_regex": "string",
        "grandparent_ifn_regex": "string",
        "host_groups": [
            "string"
        ],
        "ifn_regex": "string",
        "name": "string",
        "parent_cl_regex": "string",
        "parent_ifn_regex": "string",
        "pattern_id": "string",
        "pattern_name": "string"
    }
]

response = falcon.ss_ioa_exclusions_create_v2(exclusions=exclusions)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "exclusions": [
        {
            "cl_regex": "string",
            "comment": "string",
            "description": "string",
            "detection_json": "string",
            "grandparent_cl_regex": "string",
            "grandparent_ifn_regex": "string",
            "host_groups": ["string"],
            "ifn_regex": "string",
            "name": "string",
            "parent_cl_regex": "string",
            "parent_ifn_regex": "string",
            "pattern_id": "string",
            "pattern_name": "string"
        }
    ]
}

response = falcon.command("ss_ioa_exclusions_create_v2", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioa_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cl_regex := "string"
  comment := "string"
  description := "string"
  detection_json := "string"
  grandparent_cl_regex := "string"
  grandparent_ifn_regex := "string"
  ifn_regex := "string"
  name := "string"
  parent_cl_regex := "string"
  parent_ifn_regex := "string"
  pattern_id := "string"
  pattern_name := "string"

  response, err := client.IoaExclusions.SsIoaExclusionsCreateV2(
    &ioa_exclusions.SsIoaExclusionsCreateV2Params{
      Body: &models.DomainSsIoaExclusionsCreateReqV2{
        Exclusions: []interface{}{
          {
          ClRegex: &cl_regex,
          Comment: &comment,
          Description: &description,
          DetectionJson: &detection_json,
          GrandparentClRegex: &grandparent_cl_regex,
          GrandparentIfnRegex: &grandparent_ifn_regex,
          HostGroups: []string{"string"},
          IfnRegex: &ifn_regex,
          Name: &name,
          ParentClRegex: &parent_cl_regex,
          ParentIfnRegex: &parent_ifn_regex,
          PatternID: &pattern_id,
          PatternName: &pattern_name,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioaExclusions.ssIoaExclusionsCreateV2(
  {
    exclusions: [{
        clRegex: "string",
        comment: "string",
        description: "string",
        detectionJson: "string",
        grandparentClRegex: "string",
        grandparentIfnRegex: "string",
        hostGroups: [],
        ifnRegex: "string",
        name: "string",
        parentClRegex: "string",
        parentIfnRegex: "string",
        patternId: "string",
        patternName: "string"
      }]
}  // body
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::IoaExclusions.new

body = Falcon::DomainSsIoaExclusionsCreateReqV2.new(
  exclusions: [{
      cl_regex: 'string',
      comment: 'string',
      description: 'string',
      detection_json: 'string',
      grandparent_cl_regex: 'string',
      grandparent_ifn_regex: 'string',
      host_groups: [],
      ifn_regex: 'string',
      name: 'string',
      parent_cl_regex: 'string',
      parent_ifn_regex: 'string',
      pattern_id: 'string',
      pattern_name: 'string'
    }]
)

response = api.ss_ioa_exclusions_create_v2(body)

puts response

Responses

[
  {
    "applied_globally": false,
    "cl_regex": "string",
    "comment": "string",
    "created_by": "string",
    "created_on": "string",
    "description": "string",
    "detection_json": "string",
    "grandparent_cl_regex": "string",
    "grandparent_ifn_regex": "string",
    "host_groups": [],
    "id": "string",
    "ifn_regex": "string",
    "last_modified": "string",
    "modified_by": "string",
    "name": "string",
    "parent_cl_regex": "string",
    "parent_ifn_regex": "string",
    "pattern_id": "string",
    "pattern_name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ss-ioa-exclusions.delete.v2

Delete the Self Service IOA Exclusions rule by id.

Method DELETE

Route /exclusions/entities/ss-ioa-exclusions/v2

Scope IOA Exclusions: WRITE

PEP 8 delete_ss_exclusions

Parameters

ids query · string or list of strings

The ids of the exclusions to delete

comment query · string

The comment why these ss ioa exclusions were deleted

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_ss_exclusions(ids=id_list, comment="string")
print(response)

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ss_ioa_exclusions_delete_v2(ids=id_list, comment="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ss_ioa_exclusions_delete_v2",
                          ids=id_list,
                          comment="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioa_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"

  response, err := client.IoaExclusions.SsIoaExclusionsDeleteV2(
    &ioa_exclusions.SsIoaExclusionsDeleteV2Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Comment: &comment,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioaExclusions.ssIoaExclusionsDeleteV2(
  ["ID1", "ID2", "ID3"],  // ids
  "string"  // comment
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::IoaExclusions.new

response = api.ss_ioa_exclusions_delete_v2(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "applied_globally": false,
    "cl_regex": "string",
    "comment": "string",
    "created_by": "string",
    "created_on": "string",
    "description": "string",
    "detection_json": "string",
    "grandparent_cl_regex": "string",
    "grandparent_ifn_regex": "string",
    "host_groups": [],
    "id": "string",
    "ifn_regex": "string",
    "last_modified": "string",
    "modified_by": "string",
    "name": "string",
    "parent_cl_regex": "string",
    "parent_ifn_regex": "string",
    "pattern_id": "string",
    "pattern_name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ss-ioa-exclusions.get-reports.v2

Create a report of Self Service IOA Exclusions scoped by the given filters

Method POST

Route /exclusions/entities/ss-ioa-exclusions/reports/v2

Scope IOA Exclusions: WRITE

PEP 8 get_ss_exclusion_reports_v2

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

report_format body · string

Format of the report to generate.

search body · object

Search criteria including filter and sort options.

Code Examples

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

search = {
    "filter": "string",
    "sort": "string"
}

response = falcon.get_ss_exclusion_reports_v2(report_format="string",
                                              search=search)
print(response)

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

search = {
    "filter": "string",
    "sort": "string"
}

response = falcon.ss_ioa_exclusions_get_reports_v2(report_format="string",
                                                   search=search)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "report_format": "string",
    "search": {
        "filter": "string",
        "sort": "string"
    }
}

response = falcon.command("ss_ioa_exclusions_get_reports_v2", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioa_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  report_format := "string"

  response, err := client.IoaExclusions.SsIoaExclusionsGetReportsV2(
    &ioa_exclusions.SsIoaExclusionsGetReportsV2Params{
      Body: &models.DomainExclusionsReportRequest{
        ReportFormat: &report_format,
        Search: &struct{}{},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioaExclusions.ssIoaExclusionsGetReportsV2(
  {
    reportFormat: "string",
    search: {
      filter: "string",
      sort: "string"
    }
}  // body
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::IoaExclusions.new

body = Falcon::DomainExclusionsReportRequest.new(
  report_format: 'string',
  search: {
    filter: 'string',
    sort: 'string'
  }
)

response = api.ss_ioa_exclusions_get_reports_v2(body)

puts response

Responses

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ss-ioa-exclusions.get.v2

Get the Self Service IOA Exclusions rules by id.

Method GET

Route /exclusions/entities/ss-ioa-exclusions/v2

Scope IOA Exclusions: READ

PEP 8 get_ss_exclusion_rules_v2

Parameters

ids query · string or list of strings

The ids of the exclusions to retrieve

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_ss_exclusion_rules_v2(ids=id_list)
print(response)

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ss_ioa_exclusions_get_v2(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ss_ioa_exclusions_get_v2",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioa_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.IoaExclusions.SsIoaExclusionsGetV2(
    &ioa_exclusions.SsIoaExclusionsGetV2Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioaExclusions.ssIoaExclusionsGetV2(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::IoaExclusions.new

response = api.ss_ioa_exclusions_get_v2(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "applied_globally": false,
    "cl_regex": "string",
    "comment": "string",
    "created_by": "string",
    "created_on": "string",
    "description": "string",
    "detection_json": "string",
    "grandparent_cl_regex": "string",
    "grandparent_ifn_regex": "string",
    "host_groups": [],
    "id": "string",
    "ifn_regex": "string",
    "last_modified": "string",
    "modified_by": "string",
    "name": "string",
    "parent_cl_regex": "string",
    "parent_ifn_regex": "string",
    "pattern_id": "string",
    "pattern_name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ss-ioa-exclusions.matched-rule.v2

Get Self Service IOA Exclusions rules for matched IFN/CLI for child, parent and grandparent

Method POST

Route /exclusions/entities/ss-ioa-matched-rules/v2

Scope IOA Exclusions: WRITE

PEP 8 get_ss_exclusion_matched_rules

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

aid body · string

Agent ID to match exclusions against.

command_line body · string

Command line of the child process.

grandparent_command_line body · string

Command line of the grandparent process.

grandparent_image_file_name body · string

Image file name of the grandparent process.

image_file_name body · string

Image file name of the child process.

parent_command_line body · string

Command line of the parent process.

parent_image_file_name body · string

Image file name of the parent process.

pattern_ids body · array

Pattern IDs to match exclusions against.

Code Examples

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_ss_exclusion_matched_rules(aid="string",
                                                 command_line="string",
                                                 grandparent_command_line="string",
                                                 grandparent_image_file_name="string",
                                                 image_file_name="string",
                                                 parent_command_line="string",
                                                 parent_image_file_name="string",
                                                 pattern_ids=id_list)
print(response)

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ss_ioa_exclusions_matched_rule_v2(aid="string",
                                                    command_line="string",
                                                    grandparent_command_line="string",
                                                    grandparent_image_file_name="string",
                                                    image_file_name="string",
                                                    parent_command_line="string",
                                                    parent_image_file_name="string",
                                                    pattern_ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "aid": "string",
    "command_line": "string",
    "grandparent_command_line": "string",
    "grandparent_image_file_name": "string",
    "image_file_name": "string",
    "parent_command_line": "string",
    "parent_image_file_name": "string",
    "pattern_ids": ["string"]
}

response = falcon.command("ss_ioa_exclusions_matched_rule_v2", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioa_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  aid := "string"
  command_line := "string"
  grandparent_command_line := "string"
  grandparent_image_file_name := "string"
  image_file_name := "string"
  parent_command_line := "string"
  parent_image_file_name := "string"

  response, err := client.IoaExclusions.SsIoaExclusionsMatchedRuleV2(
    &ioa_exclusions.SsIoaExclusionsMatchedRuleV2Params{
      Body: &models.DomainSsIoaExclusionsMatchedRuleReqV2{
        Aid: &aid,
        CommandLine: &command_line,
        GrandparentCommandLine: &grandparent_command_line,
        GrandparentImageFileName: &grandparent_image_file_name,
        ImageFileName: &image_file_name,
        ParentCommandLine: &parent_command_line,
        ParentImageFileName: &parent_image_file_name,
        PatternIds: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioaExclusions.ssIoaExclusionsMatchedRuleV2(
  {
    aid: "string",
    commandLine: "string",
    grandparentCommandLine: "string",
    grandparentImageFileName: "string",
    imageFileName: "string",
    parentCommandLine: "string",
    parentImageFileName: "string",
    patternIds: []
}  // body
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::IoaExclusions.new

body = Falcon::DomainSsIoaExclusionsMatchedRuleReqV2.new(
  aid: 'string',
  command_line: 'string',
  grandparent_command_line: 'string',
  grandparent_image_file_name: 'string',
  image_file_name: 'string',
  parent_command_line: 'string',
  parent_image_file_name: 'string',
  pattern_ids: []
)

response = api.ss_ioa_exclusions_matched_rule_v2(body)

puts response

Responses

[
  {
    "applied_globally": false,
    "cl_regex": "string",
    "comment": "string",
    "created_by": "string",
    "created_on": "string",
    "description": "string",
    "detection_json": "string",
    "grandparent_cl_regex": "string",
    "grandparent_ifn_regex": "string",
    "host_groups": [],
    "id": "string",
    "ifn_regex": "string",
    "last_modified": "string",
    "modified_by": "string",
    "name": "string",
    "parent_cl_regex": "string",
    "parent_ifn_regex": "string",
    "pattern_id": "string",
    "pattern_name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ss-ioa-exclusions.new-rules.v2

Get defaults for Self Service IOA Exclusions based on provided IFN/CLI for child, parent and grandparent.

Method POST

Route /exclusions/entities/ss-ioa-new-rules/v2

Scope IOA Exclusions: WRITE

PEP 8 get_default_ss_exclusions

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

aid body · string

Agent ID to get default exclusions for.

command_line body · string

Command line of the child process.

grandparent_command_line body · string

Command line of the grandparent process.

grandparent_image_file_name body · string

Image file name of the grandparent process.

image_file_name body · string

Image file name of the child process.

parent_command_line body · string

Command line of the parent process.

parent_image_file_name body · string

Image file name of the parent process.

Code Examples

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.get_default_ss_exclusions(aid="string",
                                            command_line="string",
                                            grandparent_command_line="string",
                                            grandparent_image_file_name="string",
                                            image_file_name="string",
                                            parent_command_line="string",
                                            parent_image_file_name="string")
print(response)

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.ss_ioa_exclusions_new_rules_v2(aid="string",
                                                 command_line="string",
                                                 grandparent_command_line="string",
                                                 grandparent_image_file_name="string",
                                                 image_file_name="string",
                                                 parent_command_line="string",
                                                 parent_image_file_name="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "aid": "string",
    "command_line": "string",
    "grandparent_command_line": "string",
    "grandparent_image_file_name": "string",
    "image_file_name": "string",
    "parent_command_line": "string",
    "parent_image_file_name": "string"
}

response = falcon.command("ss_ioa_exclusions_new_rules_v2", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioa_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  aid := "string"
  command_line := "string"
  grandparent_command_line := "string"
  grandparent_image_file_name := "string"
  image_file_name := "string"
  parent_command_line := "string"
  parent_image_file_name := "string"

  response, err := client.IoaExclusions.SsIoaExclusionsNewRulesV2(
    &ioa_exclusions.SsIoaExclusionsNewRulesV2Params{
      Body: &models.DomainSsIoaExclusionsNewRuleReqV2{
        Aid: &aid,
        CommandLine: &command_line,
        GrandparentCommandLine: &grandparent_command_line,
        GrandparentImageFileName: &grandparent_image_file_name,
        ImageFileName: &image_file_name,
        ParentCommandLine: &parent_command_line,
        ParentImageFileName: &parent_image_file_name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioaExclusions.ssIoaExclusionsNewRulesV2(
  {
    aid: "string",
    commandLine: "string",
    grandparentCommandLine: "string",
    grandparentImageFileName: "string",
    imageFileName: "string",
    parentCommandLine: "string",
    parentImageFileName: "string"
}  // body
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::IoaExclusions.new

body = Falcon::DomainSsIoaExclusionsNewRuleReqV2.new(
  aid: 'string',
  command_line: 'string',
  grandparent_command_line: 'string',
  grandparent_image_file_name: 'string',
  image_file_name: 'string',
  parent_command_line: 'string',
  parent_image_file_name: 'string'
)

response = api.ss_ioa_exclusions_new_rules_v2(body)

puts response

Responses

{
  "aid": "string",
  "cl_regex": "string",
  "command_line": "string",
  "grandparent_cl_regex": "string",
  "grandparent_command_line": "string",
  "grandparent_ifn_regex": "string",
  "grandparent_image_file_name": "string",
  "host_groups": [
    "string"
  ],
  "ifn_regex": "string",
  "image_file_name": "string",
  "parent_cl_regex": "string",
  "parent_command_line": "string",
  "parent_ifn_regex": "string",
  "parent_image_file_name": "string"
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ss-ioa-exclusions.search.v2

Search for Self Service IOA Exclusions.

Method GET

Route /exclusions/queries/ss-ioa-exclusions/v2

Scope IOA Exclusions: READ

PEP 8 query_ss_exclusions

Parameters

filter query · string

The filter expression that should be used to limit the results.

ifn_regex query · string

The ifn_regex expression to filter exclusions by, used alongside expressions specified in the filter query parameter.

cl_regex query · string

The cl_regex expression to filter exclusions by, used alongside expressions specified in the filter query parameter.

parent_ifn_regex query · string

The parent_ifn_regex expression to filter exclusions by, used alongside expressions specified in the filter query parameter.

parent_cl_regex query · string

The parent_cl_regex expression to filter exclusions by, used alongside expressions specified in the filter query parameter.

grandparent_ifn_regex query · string

The grandparent_ifn_regex expression to filter exclusions by, used alongside expressions specified in the filter query parameter.

grandparent_cl_regex query · string

The grandparent_cl_regex expression to filter exclusions by, used alongside expressions specified in the filter query parameter.

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return. [1-500]

sort query · string

The sort expression that should be used to sort the results.

Available values (12)

`name.asc`	`name.desc`	`pattern_id.asc`
`pattern_id.desc`	`pattern_name.asc`	`pattern_name.desc`
`created_by.asc`	`created_by.desc`	`last_modified.asc`
`last_modified.desc`	`modified_by.asc`	`modified_by.desc`

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.query_ss_exclusions(filter="string",
                                      ifn_regex="string",
                                      cl_regex="string",
                                      parent_ifn_regex="string",
                                      parent_cl_regex="string",
                                      grandparent_ifn_regex="string",
                                      grandparent_cl_regex="string",
                                      offset=integer,
                                      limit=integer,
                                      sort="string")
print(response)

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.ss_ioa_exclusions_search_v2(filter="string",
                                              ifn_regex="string",
                                              cl_regex="string",
                                              parent_ifn_regex="string",
                                              parent_cl_regex="string",
                                              grandparent_ifn_regex="string",
                                              grandparent_cl_regex="string",
                                              offset=integer,
                                              limit=integer,
                                              sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ss_ioa_exclusions_search_v2",
                          filter="string",
                          ifn_regex="string",
                          cl_regex="string",
                          parent_ifn_regex="string",
                          parent_cl_regex="string",
                          grandparent_ifn_regex="string",
                          grandparent_cl_regex="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioa_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  ifnRegex := "string"
  clRegex := "string"
  parentIfnRegex := "string"
  parentClRegex := "string"
  grandparentIfnRegex := "string"
  grandparentClRegex := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.IoaExclusions.SsIoaExclusionsSearchV2(
    &ioa_exclusions.SsIoaExclusionsSearchV2Params{
      Filter: &filter,
      IfnRegex: &ifnRegex,
      ClRegex: &clRegex,
      ParentIfnRegex: &parentIfnRegex,
      ParentClRegex: &parentClRegex,
      GrandparentIfnRegex: &grandparentIfnRegex,
      GrandparentClRegex: &grandparentClRegex,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioaExclusions.ssIoaExclusionsSearchV2(
  "string",  // filter
  "string",  // ifnRegex
  "string",  // clRegex
  "string",  // parentIfnRegex
  "string",  // parentClRegex
  "string",  // grandparentIfnRegex
  "string",  // grandparentClRegex
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::IoaExclusions.new

response = api.ss_ioa_exclusions_search_v2(filter: 'string',
                                           ifn_regex: 'string',
                                           cl_regex: 'string',
                                           parent_ifn_regex: 'string',
                                           parent_cl_regex: 'string',
                                           grandparent_ifn_regex: 'string',
                                           grandparent_cl_regex: 'string',
                                           offset: integer,
                                           limit: integer,
                                           sort: 'string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ss-ioa-exclusions.update.v2

Update the Self Service IOA Exclusions rule by id.

Method PATCH

Route /exclusions/entities/ss-ioa-exclusions/v2

Scope IOA Exclusions: WRITE

PEP 8 update_ss_exclusions

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

exclusions body · array

List of exclusion definitions to update.

Code Examples

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

exclusions = [
    {
        "cl_regex": "string",
        "comment": "string",
        "description": "string",
        "detection_json": "string",
        "grandparent_cl_regex": "string",
        "grandparent_ifn_regex": "string",
        "host_groups": [
            "string"
        ],
        "id": "string",
        "ifn_regex": "string",
        "name": "string",
        "parent_cl_regex": "string",
        "parent_ifn_regex": "string",
        "pattern_id": "string",
        "pattern_name": "string"
    }
]

response = falcon.update_ss_exclusions(exclusions=exclusions)
print(response)

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

exclusions = [
    {
        "cl_regex": "string",
        "comment": "string",
        "description": "string",
        "detection_json": "string",
        "grandparent_cl_regex": "string",
        "grandparent_ifn_regex": "string",
        "host_groups": [
            "string"
        ],
        "id": "string",
        "ifn_regex": "string",
        "name": "string",
        "parent_cl_regex": "string",
        "parent_ifn_regex": "string",
        "pattern_id": "string",
        "pattern_name": "string"
    }
]

response = falcon.ss_ioa_exclusions_update_v2(exclusions=exclusions)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "exclusions": [
        {
            "cl_regex": "string",
            "comment": "string",
            "description": "string",
            "detection_json": "string",
            "grandparent_cl_regex": "string",
            "grandparent_ifn_regex": "string",
            "host_groups": ["string"],
            "id": "string",
            "ifn_regex": "string",
            "name": "string",
            "parent_cl_regex": "string",
            "parent_ifn_regex": "string",
            "pattern_id": "string",
            "pattern_name": "string"
        }
    ]
}

response = falcon.command("ss_ioa_exclusions_update_v2", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioa_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cl_regex := "string"
  comment := "string"
  description := "string"
  detection_json := "string"
  grandparent_cl_regex := "string"
  grandparent_ifn_regex := "string"
  id := "string"
  ifn_regex := "string"
  name := "string"
  parent_cl_regex := "string"
  parent_ifn_regex := "string"
  pattern_id := "string"
  pattern_name := "string"

  response, err := client.IoaExclusions.SsIoaExclusionsUpdateV2(
    &ioa_exclusions.SsIoaExclusionsUpdateV2Params{
      Body: &models.DomainSsIoaExclusionsUpdateReqV2{
        Exclusions: []interface{}{
          {
          ClRegex: &cl_regex,
          Comment: &comment,
          Description: &description,
          DetectionJson: &detection_json,
          GrandparentClRegex: &grandparent_cl_regex,
          GrandparentIfnRegex: &grandparent_ifn_regex,
          HostGroups: []string{"string"},
          ID: &id,
          IfnRegex: &ifn_regex,
          Name: &name,
          ParentClRegex: &parent_cl_regex,
          ParentIfnRegex: &parent_ifn_regex,
          PatternID: &pattern_id,
          PatternName: &pattern_name,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioaExclusions.ssIoaExclusionsUpdateV2(
  {
    exclusions: [{
        clRegex: "string",
        comment: "string",
        description: "string",
        detectionJson: "string",
        grandparentClRegex: "string",
        grandparentIfnRegex: "string",
        hostGroups: [],
        id: "string",
        ifnRegex: "string",
        name: "string",
        parentClRegex: "string",
        parentIfnRegex: "string",
        patternId: "string",
        patternName: "string"
      }]
}  // body
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::IoaExclusions.new

body = Falcon::DomainSsIoaExclusionsUpdateReqV2.new(
  exclusions: [{
      cl_regex: 'string',
      comment: 'string',
      description: 'string',
      detection_json: 'string',
      grandparent_cl_regex: 'string',
      grandparent_ifn_regex: 'string',
      host_groups: [],
      id: 'string',
      ifn_regex: 'string',
      name: 'string',
      parent_cl_regex: 'string',
      parent_ifn_regex: 'string',
      pattern_id: 'string',
      pattern_name: 'string'
    }]
)

response = api.ss_ioa_exclusions_update_v2(body)

puts response

Responses

[
  {
    "applied_globally": false,
    "cl_regex": "string",
    "comment": "string",
    "created_by": "string",
    "created_on": "string",
    "description": "string",
    "detection_json": "string",
    "grandparent_cl_regex": "string",
    "grandparent_ifn_regex": "string",
    "host_groups": [],
    "id": "string",
    "ifn_regex": "string",
    "last_modified": "string",
    "modified_by": "string",
    "name": "string",
    "parent_cl_regex": "string",
    "parent_ifn_regex": "string",
    "pattern_id": "string",
    "pattern_name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

updateIOAExclusionsV1

Update the IOA exclusions

Method PATCH

Route /policy/entities/ioa-exclusions/v1

Scope IOA Exclusions: WRITE

PEP 8 update_exclusions

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

cl_regex body · string

Command line regex value for the exclusion.

comment body · string

Comment describing why the exclusion is updated.

description body · string

Description of the exclusion.

detection_json body · string

Detection JSON payload for the exclusion.

groups body · array

Group IDs to exclude.

id body · string

Identifier of the exclusion to update.

ifn_regex body · string

Image file name regex value for the exclusion.

name body · string

Name of the exclusion.

pattern_id body · string

Pattern ID associated with the exclusion.

pattern_name body · string

Pattern name associated with the exclusion.

Code Examples

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_exclusions(cl_regex="string",
                                    comment="string",
                                    description="string",
                                    detection_json="string",
                                    groups=id_list,
                                    id="string",
                                    ifn_regex="string",
                                    name="string",
                                    pattern_id="string",
                                    pattern_name="string")
print(response)

from falconpy import IOAExclusions

falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.updateIOAExclusionsV1(cl_regex="string",
                                        comment="string",
                                        description="string",
                                        detection_json="string",
                                        groups=id_list,
                                        id="string",
                                        ifn_regex="string",
                                        name="string",
                                        pattern_id="string",
                                        pattern_name="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "cl_regex": "string",
    "comment": "string",
    "description": "string",
    "detection_json": "string",
    "groups": ["string"],
    "id": "string",
    "ifn_regex": "string",
    "name": "string",
    "pattern_id": "string",
    "pattern_name": "string"
}

response = falcon.command("updateIOAExclusionsV1", body=body_payload)
print(response)

Edit-FalconIoaExclusion -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioa_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cl_regex := "string"
  comment := "string"
  description := "string"
  detection_json := "string"
  id := "string"
  ifn_regex := "string"
  name := "string"
  pattern_id := "string"
  pattern_name := "string"

  response, err := client.IoaExclusions.UpdateIOAExclusionsV1(
    &ioa_exclusions.UpdateIOAExclusionsV1Params{
      Body: &models.IoaExclusionsIoaExclusionUpdateReqV1{
        ClRegex: &cl_regex,
        Comment: &comment,
        Description: &description,
        DetectionJson: &detection_json,
        Groups: []string{"string"},
        ID: &id,
        IfnRegex: &ifn_regex,
        Name: &name,
        PatternID: &pattern_id,
        PatternName: &pattern_name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioaExclusions.updateIOAExclusionsV1(
  {
    clRegex: "string",
    comment: "string",
    description: "string",
    detectionJson: "string",
    groups: [],
    id: "string",
    ifnRegex: "string",
    name: "string",
    patternId: "string",
    patternName: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::ioa_exclusions_api::update_ioa_exclusions_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::IoaExclusionsIoaExclusionUpdateReqV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = IoaExclusionsIoaExclusionUpdateReqV1 {
        cl_regex: Some("string".to_string()),
        description: Some("string".to_string()),
        detection_json: Some("string".to_string()),
        groups: vec!["string".to_string()],
        id: Some("string".to_string()),
        ifn_regex: Some("string".to_string()),
        name: Some("string".to_string()),
        pattern_id: Some("string".to_string()),
        pattern_name: Some("string".to_string()),
        ..Default::default()
    };

    let response = update_ioa_exclusions_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::IoaExclusions.new

body = Falcon::IoaExclusionsIoaExclusionUpdateReqV1.new(
  cl_regex: 'string',
  comment: 'string',
  description: 'string',
  detection_json: 'string',
  groups: [],
  id: 'string',
  ifn_regex: 'string',
  name: 'string',
  pattern_id: 'string',
  pattern_name: 'string'
)

response = api.update_ioa_exclusions_v1(body)

puts response

Responses

[
  {
    "applied_globally": false,
    "cl_regex": "string",
    "created_by": "string",
    "created_on": "string",
    "description": "string",
    "detection_json": "string",
    "groups": [],
    "id": "string",
    "ifn_regex": "string",
    "last_modified": "string",
    "modified_by": "string",
    "name": "string",
    "pattern_id": "string",
    "pattern_name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "applied_globally": false,
      "cl_regex": "string",
      "created_by": "string",
      "created_on": "string",
      "description": "string",
      "detection_json": "string",
      "groups": [],
      "id": "string",
      "ifn_regex": "string",
      "last_modified": "string",
      "modified_by": "string",
      "name": "string",
      "pattern_id": "string",
      "pattern_name": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "applied_globally": false,
      "cl_regex": "string",
      "created_by": "string",
      "created_on": "string",
      "description": "string",
      "detection_json": "string",
      "groups": [],
      "id": "string",
      "ifn_regex": "string",
      "last_modified": "string",
      "modified_by": "string",
      "name": "string",
      "pattern_id": "string",
      "pattern_name": "string"
    }
  ]
}

IOA Exclusions

Table of Contents

createIOAExclusionsV1

Parameters

deleteIOAExclusionsV1

Parameters

getIOAExclusionsV1

Parameters

queryIOAExclusionsV1

Parameters

ss-ioa-exclusions.aggregates.v2

Parameters

ss-ioa-exclusions.create.v2

Parameters

ss-ioa-exclusions.delete.v2

Parameters

ss-ioa-exclusions.get-reports.v2

Parameters

ss-ioa-exclusions.get.v2

Parameters

ss-ioa-exclusions.matched-rule.v2

Parameters

ss-ioa-exclusions.new-rules.v2

Parameters

ss-ioa-exclusions.search.v2

Parameters

ss-ioa-exclusions.update.v2

Parameters

updateIOAExclusionsV1

Parameters