IT Automation

The IT Automation service collection provides operations for managing automation policies, executions, jobs, and templates. Create and manage workflows for automated IT processes across your CrowdStrike environment.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

Operation	Description
ITAutomationCancelTaskExecution `cancel_execution`	Cancel a task execution specified in the request
ITAutomationCombinedScheduledTasks `scheduled_task_details`	Returns full details of scheduled tasks matching the filter query parameter.
ITAutomationCreatePolicy `create_policy`	Creates a new policy of the specified type.
ITAutomationCreateScheduledTask `create_scheduled_task`	Creates a scheduled task from the given request
ITAutomationCreateTask `create_task`	Creates a task with details from the given request.
ITAutomationCreateTaskGroup `create_task_group`	Creates a task group from the given request
ITAutomationCreateUserGroup `create_user_group`	Creates a user group from the given request
ITAutomationDeletePolicy `delete_policy`	Deletes 1 or more policies.
ITAutomationDeleteScheduledTasks `delete_scheduled_task`	Delete one or more scheduled tasks by providing the scheduled tasks IDs
ITAutomationDeleteTask `delete_task`	Deletes tasks for each provided ID
ITAutomationDeleteTaskGroups `delete_task_groups`	Delete one or more task groups by providing the task group IDs
ITAutomationDeleteUserGroup `delete_user_groups`	Deletes user groups for each provided ids
ITAutomationGetAssociatedTasks `get_associated_tasks`	Retrieve tasks associated with the provided file id
ITAutomationGetExecutionResults `get_execution_results`	Get the task execution results from an async search.
ITAutomationGetExecutionResultsSearchStatus `get_execution_results_search_status`	Get the status of an async task execution results.
ITAutomationGetPolicies `get_policies`	Retrieves the configuration for 1 or more policies.
ITAutomationGetScheduledTasks `get_scheduled_task`	Returns scheduled tasks for each provided id
ITAutomationGetTaskExecution `get_execution`	Get the task execution for the provided task execution IDs
ITAutomationGetTaskExecutionHostStatus `get_execution_host_status`	Get the status of host executions by providing the execution IDs
ITAutomationGetTaskExecutionsByQuery `get_executions_by_query`	Returns the list of task executions (and their details) matching the filter query parameter.
ITAutomationGetTaskGroups `get_task_group`	Returns task groups for each provided id
ITAutomationGetTaskGroupsByQuery `get_task_groups_by_query`	Returns full details of task groups matching the filter query parameter.
ITAutomationGetTasks `get_tasks`	Returns tasks for each provided ID
ITAutomationGetTasksByQuery `get_tasks_by_query`	Returns full details of tasks matching the filter query parameter.
ITAutomationGetUserGroup `get_user_group`	Returns user groups for each provided id
ITAutomationQueryPolicies `query_policies`	Returns the list of policy ids matching the filter query parameter.
ITAutomationRerunTaskExecution `rerun_execution`	Rerun the task execution specified in the request
ITAutomationRunLiveQuery `run_live_query`	Starts a new task execution from the provided query data in the request and returns the initiated task executions
ITAutomationSearchScheduledTasks `search_scheduled_tasks`	Returns the list of scheduled task IDs matching the filter query parameter
ITAutomationSearchTaskExecutions `search_task_executions`	Returns the list of task execution IDs matching the filter query parameter.
ITAutomationSearchTaskGroups `search_task_groups`	Returns the list of task group ids matching the filter query parameter
ITAutomationSearchTasks `search_tasks`	Returns the list of task IDs matching the filter query parameter.
ITAutomationSearchUserGroup `search_user_groups`	Returns the list of user group ids matching the filter query parameter.
ITAutomationStartExecutionResultsSearch `execution_results_search`	Starts an async task execution results search.
ITAutomationStartTaskExecution `start_execution`	Starts a new task execution from an existing task provided in the request and returns the initiated task executions
ITAutomationUpdatePolicies `update_policy`	Updates a new policy of the specified type.
ITAutomationUpdatePoliciesPrecedence `update_policies_precedence`	Updates the policy precedence for all policies of a specific platform.
ITAutomationUpdatePolicyHostGroups `update_policy_host_groups`	Manage host groups assigned to a policy.
ITAutomationUpdateScheduledTask `update_scheduled_task`	Update an existing scheduled task with the supplied info
ITAutomationUpdateTask `update_task`	Update a task with details from the given request.
ITAutomationUpdateTaskGroup `update_task_group`	Update a task group for a given id
ITAutomationUpdateUserGroup `update_user_group`	Update a user group for a given id

ITAutomationCancelTaskExecution

Cancel a task execution specified in the request

Method POST

Route /it-automation/entities/task-execution-cancel/v1

Scope IT Automation - Task Executions: WRITE

PEP 8 cancel_execution

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

task_execution_id body · string

ID of the task execution to cancel. Example: f64b95555ef54ea682619ce880d267cc

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.cancel_execution(task_execution_id="string")
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.ITAutomationCancelTaskExecution(task_execution_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "task_execution_id": "string"
}

response = falcon.command("ITAutomationCancelTaskExecution", body=body_payload)
print(response)

Stop-FalconItTaskExecution -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  task_execution_id := "string"

  response, err := client.ItAutomation.ITAutomationCancelTaskExecution(
    &it_automation.ITAutomationCancelTaskExecutionParams{
      Body: &models.ItautomationCancelTaskExecutionRequest{
        TaskExecutionID: &task_execution_id,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationCancelTaskExecution(
  {
    taskExecutionId: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_cancel_task_execution;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ItautomationCancelTaskExecutionRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ItautomationCancelTaskExecutionRequest {
        task_execution_id: Some("string".to_string()),
        ..Default::default()
    };

    let response = i_t_automation_cancel_task_execution(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

body = Falcon::ItautomationCancelTaskExecutionRequest.new(
  task_execution_id: 'string'
)

response = api.i_t_automation_cancel_task_execution(body)

puts response

Responses

[
  {
    "composite_query": {},
    "discover_new_hosts": false,
    "discover_offline_hosts": false,
    "distribute": false,
    "execution_args": {},
    "expiration_interval": "string",
    "guardrails": {},
    "id": "string",
    "os_query": "string",
    "platforms": [],
    "queries": {},
    "remediations": {},
    "run_by": "string",
    "run_type": "string",
    "status_by_stage": {},
    "target": "string",
    "task_id": "string",
    "task_name": "string",
    "task_parameters": [],
    "task_type": "string",
    "trigger_condition": [],
    "verification_condition": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationCombinedScheduledTasks

Returns full details of scheduled tasks matching the filter query parameter.

Method GET

Route /it-automation/combined/scheduled-tasks/v1

Scope IT Automation - Task Executions: READ

PEP 8 scheduled_task_details

Parameters

filter query · string

The filter expression that should be used to limit the results

sort query · string

The sort expression that should be used to sort the results

offset query · integer

Starting index for record retrieval. Example: 100

limit query · integer

The maximum records to return. Example: 50

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.scheduled_task_details(filter="string",
                                         sort="string",
                                         offset=integer,
                                         limit=integer)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.ITAutomationCombinedScheduledTasks(filter="string",
                                                     sort="string",
                                                     offset=integer,
                                                     limit=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ITAutomationCombinedScheduledTasks",
                          filter="string",
                          sort="string",
                          offset=integer,
                          limit=integer)
print(response)

Get-FalconItScheduledTask -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  offset := int64(0)
  limit := int64(0)

  response, err := client.ItAutomation.ITAutomationCombinedScheduledTasks(
    &it_automation.ITAutomationCombinedScheduledTasksParams{
      Filter: &filter,
      Sort: &sort,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationCombinedScheduledTasks(
  "string",  // filter
  "string",  // sort
  integer,  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_combined_scheduled_tasks;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = i_t_automation_combined_scheduled_tasks(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

response = api.i_t_automation_combined_scheduled_tasks(filter: 'string',
                                                       sort: 'string',
                                                       offset: integer,
                                                       limit: integer)

puts response

Responses

[
  {
    "created_by": "string",
    "created_time": "string",
    "discover_new_hosts": false,
    "discover_offline_hosts": false,
    "distribute": false,
    "execution_args": {},
    "expiration_interval": "string",
    "groups": [],
    "guardrails": {},
    "id": "string",
    "is_active": false,
    "is_preset": false,
    "last_run": "string",
    "modified_by": "string",
    "modified_time": "string",
    "next_run_time": "string",
    "schedule": {},
    "schedule_name": "string",
    "target": "string",
    "task_id": "string",
    "task_name": "string",
    "task_type": "string",
    "trigger_condition": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationCreatePolicy

Creates a new policy of the specified type.

Method POST

Route /it-automation/entities/policies/v1

Scope IT Automation - Policies: WRITE

PEP 8 create_policy

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

config body · object

Configuration settings for the policy

description body · string

Description of the policy

name body · string

The name of the policy

platform body · string

The platform for the policy

Available values (3)

Windows Mac Linux

enable_script_execution body · boolean

Enable or disable script execution.

enable_python_execution body · boolean

Enable or disable Python execution.

enable_os_query body · boolean

Enable or disable OS Query.

execution_timeout body · integer

Specifies the timeout value for executions.

execution_timeout_unit body · string

Execution timeout unit. Allowed values:

Available values (2)

Hours Minutes

cpu_throttle body · integer

Specifies the CPU throttle value.

cpu_scheduling body · string

Sets priority to determine the order in which a query process will run on a host’s CPU.

memory_pressure_level body · string

Sets memory pressure level to control system resource allocation during task execution.

memory_allocation body · integer

Specifies the memory allocation value.

memory_allocation_unit body · string

Memory allocation unit. Allowed values:

Available values (2)

MB GB

concurrent_host_limit body · integer

Specifies the maximum number of concurrent hosts.

concurrent_task_limit body · integer

Specifies the maximum number of concurrent tasks.

concurrent_host_file_transfer_limit body · integer

Specifies the maximum number of concurrent file transfers.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.create_policy(name="string",
                                description="string",
                                platform="string",
                                enable_script_execution=boolean,
                                enable_python_execution=boolean,
                                enable_os_query=boolean,
                                execution_timeout=integer,
                                execution_timeout_unit="string",
                                cpu_throttle=integer,
                                cpu_scheduling="string",
                                memory_pressure_level="string",
                                memory_allocation=integer,
                                memory_allocation_unit="string",
                                concurrent_host_limit=integer,
                                concurrent_task_limit=integer,
                                concurrent_host_file_transfer_limit=integer)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.ITAutomationCreatePolicy(name="string",
                                           description="string",
                                           platform="string",
                                           enable_script_execution=boolean,
                                           enable_python_execution=boolean,
                                           enable_os_query=boolean,
                                           execution_timeout=integer,
                                           execution_timeout_unit="string",
                                           cpu_throttle=integer,
                                           cpu_scheduling="string",
                                           memory_pressure_level="string",
                                           memory_allocation=integer,
                                           memory_allocation_unit="string",
                                           concurrent_host_limit=integer,
                                           concurrent_task_limit=integer,
                                           concurrent_host_file_transfer_limit=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "config": {
        "concurrency": {
            "concurrent_host_file_transfer_limit": integer,
            "concurrent_host_limit": integer,
            "concurrent_task_limit": integer
        },
        "execution": {
            "enable_os_query": boolean,
            "enable_python_execution": boolean,
            "enable_script_execution": boolean,
            "execution_timeout": integer,
            "execution_timeout_unit": "string"
        },
        "resources": {
            "cpu_scheduling": "string",
            "cpu_throttle": integer,
            "memory_allocation": integer,
            "memory_allocation_unit": "string",
            "memory_pressure_level": "string"
        }
    },
    "description": "string",
    "name": "string",
    "platform": "string"
}

response = falcon.command("ITAutomationCreatePolicy", body=body_payload)
print(response)

New-FalconItPolicy -Name "string" -Platform "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  name := "string"
  platform := "string"

  response, err := client.ItAutomation.ITAutomationCreatePolicy(
    &it_automation.ITAutomationCreatePolicyParams{
      Body: &models.ItautomationCreatePolicyRequest{
        Config: &struct{}{},
        Description: &description,
        Name: &name,
        Platform: &platform,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationCreatePolicy(
  {
    config: {
      concurrency: {
        concurrentHostFileTransferLimit: integer,
        concurrentHostLimit: integer,
        concurrentTaskLimit: integer
      },
      execution: {
        enableOsQuery: boolean,
        enablePythonExecution: boolean,
        enableScriptExecution: boolean,
        executionTimeout: integer,
        executionTimeoutUnit: "string"
      },
      resources: {
        cpuScheduling: "string",
        cpuThrottle: integer,
        memoryAllocation: integer,
        memoryAllocationUnit: "string",
        memoryPressureLevel: "string"
      }
    },
    description: "string",
    name: "string",
    platform: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_create_policy;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ItautomationCreatePolicyRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ItautomationCreatePolicyRequest {
        description: Some("string".to_string()),
        platform: Some("string".to_string()),
        ..Default::default()
    };

    let response = i_t_automation_create_policy(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

body = {
  config: {
    concurrency: {
      concurrent_host_file_transfer_limit: integer,
      concurrent_host_limit: integer,
      concurrent_task_limit: integer
    },
    execution: {
      enable_os_query: boolean,
      enable_python_execution: boolean,
      enable_script_execution: boolean,
      execution_timeout: integer,
      execution_timeout_unit: 'string'
    },
    resources: {
      cpu_scheduling: 'string',
      cpu_throttle: integer,
      memory_allocation: integer,
      memory_allocation_unit: 'string',
      memory_pressure_level: 'string'
    }
  },
  description: 'string',
  name: 'string',
  platform: 'string'
}

response = api.i_t_automation_create_policy(body)

puts response

Responses

[
  {
    "config": {},
    "created_at": "string",
    "created_by": "string",
    "description": "string",
    "host_groups": [],
    "id": "string",
    "is_enabled": false,
    "modified_at": "string",
    "modified_by": "string",
    "name": "string",
    "precedence": 0,
    "target": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationCreateScheduledTask

Creates a scheduled task from the given request

Method POST

Route /it-automation/entities/scheduled-tasks/v1

Scope IT Automation - Task Executions: WRITE

PEP 8 create_scheduled_task

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

discover_new_hosts body · boolean

Whether to discover new hosts for the scheduled task. Example: true

discover_offline_hosts body · boolean

Whether to discover offline hosts for the scheduled task. Example: true

distribute body · boolean

Whether to distribute the scheduled task. Example: true

execution_args body · object

Additional arguments for the scheduled task. Example: {“state”: “running”}

expiration_interval body · string

Duration for which the task stays active. Once expired, new and offline hosts won’t be targeted. Example: 1m

guardrails body · object

Safety limits for task execution

is_active body · boolean

Whether the scheduled task is active. Example: true

schedule body · object

Schedule details for the task execution

schedule_name body · string

Custom name for the scheduled task. Example: Weekly Security Scan

target body · string

Filter expression to select target hosts. Example: platform_name:‘Windows’

task_id body · string

Unique identifier of the task to be scheduled. Example: f64b95555ef54ea682619ce880d267cc

trigger_condition body · array

Conditions that trigger remediation actions

arguments body · dictionary

Arguments to provide to the task when executed.

id body · string

The id of the scheduled task to update.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

arguments = {
    "additionalProp1": "string",
    "additionalProp2": "string",
    "additionalProp3": "string"
}

guardrails = {
    "run_time_limit_millis": 0
}

schedule = {
    "day_of_month": 0,
    "days_of_week": [
        "string"
    ],
    "end_time": "2025-07-13T13:39:00.637Z",
    "frequency": "One-Time",
    "interval": 0,
    "start_time": "2025-07-13T13:39:00.637Z",
    "time": "string",
    "timezone": "string"
}

trigger_condition = [
    {
        "groups": [
            null
        ],
        "operator": "AND",
        "statements": [
            {
                "data_comparator": "LessThan",
                "data_type": "StringType",
                "key": "string",
                "task_id": "string",
                "value": "string"
            }
        ]
    }
]

response = falcon.create_scheduled_task(arguments=arguments,
                                        discover_new_hosts=boolean,
                                        discover_offline_hosts=boolean,
                                        distribute=boolean,
                                        expiration_interval="string",
                                        guardrails=guardrails,
                                        id="string",
                                        is_active=boolean,
                                        schedule=schedule,
                                        target="string",
                                        task_id="string",
                                        trigger_condition=trigger_condition)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

arguments = {
    "additionalProp1": "string",
    "additionalProp2": "string",
    "additionalProp3": "string"
}

guardrails = {
    "run_time_limit_millis": 0
}

schedule = {
    "day_of_month": 0,
    "days_of_week": [
        "string"
    ],
    "end_time": "2025-07-13T13:39:00.637Z",
    "frequency": "One-Time",
    "interval": 0,
    "start_time": "2025-07-13T13:39:00.637Z",
    "time": "string",
    "timezone": "string"
}

trigger_condition = [
    {
        "groups": [
            null
        ],
        "operator": "AND",
        "statements": [
            {
                "data_comparator": "LessThan",
                "data_type": "StringType",
                "key": "string",
                "task_id": "string",
                "value": "string"
            }
        ]
    }
]

response = falcon.ITAutomationCreateScheduledTask(arguments=arguments,
                                                  discover_new_hosts=boolean,
                                                  discover_offline_hosts=boolean,
                                                  distribute=boolean,
                                                  expiration_interval="string",
                                                  guardrails=guardrails,
                                                  id="string",
                                                  is_active=boolean,
                                                  schedule=schedule,
                                                  target="string",
                                                  task_id="string",
                                                  trigger_condition=trigger_condition)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "discover_new_hosts": boolean,
    "discover_offline_hosts": boolean,
    "distribute": boolean,
    "execution_args": {},
    "expiration_interval": "string",
    "guardrails": {
        "run_time_limit_millis": integer
    },
    "is_active": boolean,
    "schedule": {
        "day_of_month": integer,
        "days_of_week": ["string"],
        "end_time": "string",
        "frequency": "string",
        "interval": integer,
        "start_time": "string",
        "time": "string",
        "timezone": "string"
    },
    "schedule_name": "string",
    "target": "string",
    "task_id": "string",
    "trigger_condition": [
        {
            "groups": [
                {
                    "groups": ["string"],
                    "operator": "string",
                    "statements": ["string"]
                }
            ],
            "operator": "string",
            "statements": [
                {
                    "data_comparator": "string",
                    "data_type": "string",
                    "key": "string",
                    "task_id": "string",
                    "value": "string"
                }
            ]
        }
    ]
}

response = falcon.command("ITAutomationCreateScheduledTask", body=body_payload)
print(response)

New-FalconItScheduledTask -TaskId "string" `
  -Target "string" `
  -Schedule @{} `
  -Enabled $boolean

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  discover_new_hosts := boolean
  discover_offline_hosts := boolean
  distribute := boolean
  expiration_interval := "string"
  is_active := boolean
  schedule_name := "string"
  target := "string"
  task_id := "string"
  operator := "string"
  data_comparator := "string"
  data_type := "string"
  key := "string"
  value := "string"

  response, err := client.ItAutomation.ITAutomationCreateScheduledTask(
    &it_automation.ITAutomationCreateScheduledTaskParams{
      Body: &models.ItautomationCreateScheduledTaskRequest{
        DiscoverNewHosts: &discover_new_hosts,
        DiscoverOfflineHosts: &discover_offline_hosts,
        Distribute: &distribute,
        ExecutionArgs: &struct{}{},
        ExpirationInterval: &expiration_interval,
        Guardrails: &struct{}{},
        IsActive: &is_active,
        Schedule: &struct{}{},
        ScheduleName: &schedule_name,
        Target: &target,
        TaskID: &task_id,
        TriggerCondition: []interface{}{
          {
          Groups: []interface{}{
            {
            Groups: []interface{}{},
            Operator: &operator,
            Statements: []interface{}{},
            },
          },
          Operator: &operator,
          Statements: []interface{}{
            {
            DataComparator: &data_comparator,
            DataType: &data_type,
            Key: &key,
            TaskID: &task_id,
            Value: &value,
            },
          },
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationCreateScheduledTask(
  {
    discoverNewHosts: boolean,
    discoverOfflineHosts: boolean,
    distribute: boolean,
    executionArgs: {},
    expirationInterval: "string",
    guardrails: {
      runTimeLimitMillis: integer
    },
    isActive: boolean,
    schedule: {
      dayOfMonth: integer,
      daysOfWeek: [],
      endTime: "string",
      frequency: "string",
      interval: integer,
      startTime: "string",
      time: "string",
      timezone: "string"
    },
    scheduleName: "string",
    target: "string",
    taskId: "string",
    triggerCondition: [{
        groups: [{
            groups: [],
            operator: "string",
            statements: []
          }],
        operator: "string",
        statements: [{
            dataComparator: "string",
            dataType: "string",
            key: "string",
            taskId: "string",
            value: "string"
          }]
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_create_scheduled_task;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ItautomationCreateScheduledTaskRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ItautomationCreateScheduledTaskRequest {
        is_active: Some(boolean),
        schedule: Default::default(),
        target: Some("string".to_string()),
        task_id: Some("string".to_string()),
        ..Default::default()
    };

    let response = i_t_automation_create_scheduled_task(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

body = Falcon::ItautomationCreateScheduledTaskRequest.new(
  discover_new_hosts: boolean,
  discover_offline_hosts: boolean,
  distribute: boolean,
  execution_args: {},
  expiration_interval: 'string',
  guardrails: {
    run_time_limit_millis: integer
  },
  is_active: boolean,
  schedule: {
    day_of_month: integer,
    days_of_week: [],
    end_time: 'string',
    frequency: 'string',
    interval: integer,
    start_time: 'string',
    time: 'string',
    timezone: 'string'
  },
  schedule_name: 'string',
  target: 'string',
  task_id: 'string',
  trigger_condition: [{
      groups: [{
          groups: [],
          operator: 'string',
          statements: []
        }],
      operator: 'string',
      statements: [{
          data_comparator: 'string',
          data_type: 'string',
          key: 'string',
          task_id: 'string',
          value: 'string'
        }]
    }]
)

response = api.i_t_automation_create_scheduled_task(body)

puts response

Responses

[
  {
    "created_by": "string",
    "created_time": "string",
    "discover_new_hosts": false,
    "discover_offline_hosts": false,
    "distribute": false,
    "execution_args": {},
    "expiration_interval": "string",
    "groups": [],
    "guardrails": {},
    "id": "string",
    "is_active": false,
    "is_preset": false,
    "last_run": "string",
    "modified_by": "string",
    "modified_time": "string",
    "next_run_time": "string",
    "schedule": {},
    "schedule_name": "string",
    "target": "string",
    "task_id": "string",
    "task_name": "string",
    "task_type": "string",
    "trigger_condition": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationCreateTask

Creates a task with details from the given request.

Method POST

Route /it-automation/entities/tasks/v1

Scope IT Automation - Tasks: WRITE

PEP 8 create_task

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

access_type body · string

Access type of the task

Available values (2)

Public Shared

assigned_user_group_ids body · array

Assigned user group IDs of the task, when access_type is Shared. Use GET /it-automation/queries/it-user-groups/v1 to fetch user group IDs

assigned_user_ids body · array

Assigned user IDs of the task, when access_type is Shared. Use GET /user-management/queries/users/v1 to fetch user IDs

composite_query body · object

Composite query configuration containing task IDs and host attributes for multi-task execution

description body · string

Detailed description of what the task does. Example: User Table Validation Check

name body · string

Name of the task. Example: OSQuery Check

os_query body · string

OSQuery to execute. Example: select * from users

output_parser_config body · object

Specifies the columns and delimiter used to parse script execution results

queries body · object

Script queries to run per platform

remediations body · object

Remediation scripts to run per platform

rows_parser_config body · object

Configuration for parsing script output into multiple rows

target body · string

Target filter in FQL format. Example: platform_name: ‘Windows’

task_group_id body · string

ID of the task group to associate this task with

task_parameters body · array

Parameters for the task

task_type body · string

Type of task

Available values (2)

query remediation

trigger_condition body · array

Conditions that trigger remediation scripts execution

verification_condition body · array

Conditions that verify the outcome of the remediation scripts execution

add_assigned_user_group_ids body · string or list of strings

User group IDs to add.

add_assigned_user_ids body · string or list of strings

User IDs to add.

removed_assigned_user_group_ids body · string or list of strings

User group IDs to be removed.

remove_assigned_user_ids body · string or list of strings

User IDs to be removed.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

output_parser_config = {
    "columns": [
        {
            "name": "string"
        }
    ],
    "default_group_by": "boolean",
    "delimiter": "string"
}

queries = {
    "linux": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    },
    "mac": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    },
    "windows": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    }
}

remediations = {
    "linux": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    },
    "mac": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    },
    "windows": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    }
}

trigger_condition = [
    {
        "groups": [
            null
        ],
        "operator": "AND",
        "statements": [
            {
                "data_comparator": "LessThan",
                "data_type": "StringType",
                "key": "string",
                "task_id": "string",
                "value": "string"
            }
        ]
    }
]

verification_condition = [
    {
        "groups": [
            null
        ],
        "operator": "AND",
        "statements": [
            {
                "data_comparator": "LessThan",
                "data_type": "StringType",
                "key": "string",
                "task_id": "string",
                "value": "string"
            }
        ]
    }
]

response = falcon.create_task(access_type="string",
                              add_assigned_user_group_ids=id_list,
                              add_assigned_user_ids=id_list,
                              description="string",
                              name="string",
                              os_query="string",
                              output_parser_config=output_parser_config,
                              queries=queries,
                              remediations=remediations,
                              removed_assigned_user_group_ids=id_list,
                              remove_assigned_user_ids=id_list,
                              target="string",
                              task_parameters=["string"],
                              task_group_id="string",
                              task_type="string",
                              trigger_condition=trigger_condition,
                              verification_condition=verification_condition)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

output_parser_config = {
    "columns": [
        {
            "name": "string"
        }
    ],
    "default_group_by": "boolean",
    "delimiter": "string"
}

queries = {
    "linux": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    },
    "mac": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    },
    "windows": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    }
}

remediations = {
    "linux": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    },
    "mac": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    },
    "windows": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    }
}

trigger_condition = [
    {
        "groups": [
            null
        ],
        "operator": "AND",
        "statements": [
            {
                "data_comparator": "LessThan",
                "data_type": "StringType",
                "key": "string",
                "task_id": "string",
                "value": "string"
            }
        ]
    }
]

verification_condition = [
    {
        "groups": [
            null
        ],
        "operator": "AND",
        "statements": [
            {
                "data_comparator": "LessThan",
                "data_type": "StringType",
                "key": "string",
                "task_id": "string",
                "value": "string"
            }
        ]
    }
]

response = falcon.ITAutomationCreateTask(access_type="string",
                                         add_assigned_user_group_ids=id_list,
                                         add_assigned_user_ids=id_list,
                                         description="string",
                                         name="string",
                                         os_query="string",
                                         output_parser_config=output_parser_config,
                                         queries=queries,
                                         remediations=remediations,
                                         removed_assigned_user_group_ids=id_list,
                                         remove_assigned_user_ids=id_list,
                                         target="string",
                                         task_parameters=["string"],
                                         task_group_id="string",
                                         task_type="string",
                                         trigger_condition=trigger_condition,
                                         verification_condition=verification_condition)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "access_type": "string",
    "assigned_user_group_ids": ["string"],
    "assigned_user_ids": ["string"],
    "composite_query": {
        "host_attributes": ["string"],
        "task_ids": ["string"]
    },
    "description": "string",
    "name": "string",
    "os_query": "string",
    "output_parser_config": {
        "columns": [
            {
                "name": "string"
            }
        ],
        "default_group_by": boolean,
        "delimiter": "string"
    },
    "queries": {
        "linux": {
            "action_type": "string",
            "content": "string",
            "file_ids": ["string"],
            "language": "string",
            "script_args": "string",
            "script_file_id": "string"
        },
        "mac": {
            "action_type": "string",
            "content": "string",
            "file_ids": ["string"],
            "language": "string",
            "script_args": "string",
            "script_file_id": "string"
        },
        "windows": {
            "action_type": "string",
            "content": "string",
            "file_ids": ["string"],
            "language": "string",
            "script_args": "string",
            "script_file_id": "string"
        }
    },
    "remediations": {
        "linux": {
            "action_type": "string",
            "content": "string",
            "file_ids": ["string"],
            "language": "string",
            "script_args": "string",
            "script_file_id": "string"
        },
        "mac": {
            "action_type": "string",
            "content": "string",
            "file_ids": ["string"],
            "language": "string",
            "script_args": "string",
            "script_file_id": "string"
        },
        "windows": {
            "action_type": "string",
            "content": "string",
            "file_ids": ["string"],
            "language": "string",
            "script_args": "string",
            "script_file_id": "string"
        }
    },
    "rows_parser_config": {
        "delimiter": "string"
    },
    "target": "string",
    "task_group_id": "string",
    "task_parameters": [
        {
            "custom_validation_message": "string",
            "custom_validation_regex": "string",
            "default_value": "string",
            "format_hint": "string",
            "input_type": "string",
            "is_optional": boolean,
            "key": "string",
            "label": "string",
            "options": [
                {
                    "key": "string",
                    "value": "string"
                }
            ],
            "purpose": "string",
            "validation_type": "string"
        }
    ],
    "task_type": "string",
    "trigger_condition": [
        {
            "groups": [
                {
                    "groups": ["string"],
                    "operator": "string",
                    "statements": ["string"]
                }
            ],
            "operator": "string",
            "statements": [
                {
                    "data_comparator": "string",
                    "data_type": "string",
                    "key": "string",
                    "task_id": "string",
                    "value": "string"
                }
            ]
        }
    ],
    "verification_condition": [
        {
            "groups": [
                {
                    "groups": ["string"],
                    "operator": "string",
                    "statements": ["string"]
                }
            ],
            "operator": "string",
            "statements": [
                {
                    "data_comparator": "string",
                    "data_type": "string",
                    "key": "string",
                    "task_id": "string",
                    "value": "string"
                }
            ]
        }
    ]
}

response = falcon.command("ITAutomationCreateTask", body=body_payload)
print(response)

New-FalconItTask -Name "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  access_type := "string"
  description := "string"
  name := "string"
  os_query := "string"
  target := "string"
  task_group_id := "string"
  custom_validation_message := "string"
  custom_validation_regex := "string"
  default_value := "string"
  format_hint := "string"
  input_type := "string"
  is_optional := boolean
  key := "string"
  label := "string"
  value := "string"
  purpose := "string"
  validation_type := "string"
  task_type := "string"
  operator := "string"
  data_comparator := "string"
  data_type := "string"
  task_id := "string"

  response, err := client.ItAutomation.ITAutomationCreateTask(
    &it_automation.ITAutomationCreateTaskParams{
      Body: &models.ItautomationCreateTaskRequest{
        AccessType: &access_type,
        AssignedUserGroupIds: []string{"string"},
        AssignedUserIds: []string{"string"},
        CompositeQuery: &struct{}{},
        Description: &description,
        Name: &name,
        OsQuery: &os_query,
        OutputParserConfig: &struct{}{},
        Queries: &struct{}{},
        Remediations: &struct{}{},
        RowsParserConfig: &struct{}{},
        Target: &target,
        TaskGroupID: &task_group_id,
        TaskParameters: []interface{}{
          {
          CustomValidationMessage: &custom_validation_message,
          CustomValidationRegex: &custom_validation_regex,
          DefaultValue: &default_value,
          FormatHint: &format_hint,
          InputType: &input_type,
          IsOptional: &is_optional,
          Key: &key,
          Label: &label,
          Options: []interface{}{
            {
            Key: &key,
            Value: &value,
            },
          },
          Purpose: &purpose,
          ValidationType: &validation_type,
          },
        },
        TaskType: &task_type,
        TriggerCondition: []interface{}{
          {
          Groups: []interface{}{
            {
            Groups: []interface{}{},
            Operator: &operator,
            Statements: []interface{}{},
            },
          },
          Operator: &operator,
          Statements: []interface{}{
            {
            DataComparator: &data_comparator,
            DataType: &data_type,
            Key: &key,
            TaskID: &task_id,
            Value: &value,
            },
          },
          },
        },
        VerificationCondition: []interface{}{
          {
          Groups: []interface{}{
            {
            Groups: []interface{}{},
            Operator: &operator,
            Statements: []interface{}{},
            },
          },
          Operator: &operator,
          Statements: []interface{}{
            {
            DataComparator: &data_comparator,
            DataType: &data_type,
            Key: &key,
            TaskID: &task_id,
            Value: &value,
            },
          },
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationCreateTask(
  {
    accessType: "string",
    assignedUserGroupIds: [],
    assignedUserIds: [],
    compositeQuery: {
      hostAttributes: [],
      taskIds: []
    },
    description: "string",
    name: "string",
    osQuery: "string",
    outputParserConfig: {
      columns: [{
          name: "string"
        }],
      defaultGroupBy: boolean,
      delimiter: "string"
    },
    queries: {
      linux: {
        actionType: "string",
        content: "string",
        fileIds: [],
        language: "string",
        scriptArgs: "string",
        scriptFileId: "string"
      },
      mac: {
        actionType: "string",
        content: "string",
        fileIds: [],
        language: "string",
        scriptArgs: "string",
        scriptFileId: "string"
      },
      windows: {
        actionType: "string",
        content: "string",
        fileIds: [],
        language: "string",
        scriptArgs: "string",
        scriptFileId: "string"
      }
    },
    remediations: {
      linux: {
        actionType: "string",
        content: "string",
        fileIds: [],
        language: "string",
        scriptArgs: "string",
        scriptFileId: "string"
      },
      mac: {
        actionType: "string",
        content: "string",
        fileIds: [],
        language: "string",
        scriptArgs: "string",
        scriptFileId: "string"
      },
      windows: {
        actionType: "string",
        content: "string",
        fileIds: [],
        language: "string",
        scriptArgs: "string",
        scriptFileId: "string"
      }
    },
    rowsParserConfig: {
      delimiter: "string"
    },
    target: "string",
    taskGroupId: "string",
    taskParameters: [{
        customValidationMessage: "string",
        customValidationRegex: "string",
        defaultValue: "string",
        formatHint: "string",
        inputType: "string",
        isOptional: boolean,
        key: "string",
        label: "string",
        options: [{
            key: "string",
            value: "string"
          }],
        purpose: "string",
        validationType: "string"
      }],
    taskType: "string",
    triggerCondition: [{
        groups: [{
            groups: [],
            operator: "string",
            statements: []
          }],
        operator: "string",
        statements: [{
            dataComparator: "string",
            dataType: "string",
            key: "string",
            taskId: "string",
            value: "string"
          }]
      }],
    verificationCondition: [{
        groups: [{
            groups: [],
            operator: "string",
            statements: []
          }],
        operator: "string",
        statements: [{
            dataComparator: "string",
            dataType: "string",
            key: "string",
            taskId: "string",
            value: "string"
          }]
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_create_task;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ItautomationCreateTaskRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ItautomationCreateTaskRequest {
        access_type: Some("string".to_string()),
        name: Some("string".to_string()),
        target: Some("string".to_string()),
        task_type: Some("string".to_string()),
        ..Default::default()
    };

    let response = i_t_automation_create_task(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

body = Falcon::ItautomationCreateTaskRequest.new(
  access_type: 'string',
  assigned_user_group_ids: [],
  assigned_user_ids: [],
  composite_query: {
    host_attributes: [],
    task_ids: []
  },
  description: 'string',
  name: 'string',
  os_query: 'string',
  output_parser_config: {
    columns: [{
        name: 'string'
      }],
    default_group_by: boolean,
    delimiter: 'string'
  },
  queries: {
    linux: {
      action_type: 'string',
      content: 'string',
      file_ids: [],
      language: 'string',
      script_args: 'string',
      script_file_id: 'string'
    },
    mac: {
      action_type: 'string',
      content: 'string',
      file_ids: [],
      language: 'string',
      script_args: 'string',
      script_file_id: 'string'
    },
    windows: {
      action_type: 'string',
      content: 'string',
      file_ids: [],
      language: 'string',
      script_args: 'string',
      script_file_id: 'string'
    }
  },
  remediations: {
    linux: {
      action_type: 'string',
      content: 'string',
      file_ids: [],
      language: 'string',
      script_args: 'string',
      script_file_id: 'string'
    },
    mac: {
      action_type: 'string',
      content: 'string',
      file_ids: [],
      language: 'string',
      script_args: 'string',
      script_file_id: 'string'
    },
    windows: {
      action_type: 'string',
      content: 'string',
      file_ids: [],
      language: 'string',
      script_args: 'string',
      script_file_id: 'string'
    }
  },
  rows_parser_config: {
    delimiter: 'string'
  },
  target: 'string',
  task_group_id: 'string',
  task_parameters: [{
      custom_validation_message: 'string',
      custom_validation_regex: 'string',
      default_value: 'string',
      format_hint: 'string',
      input_type: 'string',
      is_optional: boolean,
      key: 'string',
      label: 'string',
      options: [{
          key: 'string',
          value: 'string'
        }],
      purpose: 'string',
      validation_type: 'string'
    }],
  task_type: 'string',
  trigger_condition: [{
      groups: [{
          groups: [],
          operator: 'string',
          statements: []
        }],
      operator: 'string',
      statements: [{
          data_comparator: 'string',
          data_type: 'string',
          key: 'string',
          task_id: 'string',
          value: 'string'
        }]
    }],
  verification_condition: [{
      groups: [{
          groups: [],
          operator: 'string',
          statements: []
        }],
      operator: 'string',
      statements: [{
          data_comparator: 'string',
          data_type: 'string',
          key: 'string',
          task_id: 'string',
          value: 'string'
        }]
    }]
)

response = api.i_t_automation_create_task(body)

puts response

Responses

[
  {
    "access_type": "string",
    "assigned_user_group_ids": [],
    "assigned_user_ids": [],
    "composite_query": {},
    "created_by": "string",
    "created_time": "string",
    "description": "string",
    "groups": [],
    "has_task_parameters": false,
    "id": "string",
    "last_run_time": "string",
    "modified_by": "string",
    "modified_time": "string",
    "name": "string",
    "os_query": "string",
    "output_parser_config": {},
    "queries": {},
    "remediations": {},
    "rows_parser_config": {},
    "runs": 0,
    "supported_os": [],
    "target": "string",
    "task_parameters": [],
    "task_type": "string",
    "trigger_condition": [],
    "verification_condition": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationCreateTaskGroup

Creates a task group from the given request

Method POST

Route /it-automation/entities/task-groups/v1

Scope IT Automation - Tasks: WRITE

PEP 8 create_task_group

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

access_type body · string

Access type of the group

Available values (2)

Public Shared

assigned_user_group_ids body · array

Assigned user group IDs of the group, when access_type is Shared. Use GET /it-automation/queries/it-user-groups/v1 to fetch user group IDs

assigned_user_ids body · array

Assigned user IDs of the group, when access_type is Shared. Use GET /user-management/queries/users/v1 to fetch user IDs

description body · string

Description of the task group

name body · string

Name of the task group

task_ids body · array

IDs of existing tasks to add to task group upon creation. Use PATCH /it-automation/entities/task-groups/v1 to add task ids later

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.create_task_group(access_type="string",
                                    assigned_user_group_ids=id_list,
                                    assigned_user_ids=id_list,
                                    description="string",
                                    name="string",
                                    task_ids=id_list)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ITAutomationCreateTaskGroup(access_type="string",
                                              assigned_user_group_ids=id_list,
                                              assigned_user_ids=id_list,
                                              description="string",
                                              name="string",
                                              task_ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "access_type": "string",
    "assigned_user_group_ids": ["string"],
    "assigned_user_ids": ["string"],
    "description": "string",
    "name": "string",
    "task_ids": ["string"]
}

response = falcon.command("ITAutomationCreateTaskGroup", body=body_payload)
print(response)

New-FalconItTaskGroup -Name "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  access_type := "string"
  description := "string"
  name := "string"

  response, err := client.ItAutomation.ITAutomationCreateTaskGroup(
    &it_automation.ITAutomationCreateTaskGroupParams{
      Body: &models.ItautomationCreateTaskGroupRequest{
        AccessType: &access_type,
        AssignedUserGroupIds: []string{"string"},
        AssignedUserIds: []string{"string"},
        Description: &description,
        Name: &name,
        TaskIds: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationCreateTaskGroup(
  {
    accessType: "string",
    assignedUserGroupIds: [],
    assignedUserIds: [],
    description: "string",
    name: "string",
    taskIds: []
}  // body
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_create_task_group;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ItautomationCreateTaskGroupRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ItautomationCreateTaskGroupRequest {
        access_type: Some("string".to_string()),
        name: Some("string".to_string()),
        ..Default::default()
    };

    let response = i_t_automation_create_task_group(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

body = Falcon::ItautomationCreateTaskGroupRequest.new(
  access_type: 'string',
  assigned_user_group_ids: [],
  assigned_user_ids: [],
  description: 'string',
  name: 'string',
  task_ids: []
)

response = api.i_t_automation_create_task_group(body)

puts response

Responses

[
  {
    "access_type": "string",
    "assigned_user_group_ids": [],
    "assigned_user_ids": [],
    "created_by": "string",
    "created_time": "string",
    "description": "string",
    "id": "string",
    "is_preset": false,
    "modified_by": "string",
    "modified_time": "string",
    "name": "string",
    "supported_os": [],
    "task_ids": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationCreateUserGroup

Creates a user group from the given request

Method POST

Route /it-automation/entities/it-user-groups/v1

Scope IT Automation - User Groups: WRITE

PEP 8 create_user_group

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

description body · string

Description of the user group

name body · string

Name of the user group

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.create_user_group(description="string", name="string")
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.ITAutomationCreateUserGroup(description="string",
                                              name="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "description": "string",
    "name": "string"
}

response = falcon.command("ITAutomationCreateUserGroup", body=body_payload)
print(response)

New-FalconItUserGroup -Name "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  name := "string"

  response, err := client.ItAutomation.ITAutomationCreateUserGroup(
    &it_automation.ITAutomationCreateUserGroupParams{
      Body: &models.ItautomationCreateUserGroupRequest{
        Description: &description,
        Name: &name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationCreateUserGroup(
  {
    description: "string",
    name: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_create_user_group;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ItautomationCreateUserGroupRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ItautomationCreateUserGroupRequest {
        name: Some("string".to_string()),
        ..Default::default()
    };

    let response = i_t_automation_create_user_group(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

body = Falcon::ItautomationCreateUserGroupRequest.new(
  description: 'string',
  name: 'string'
)

response = api.i_t_automation_create_user_group(body)

puts response

Responses

[
  {
    "created_by": "string",
    "created_time": "string",
    "description": "string",
    "id": "string",
    "modified_by": "string",
    "modified_time": "string",
    "name": "string",
    "task_group_ids": [],
    "task_ids": [],
    "users": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationDeletePolicy

Deletes 1 or more policies.

Method DELETE

Route /it-automation/entities/policies/v1

Scope IT Automation - Policies: WRITE

PEP 8 delete_policy

Parameters

ids query · string or list of strings

list of task ids to delete

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_policy(ids=id_list)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ITAutomationDeletePolicy(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ITAutomationDeletePolicy",
                          ids=id_list)
print(response)

Remove-FalconItPolicy -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ItAutomation.ITAutomationDeletePolicy(
    &it_automation.ITAutomationDeletePolicyParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationDeletePolicy(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_delete_policy;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = i_t_automation_delete_policy(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

response = api.i_t_automation_delete_policy(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationDeleteScheduledTasks

Delete one or more scheduled tasks by providing the scheduled tasks IDs

Method DELETE

Route /it-automation/entities/scheduled-tasks/v1

Scope IT Automation - Task Executions: WRITE

PEP 8 delete_scheduled_task

Parameters

ids query · string or list of strings

Comma separated values of scheduled task IDs to delete

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_scheduled_task(ids=id_list)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ITAutomationDeleteScheduledTasks(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ITAutomationDeleteScheduledTasks",
                          ids=id_list)
print(response)

Remove-FalconItScheduledTask -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ItAutomation.ITAutomationDeleteScheduledTasks(
    &it_automation.ITAutomationDeleteScheduledTasksParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationDeleteScheduledTasks(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_delete_scheduled_tasks;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = i_t_automation_delete_scheduled_tasks(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

response = api.i_t_automation_delete_scheduled_tasks(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationDeleteTask

Deletes tasks for each provided ID

Method DELETE

Route /it-automation/entities/tasks/v1

Scope IT Automation - Tasks: WRITE

PEP 8 delete_task

Parameters

ids query · string or list of strings

IDs of tasks to delete. Use ITAutomationSearchTasks to fetch IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_task(ids=id_list)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ITAutomationDeleteTask(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ITAutomationDeleteTask",
                          ids=id_list)
print(response)

Remove-FalconItTask -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ItAutomation.ITAutomationDeleteTask(
    &it_automation.ITAutomationDeleteTaskParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationDeleteTask(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_delete_task;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = i_t_automation_delete_task(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

response = api.i_t_automation_delete_task(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationDeleteTaskGroups

Delete one or more task groups by providing the task group IDs

Method DELETE

Route /it-automation/entities/task-groups/v1

Scope IT Automation - Tasks: WRITE

PEP 8 delete_task_groups

Parameters

ids query · string or list of strings

Comma separated values of task group IDs to delete

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_task_groups(ids=id_list)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ITAutomationDeleteTaskGroups(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ITAutomationDeleteTaskGroups",
                          ids=id_list)
print(response)

Remove-FalconItTaskGroup -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ItAutomation.ITAutomationDeleteTaskGroups(
    &it_automation.ITAutomationDeleteTaskGroupsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationDeleteTaskGroups(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_delete_task_groups;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = i_t_automation_delete_task_groups(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

response = api.i_t_automation_delete_task_groups(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationDeleteUserGroup

Deletes user groups for each provided ids

Method DELETE

Route /it-automation/entities/it-user-groups/v1

Scope IT Automation - User Groups: WRITE

PEP 8 delete_user_groups

Parameters

ids query · string or list of strings

Comma separated values of user group ids to delete

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_user_groups(ids=id_list)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ITAutomationDeleteUserGroup(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ITAutomationDeleteUserGroup",
                          ids=id_list)
print(response)

Remove-FalconItUserGroup -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ItAutomation.ITAutomationDeleteUserGroup(
    &it_automation.ITAutomationDeleteUserGroupParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationDeleteUserGroup(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_delete_user_group;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = i_t_automation_delete_user_group(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

response = api.i_t_automation_delete_user_group(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationGetAssociatedTasks

Retrieve tasks associated with the provided file id

Method GET

Route /it-automation/combined/associated-tasks/v1

Scope IT Automation - Tasks: READ

PEP 8 get_associated_tasks

Parameters

id query · string

The ID of the file to fetch associated tasks for

filter query · string

The filter expression that should be used to limit the results

sort query · string

The sort expression that should be used to sort the results

offset query · integer

Starting index for record retrieval. Example: 100

limit query · integer

The maximum records to return. Example: 50

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.get_associated_tasks(id="string",
                                       filter="string",
                                       sort="string",
                                       offset=integer,
                                       limit=integer)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.ITAutomationGetAssociatedTasks(id="string",
                                                 filter="string",
                                                 sort="string",
                                                 offset=integer,
                                                 limit=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ITAutomationGetAssociatedTasks",
                          id="string",
                          filter="string",
                          sort="string",
                          offset=integer,
                          limit=integer)
print(response)

Get-FalconItFileTask -Id "string" `
  -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  offset := int64(0)
  limit := int64(0)

  response, err := client.ItAutomation.ITAutomationGetAssociatedTasks(
    &it_automation.ITAutomationGetAssociatedTasksParams{
      ID: "string",
      Filter: &filter,
      Sort: &sort,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationGetAssociatedTasks(
  "string",  // id
  "string",  // filter
  "string",  // sort
  integer,  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_get_associated_tasks;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = i_t_automation_get_associated_tasks(
        &falcon.cfg,  // configuration
        "string",  // id
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

response = api.i_t_automation_get_associated_tasks('string')

puts response

Responses

[
  {
    "id": "string",
    "name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationGetExecutionResults

Get the task execution results from an async search.

Method GET

Route /it-automation/entities/task-execution-results/v1

Scope IT Automation - Task Executions: READ

PEP 8 get_execution_results

Parameters

id query · string

The Job ID to fetch. Use the value returned from ITAutomationStartExecutionResultsSearch

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum number of event results to return

sort query · string

Sort results by one of the fields in the event results, either asc (ascending) or desc (descending)

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.get_execution_results(id="string",
                                        offset=integer,
                                        limit=integer,
                                        sort="string")
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.ITAutomationGetExecutionResults(id="string",
                                                  offset=integer,
                                                  limit=integer,
                                                  sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ITAutomationGetExecutionResults",
                          id="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

Get-FalconItTaskExecutionSearch -Id "string" -HostResult $boolean

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.ItAutomation.ITAutomationGetExecutionResults(
    &it_automation.ITAutomationGetExecutionResultsParams{
      ID: "string",
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationGetExecutionResults(
  "string",  // id
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_get_execution_results;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = i_t_automation_get_execution_results(
        &falcon.cfg,  // configuration
        "string",  // id
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

response = api.i_t_automation_get_execution_results('string')

puts response

Responses

[
  {}
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationGetExecutionResultsSearchStatus

Get the status of an async task execution results.

Method GET

Route /it-automation/entities/task-execution-results-search/v1

Scope IT Automation - Task Executions: READ

PEP 8 get_execution_results_search_status

Parameters

id query · string

Search Job ID to fetch. UseITAutomationStartExecutionResultsSearch to get the job id

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.get_execution_results_search_status(id="string")
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.ITAutomationGetExecutionResultsSearchStatus(id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ITAutomationGetExecutionResultsSearchStatus",
                          id="string")
print(response)

Get-FalconItTaskExecutionSearch -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ItAutomation.ITAutomationGetExecutionResultsSearchStatus(
    &it_automation.ITAutomationGetExecutionResultsSearchStatusParams{
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationGetExecutionResultsSearchStatus("string");  // id

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_get_execution_results_search_status;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = i_t_automation_get_execution_results_search_status(
        &falcon.cfg,  // configuration
        "string",  // id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

response = api.i_t_automation_get_execution_results_search_status('string')

puts response

Responses

[
  {
    "event_count": 0,
    "is_pending": false,
    "job_id": "string",
    "percent_complete": 0,
    "result_count": 0,
    "status": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationGetPolicies

Retrieves the configuration for 1 or more policies.

Method GET

Route /it-automation/entities/policies/v1

Scope IT Automation - Policies: READ

PEP 8 get_policies

Parameters

ids query · string or list of strings

One or more (up to 500) policy ids in the form of ids=ID1&ids=ID2

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_policies(ids=id_list)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ITAutomationGetPolicies(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ITAutomationGetPolicies",
                          ids=id_list)
print(response)

Get-FalconItPolicy -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ItAutomation.ITAutomationGetPolicies(
    &it_automation.ITAutomationGetPoliciesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationGetPolicies(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_get_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = i_t_automation_get_policies(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

response = api.i_t_automation_get_policies(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "config": {},
    "created_at": "string",
    "created_by": "string",
    "description": "string",
    "host_groups": [],
    "id": "string",
    "is_enabled": false,
    "modified_at": "string",
    "modified_by": "string",
    "name": "string",
    "precedence": 0,
    "target": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationGetScheduledTasks

Returns scheduled tasks for each provided id

Method GET

Route /it-automation/entities/scheduled-tasks/v1

Scope IT Automation - Task Executions: READ

PEP 8 get_scheduled_task

Parameters

ids query · string or list of strings

Scheduled task IDs to fetch. Use ITAutomationSearchScheduledTasks to fetch scheduled task IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_scheduled_task(ids=id_list)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ITAutomationGetScheduledTasks(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ITAutomationGetScheduledTasks",
                          ids=id_list)
print(response)

Get-FalconItScheduledTask -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ItAutomation.ITAutomationGetScheduledTasks(
    &it_automation.ITAutomationGetScheduledTasksParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationGetScheduledTasks(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_get_scheduled_tasks;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = i_t_automation_get_scheduled_tasks(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

response = api.i_t_automation_get_scheduled_tasks(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "created_by": "string",
    "created_time": "string",
    "discover_new_hosts": false,
    "discover_offline_hosts": false,
    "distribute": false,
    "execution_args": {},
    "expiration_interval": "string",
    "groups": [],
    "guardrails": {},
    "id": "string",
    "is_active": false,
    "is_preset": false,
    "last_run": "string",
    "modified_by": "string",
    "modified_time": "string",
    "next_run_time": "string",
    "schedule": {},
    "schedule_name": "string",
    "target": "string",
    "task_id": "string",
    "task_name": "string",
    "task_type": "string",
    "trigger_condition": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationGetTaskExecution

Get the task execution for the provided task execution IDs

Method GET

Route /it-automation/entities/task-executions/v1

Scope IT Automation - Task Executions: READ

PEP 8 get_execution

Parameters

ids query · string or list of strings

Task execution IDs to fetch. Use ITAutomationSearchTaskExecutions to get the execution id

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_execution(ids=id_list)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ITAutomationGetTaskExecution(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ITAutomationGetTaskExecution",
                          ids=id_list)
print(response)

Get-FalconItTaskExecution -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ItAutomation.ITAutomationGetTaskExecution(
    &it_automation.ITAutomationGetTaskExecutionParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationGetTaskExecution(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_get_task_execution;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = i_t_automation_get_task_execution(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

response = api.i_t_automation_get_task_execution(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "composite_query": {},
    "discover_new_hosts": false,
    "discover_offline_hosts": false,
    "distribute": false,
    "execution_args": {},
    "expiration_interval": "string",
    "guardrails": {},
    "id": "string",
    "os_query": "string",
    "platforms": [],
    "queries": {},
    "remediations": {},
    "run_by": "string",
    "run_type": "string",
    "status_by_stage": {},
    "target": "string",
    "task_id": "string",
    "task_name": "string",
    "task_parameters": [],
    "task_type": "string",
    "trigger_condition": [],
    "verification_condition": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationGetTaskExecutionHostStatus

Get the status of host executions by providing the execution IDs

Method GET

Route /it-automation/entities/task-execution-host-status/v1

Scope IT Automation - Task Executions: READ

PEP 8 get_execution_host_status

Parameters

ids query · string or list of strings

Task execution IDs to get statuses for. Use ITAutomationSearchTaskExecutions to fetch execution IDs

filter query · string

The filter expression that should be used to limit the results

sort query · string

The sort expression that should be used to sort the results

offset query · integer

Starting index for record retrieval. Example: 100

limit query · integer

The maximum records to return. Example: 50

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_execution_host_status(ids=id_list,
                                            filter="string",
                                            sort="string",
                                            offset=integer,
                                            limit=integer)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ITAutomationGetTaskExecutionHostStatus(ids=id_list,
                                                         filter="string",
                                                         sort="string",
                                                         offset=integer,
                                                         limit=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ITAutomationGetTaskExecutionHostStatus",
                          ids=id_list,
                          filter="string",
                          sort="string",
                          offset=integer,
                          limit=integer)
print(response)

Get-FalconItHostExecution -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  offset := int64(0)
  limit := int64(0)

  response, err := client.ItAutomation.ITAutomationGetTaskExecutionHostStatus(
    &it_automation.ITAutomationGetTaskExecutionHostStatusParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Filter: &filter,
      Sort: &sort,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationGetTaskExecutionHostStatus(
  ["ID1", "ID2", "ID3"],  // ids
  "string",  // filter
  "string",  // sort
  integer,  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_get_task_execution_host_status;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = i_t_automation_get_task_execution_host_status(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

response = api.i_t_automation_get_task_execution_host_status(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "end_time": "string",
    "host_id": "string",
    "hostname": "string",
    "it_automation_policy": {},
    "platform": "string",
    "reason": "string",
    "remote_response_policy": {},
    "stage": "string",
    "start_time": "string",
    "status": "string",
    "task_execution_id": "string",
    "total_results": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationGetTaskExecutionsByQuery

Returns the list of task executions (and their details) matching the filter query parameter.

Method GET

Route /it-automation/combined/task-executions/v1

Scope IT Automation - Task Executions: READ

PEP 8 get_executions_by_query

Parameters

filter query · string

The filter expression that should be used to limit the results

sort query · string

The sort expression that should be used to sort the results

offset query · integer

Starting index for record retrieval. Example: 100

limit query · integer

The maximum records to return. Example: 50

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.get_executions_by_query(filter="string",
                                          sort="string",
                                          offset=integer,
                                          limit=integer)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.ITAutomationGetTaskExecutionsByQuery(filter="string",
                                                       sort="string",
                                                       offset=integer,
                                                       limit=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ITAutomationGetTaskExecutionsByQuery",
                          filter="string",
                          sort="string",
                          offset=integer,
                          limit=integer)
print(response)

Get-FalconItTaskExecution -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  offset := int64(0)
  limit := int64(0)

  response, err := client.ItAutomation.ITAutomationGetTaskExecutionsByQuery(
    &it_automation.ITAutomationGetTaskExecutionsByQueryParams{
      Filter: &filter,
      Sort: &sort,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationGetTaskExecutionsByQuery(
  "string",  // filter
  "string",  // sort
  integer,  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_get_task_executions_by_query;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = i_t_automation_get_task_executions_by_query(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

response = api.i_t_automation_get_task_executions_by_query(filter: 'string',
                                                           sort: 'string',
                                                           offset: integer,
                                                           limit: integer)

puts response

Responses

[
  {
    "composite_query": {},
    "discover_new_hosts": false,
    "discover_offline_hosts": false,
    "distribute": false,
    "execution_args": {},
    "expiration_interval": "string",
    "guardrails": {},
    "id": "string",
    "os_query": "string",
    "platforms": [],
    "queries": {},
    "remediations": {},
    "run_by": "string",
    "run_type": "string",
    "status_by_stage": {},
    "target": "string",
    "task_id": "string",
    "task_name": "string",
    "task_parameters": [],
    "task_type": "string",
    "trigger_condition": [],
    "verification_condition": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationGetTaskGroups

Returns task groups for each provided id

Method GET

Route /it-automation/entities/task-groups/v1

Scope IT Automation - Tasks: READ

PEP 8 get_task_group

Parameters

ids query · string or list of strings

Comma separated values of task group ids to fetch

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_task_group(ids=id_list)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ITAutomationGetTaskGroups(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ITAutomationGetTaskGroups",
                          ids=id_list)
print(response)

Get-FalconItTaskGroup -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ItAutomation.ITAutomationGetTaskGroups(
    &it_automation.ITAutomationGetTaskGroupsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationGetTaskGroups(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_get_task_groups;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = i_t_automation_get_task_groups(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

response = api.i_t_automation_get_task_groups(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "access_type": "string",
    "assigned_user_group_ids": [],
    "assigned_user_ids": [],
    "created_by": "string",
    "created_time": "string",
    "description": "string",
    "id": "string",
    "is_preset": false,
    "modified_by": "string",
    "modified_time": "string",
    "name": "string",
    "supported_os": [],
    "task_ids": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "access_type": "string",
      "assigned_user_group_ids": [],
      "assigned_user_ids": [],
      "created_by": "string",
      "created_time": "string",
      "description": "string",
      "id": "string",
      "is_preset": false,
      "modified_by": "string",
      "modified_time": "string",
      "name": "string",
      "supported_os": [],
      "task_ids": []
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationGetTaskGroupsByQuery

Returns full details of task groups matching the filter query parameter.

Method GET

Route /it-automation/combined/task-groups/v1

Scope IT Automation - Tasks: READ

PEP 8 get_task_groups_by_query

Parameters

filter query · string

The filter expression that should be used to limit the results

sort query · string

The sort expression that should be used to sort the results

offset query · integer

Starting index for record retrieval. Example: 100

limit query · integer

The maximum records to return. Example: 50

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.get_task_groups_by_query(filter="string",
                                           sort="string",
                                           offset=integer,
                                           limit=integer)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.ITAutomationGetTaskGroupsByQuery(filter="string",
                                                   sort="string",
                                                   offset=integer,
                                                   limit=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ITAutomationGetTaskGroupsByQuery",
                          filter="string",
                          sort="string",
                          offset=integer,
                          limit=integer)
print(response)

Get-FalconItTaskGroup -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  offset := int64(0)
  limit := int64(0)

  response, err := client.ItAutomation.ITAutomationGetTaskGroupsByQuery(
    &it_automation.ITAutomationGetTaskGroupsByQueryParams{
      Filter: &filter,
      Sort: &sort,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationGetTaskGroupsByQuery(
  "string",  // filter
  "string",  // sort
  integer,  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_get_task_groups_by_query;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = i_t_automation_get_task_groups_by_query(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

response = api.i_t_automation_get_task_groups_by_query(filter: 'string',
                                                       sort: 'string',
                                                       offset: integer,
                                                       limit: integer)

puts response

Responses

[
  {
    "access_type": "string",
    "assigned_user_group_ids": [],
    "assigned_user_ids": [],
    "created_by": "string",
    "created_time": "string",
    "description": "string",
    "id": "string",
    "is_preset": false,
    "modified_by": "string",
    "modified_time": "string",
    "name": "string",
    "supported_os": [],
    "task_ids": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "access_type": "string",
      "assigned_user_group_ids": [],
      "assigned_user_ids": [],
      "created_by": "string",
      "created_time": "string",
      "description": "string",
      "id": "string",
      "is_preset": false,
      "modified_by": "string",
      "modified_time": "string",
      "name": "string",
      "supported_os": [],
      "task_ids": []
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationGetTasks

Returns tasks for each provided ID

Method GET

Route /it-automation/entities/tasks/v1

Scope IT Automation - Tasks: READ

PEP 8 get_tasks

Parameters

ids query · string or list of strings

IDs of tasks to fetch. Use ITAutomationSearchTasks to fetch IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_tasks(ids=id_list)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ITAutomationGetTasks(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ITAutomationGetTasks",
                          ids=id_list)
print(response)

Get-FalconItTask -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ItAutomation.ITAutomationGetTasks(
    &it_automation.ITAutomationGetTasksParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationGetTasks(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_get_tasks;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = i_t_automation_get_tasks(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

response = api.i_t_automation_get_tasks(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "access_type": "string",
    "assigned_user_group_ids": [],
    "assigned_user_ids": [],
    "composite_query": {},
    "created_by": "string",
    "created_time": "string",
    "description": "string",
    "groups": [],
    "has_task_parameters": false,
    "id": "string",
    "last_run_time": "string",
    "modified_by": "string",
    "modified_time": "string",
    "name": "string",
    "os_query": "string",
    "output_parser_config": {},
    "queries": {},
    "remediations": {},
    "rows_parser_config": {},
    "runs": 0,
    "supported_os": [],
    "target": "string",
    "task_parameters": [],
    "task_type": "string",
    "trigger_condition": [],
    "verification_condition": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationGetTasksByQuery

Returns full details of tasks matching the filter query parameter.

Method GET

Route /it-automation/combined/tasks/v1

Scope IT Automation - Tasks: READ

PEP 8 get_tasks_by_query

Parameters

filter query · string

The filter expression that should be used to limit the results

sort query · string

The sort expression that should be used to sort the results

offset query · integer

Starting index for record retrieval. Example: 100

limit query · integer

The maximum records to return. Example: 50

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.get_tasks_by_query(filter="string",
                                     sort="string",
                                     offset=integer,
                                     limit=integer)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.ITAutomationGetTasksByQuery(filter="string",
                                              sort="string",
                                              offset=integer,
                                              limit=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ITAutomationGetTasksByQuery",
                          filter="string",
                          sort="string",
                          offset=integer,
                          limit=integer)
print(response)

Get-FalconItTask -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  offset := int64(0)
  limit := int64(0)

  response, err := client.ItAutomation.ITAutomationGetTasksByQuery(
    &it_automation.ITAutomationGetTasksByQueryParams{
      Filter: &filter,
      Sort: &sort,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationGetTasksByQuery(
  "string",  // filter
  "string",  // sort
  integer,  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_get_tasks_by_query;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = i_t_automation_get_tasks_by_query(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

response = api.i_t_automation_get_tasks_by_query(filter: 'string',
                                                 sort: 'string',
                                                 offset: integer,
                                                 limit: integer)

puts response

Responses

[
  {
    "access_type": "string",
    "assigned_user_group_ids": [],
    "assigned_user_ids": [],
    "composite_query": {},
    "created_by": "string",
    "created_time": "string",
    "description": "string",
    "groups": [],
    "has_task_parameters": false,
    "id": "string",
    "last_run_time": "string",
    "modified_by": "string",
    "modified_time": "string",
    "name": "string",
    "os_query": "string",
    "output_parser_config": {},
    "queries": {},
    "remediations": {},
    "rows_parser_config": {},
    "runs": 0,
    "supported_os": [],
    "target": "string",
    "task_parameters": [],
    "task_type": "string",
    "trigger_condition": [],
    "verification_condition": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationGetUserGroup

Returns user groups for each provided id

Method GET

Route /it-automation/entities/it-user-groups/v1

Scope IT Automation - User Groups: READ

PEP 8 get_user_group

Parameters

ids query · string or list of strings

Comma separated values of user group ids to fetch

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_user_group(ids=id_list)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ITAutomationGetUserGroup(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ITAutomationGetUserGroup",
                          ids=id_list)
print(response)

Get-FalconItUserGroup -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ItAutomation.ITAutomationGetUserGroup(
    &it_automation.ITAutomationGetUserGroupParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationGetUserGroup(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_get_user_group;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = i_t_automation_get_user_group(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

response = api.i_t_automation_get_user_group(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "created_by": "string",
    "created_time": "string",
    "description": "string",
    "id": "string",
    "modified_by": "string",
    "modified_time": "string",
    "name": "string",
    "task_group_ids": [],
    "task_ids": [],
    "users": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationQueryPolicies

Returns the list of policy ids matching the filter query parameter.

Method GET

Route /it-automation/queries/policies/v1

Scope IT Automation - Policies: READ

PEP 8 query_policies

Parameters

offset query · integer

The offset to start retrieving records from. Defaults to 0 if not specified.

limit query · integer

The maximum number of ids to return. Defaults to 100 if not specified. The maximum number of results that can be returned in a single call is 500.

sort query · string

The sort expression that should be used to sort the results

platform query · string

The platform of policies to retrieve

Available values (3)

Windows Mac Linux

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.query_policies(offset=integer,
                                 limit=integer,
                                 sort="string",
                                 platform="string")
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.ITAutomationQueryPolicies(offset=integer,
                                            limit=integer,
                                            sort="string",
                                            platform="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ITAutomationQueryPolicies",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          platform="string")
print(response)

Get-FalconItPolicy -Platform "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.ItAutomation.ITAutomationQueryPolicies(
    &it_automation.ITAutomationQueryPoliciesParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Platform: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationQueryPolicies(
  "string",  // platform
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_query_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = i_t_automation_query_policies(
        &falcon.cfg,  // configuration
        "string",  // platform
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

response = api.i_t_automation_query_policies('string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationRerunTaskExecution

Rerun the task execution specified in the request

Method POST

Route /it-automation/entities/task-execution-rerun/v1

Scope IT Automation - Task Executions: WRITE

PEP 8 rerun_execution

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

run_type body · string

[Deprecated: use run_types] Type of rerun. When set to hosts, re-run on same hosts again. When set to failed, re-run only on failed hosts. When set to offline, re-run only on offline hosts. When set to target, re-run on all the hosts resolved to set criteria.

Available values (4)

`hosts`	`failed`	`offline`
`target`

run_types body · array

Types of reruns to combine with OR logic. Cannot be used with run_type. Example: [‘failed’, ‘offline’]

Available values (7)

`hosts`	`failed`	`offline`
`target`	`completed`	`canceled`
`expired`

task_execution_id body · string

ID of the task execution to rerun. Example: f64b95555ef54ea682619ce880d267cc

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.rerun_execution(run_type="string", task_execution_id="string")
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.ITAutomationRerunTaskExecution(run_type="string",
                                                 task_execution_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "run_type": "string",
    "run_types": ["string"],
    "task_execution_id": "string"
}

response = falcon.command("ITAutomationRerunTaskExecution", body=body_payload)
print(response)

Redo-FalconItTaskExecution -RunType "string" -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  run_type := "string"
  task_execution_id := "string"

  response, err := client.ItAutomation.ITAutomationRerunTaskExecution(
    &it_automation.ITAutomationRerunTaskExecutionParams{
      Body: &models.ItautomationRerunTaskExecutionRequest{
        RunType: &run_type,
        RunTypes: []string{"string"},
        TaskExecutionID: &task_execution_id,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationRerunTaskExecution(
  {
    runType: "string",
    runTypes: [],
    taskExecutionId: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_rerun_task_execution;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ItautomationRerunTaskExecutionRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ItautomationRerunTaskExecutionRequest {
        task_execution_id: Some("string".to_string()),
        ..Default::default()
    };

    let response = i_t_automation_rerun_task_execution(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

body = Falcon::ItautomationRerunTaskExecutionRequest.new(
  run_type: 'string',
  run_types: [],
  task_execution_id: 'string'
)

response = api.i_t_automation_rerun_task_execution(body)

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationRunLiveQuery

Starts a new task execution from the provided query data in the request and returns the initiated task executions

Method POST

Route /it-automation/entities/live-query-execution/v1

Scope IT Automation - Task Executions: WRITE

PEP 8 run_live_query

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

composite_query body · object

Specifies task ids and host attributes for composite querying

discover_new_hosts body · boolean

Whether to discover new hosts for the scheduled task. Example: true

discover_offline_hosts body · boolean

Whether to discover offline hosts for the scheduled task. Example: true

distribute body · boolean

Whether to distribute the scheduled task. Example: true

expiration_interval body · string

Duration for which the task stays active. Once expired, new and offline hosts won’t be targeted. Example: 1m

guardrails body · object

Execution guardrails and limits

osquery body · string

OSQuery to execute. Example: select * from users

output_parser_config body · object

Specifies columns and delimiter for parsing script execution results

queries body · object

Script queries to run per platform

rows_parser_config body · object

Configuration for parsing script output into multiple rows

target body · string

Target filter in FQL format. Example: platform_name: ‘Windows’

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

guardrails = {
    "run_time_limit_millis": 0
}

output_parser_config = {
    "columns": [
        {
            "name": "string"
        }
    ],
    "default_group_by": "boolean",
    "delimiter": "string"
}

queries = {
    "linux": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    },
    "mac": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    },
    "windows": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    }
}

response = falcon.run_live_query(discover_new_hosts=boolean,
                                 discover_offline_hosts=boolean,
                                 distribute=boolean,
                                 expiration_interval="string",
                                 guardrails=guardrails,
                                 osquery="string",
                                 output_parser_config=output_parser_config,
                                 queries=queries,
                                 target="string")
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

guardrails = {
    "run_time_limit_millis": 0
}

output_parser_config = {
    "columns": [
        {
            "name": "string"
        }
    ],
    "default_group_by": "boolean",
    "delimiter": "string"
}

queries = {
    "linux": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    },
    "mac": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    },
    "windows": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    }
}

response = falcon.ITAutomationRunLiveQuery(discover_new_hosts=boolean,
                                           discover_offline_hosts=boolean,
                                           distribute=boolean,
                                           expiration_interval="string",
                                           guardrails=guardrails,
                                           osquery="string",
                                           output_parser_config=output_parser_config,
                                           queries=queries,
                                           target="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "composite_query": {
        "host_attributes": ["string"],
        "task_ids": ["string"]
    },
    "discover_new_hosts": boolean,
    "discover_offline_hosts": boolean,
    "distribute": boolean,
    "expiration_interval": "string",
    "guardrails": {
        "run_time_limit_millis": integer
    },
    "osquery": "string",
    "output_parser_config": {
        "columns": [
            {
                "name": "string"
            }
        ],
        "default_group_by": boolean,
        "delimiter": "string"
    },
    "queries": {
        "linux": {
            "action_type": "string",
            "content": "string",
            "file_ids": ["string"],
            "language": "string",
            "script_args": "string",
            "script_file_id": "string"
        },
        "mac": {
            "action_type": "string",
            "content": "string",
            "file_ids": ["string"],
            "language": "string",
            "script_args": "string",
            "script_file_id": "string"
        },
        "windows": {
            "action_type": "string",
            "content": "string",
            "file_ids": ["string"],
            "language": "string",
            "script_args": "string",
            "script_file_id": "string"
        }
    },
    "rows_parser_config": {
        "delimiter": "string"
    },
    "target": "string"
}

response = falcon.command("ITAutomationRunLiveQuery", body=body_payload)
print(response)

Invoke-FalconItTask -Target "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  discover_new_hosts := boolean
  discover_offline_hosts := boolean
  distribute := boolean
  expiration_interval := "string"
  osquery := "string"
  target := "string"

  response, err := client.ItAutomation.ITAutomationRunLiveQuery(
    &it_automation.ITAutomationRunLiveQueryParams{
      Body: &models.ItautomationRunLiveQueryRequest{
        CompositeQuery: &struct{}{},
        DiscoverNewHosts: &discover_new_hosts,
        DiscoverOfflineHosts: &discover_offline_hosts,
        Distribute: &distribute,
        ExpirationInterval: &expiration_interval,
        Guardrails: &struct{}{},
        Osquery: &osquery,
        OutputParserConfig: &struct{}{},
        Queries: &struct{}{},
        RowsParserConfig: &struct{}{},
        Target: &target,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationRunLiveQuery(
  {
    compositeQuery: {
      hostAttributes: [],
      taskIds: []
    },
    discoverNewHosts: boolean,
    discoverOfflineHosts: boolean,
    distribute: boolean,
    expirationInterval: "string",
    guardrails: {
      runTimeLimitMillis: integer
    },
    osquery: "string",
    outputParserConfig: {
      columns: [{
          name: "string"
        }],
      defaultGroupBy: boolean,
      delimiter: "string"
    },
    queries: {
      linux: {
        actionType: "string",
        content: "string",
        fileIds: [],
        language: "string",
        scriptArgs: "string",
        scriptFileId: "string"
      },
      mac: {
        actionType: "string",
        content: "string",
        fileIds: [],
        language: "string",
        scriptArgs: "string",
        scriptFileId: "string"
      },
      windows: {
        actionType: "string",
        content: "string",
        fileIds: [],
        language: "string",
        scriptArgs: "string",
        scriptFileId: "string"
      }
    },
    rowsParserConfig: {
      delimiter: "string"
    },
    target: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_run_live_query;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ItautomationRunLiveQueryRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ItautomationRunLiveQueryRequest {
        target: Some("string".to_string()),
        ..Default::default()
    };

    let response = i_t_automation_run_live_query(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

body = Falcon::ItautomationRunLiveQueryRequest.new(
  composite_query: {
    host_attributes: [],
    task_ids: []
  },
  discover_new_hosts: boolean,
  discover_offline_hosts: boolean,
  distribute: boolean,
  expiration_interval: 'string',
  guardrails: {
    run_time_limit_millis: integer
  },
  osquery: 'string',
  output_parser_config: {
    columns: [{
        name: 'string'
      }],
    default_group_by: boolean,
    delimiter: 'string'
  },
  queries: {
    linux: {
      action_type: 'string',
      content: 'string',
      file_ids: [],
      language: 'string',
      script_args: 'string',
      script_file_id: 'string'
    },
    mac: {
      action_type: 'string',
      content: 'string',
      file_ids: [],
      language: 'string',
      script_args: 'string',
      script_file_id: 'string'
    },
    windows: {
      action_type: 'string',
      content: 'string',
      file_ids: [],
      language: 'string',
      script_args: 'string',
      script_file_id: 'string'
    }
  },
  rows_parser_config: {
    delimiter: 'string'
  },
  target: 'string'
)

response = api.i_t_automation_run_live_query(body)

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationSearchScheduledTasks

Returns the list of scheduled task IDs matching the filter query parameter

Method GET

Route /it-automation/queries/scheduled-tasks/v1

Scope IT Automation - Task Executions: READ

PEP 8 search_scheduled_tasks

Parameters

filter query · string

The filter expression that should be used to limit the results

sort query · string

The sort expression that should be used to sort the results

offset query · integer

Starting index for record retrieval. Example: 100

limit query · integer

The maximum records to return. Example: 50

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.search_scheduled_tasks(filter="string",
                                         sort="string",
                                         offset=integer,
                                         limit=integer)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.ITAutomationSearchScheduledTasks(filter="string",
                                                   sort="string",
                                                   offset=integer,
                                                   limit=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ITAutomationSearchScheduledTasks",
                          filter="string",
                          sort="string",
                          offset=integer,
                          limit=integer)
print(response)

Get-FalconItScheduledTask -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  offset := int64(0)
  limit := int64(0)

  response, err := client.ItAutomation.ITAutomationSearchScheduledTasks(
    &it_automation.ITAutomationSearchScheduledTasksParams{
      Filter: &filter,
      Sort: &sort,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationSearchScheduledTasks(
  "string",  // filter
  "string",  // sort
  integer,  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_search_scheduled_tasks;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = i_t_automation_search_scheduled_tasks(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

response = api.i_t_automation_search_scheduled_tasks(filter: 'string',
                                                     sort: 'string',
                                                     offset: integer,
                                                     limit: integer)

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationSearchTaskExecutions

Returns the list of task execution IDs matching the filter query parameter.

Method GET

Route /it-automation/queries/task-executions/v1

Scope IT Automation - Task Executions: READ

PEP 8 search_task_executions

Parameters

filter query · string

The filter expression that should be used to limit the results

sort query · string

The sort expression that should be used to sort the results

offset query · integer

Starting index for record retrieval. Example: 100

limit query · integer

The maximum records to return. Example: 50

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.search_task_executions(filter="string",
                                         sort="string",
                                         offset=integer,
                                         limit=integer)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.ITAutomationSearchTaskExecutions(filter="string",
                                                   sort="string",
                                                   offset=integer,
                                                   limit=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ITAutomationSearchTaskExecutions",
                          filter="string",
                          sort="string",
                          offset=integer,
                          limit=integer)
print(response)

Get-FalconItTaskExecution -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  offset := int64(0)
  limit := int64(0)

  response, err := client.ItAutomation.ITAutomationSearchTaskExecutions(
    &it_automation.ITAutomationSearchTaskExecutionsParams{
      Filter: &filter,
      Sort: &sort,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationSearchTaskExecutions(
  "string",  // filter
  "string",  // sort
  integer,  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_search_task_executions;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = i_t_automation_search_task_executions(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

response = api.i_t_automation_search_task_executions(filter: 'string',
                                                     sort: 'string',
                                                     offset: integer,
                                                     limit: integer)

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationSearchTaskGroups

Returns the list of task group ids matching the filter query parameter

Method GET

Route /it-automation/queries/task-groups/v1

Scope IT Automation - Tasks: READ

PEP 8 search_task_groups

Parameters

filter query · string

The filter expression that should be used to limit the results

sort query · string

The sort expression that should be used to sort the results

offset query · integer

Starting index for record retrieval. Example: 100

limit query · integer

The maximum records to return. Example: 50

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.search_task_groups(filter="string",
                                     sort="string",
                                     offset=integer,
                                     limit=integer)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.ITAutomationSearchTaskGroups(filter="string",
                                               sort="string",
                                               offset=integer,
                                               limit=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ITAutomationSearchTaskGroups",
                          filter="string",
                          sort="string",
                          offset=integer,
                          limit=integer)
print(response)

Get-FalconItTaskGroup -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  offset := int64(0)
  limit := int64(0)

  response, err := client.ItAutomation.ITAutomationSearchTaskGroups(
    &it_automation.ITAutomationSearchTaskGroupsParams{
      Filter: &filter,
      Sort: &sort,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationSearchTaskGroups(
  "string",  // filter
  "string",  // sort
  integer,  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_search_task_groups;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = i_t_automation_search_task_groups(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

response = api.i_t_automation_search_task_groups(filter: 'string',
                                                 sort: 'string',
                                                 offset: integer,
                                                 limit: integer)

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationSearchTasks

Returns the list of task IDs matching the filter query parameter.

Method GET

Route /it-automation/queries/tasks/v1

Scope IT Automation - Tasks: READ

PEP 8 search_tasks

Parameters

filter query · string

The filter expression that should be used to limit the results

sort query · string

The sort expression that should be used to sort the results

offset query · integer

Starting index for record retrieval. Example: 100

limit query · integer

The maximum records to return. Example: 50

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.search_tasks(filter="string",
                               sort="string",
                               offset=integer,
                               limit=integer)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.ITAutomationSearchTasks(filter="string",
                                          sort="string",
                                          offset=integer,
                                          limit=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ITAutomationSearchTasks",
                          filter="string",
                          sort="string",
                          offset=integer,
                          limit=integer)
print(response)

Get-FalconItTask -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  offset := int64(0)
  limit := int64(0)

  response, err := client.ItAutomation.ITAutomationSearchTasks(
    &it_automation.ITAutomationSearchTasksParams{
      Filter: &filter,
      Sort: &sort,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationSearchTasks(
  "string",  // filter
  "string",  // sort
  integer,  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_search_tasks;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = i_t_automation_search_tasks(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

response = api.i_t_automation_search_tasks(filter: 'string',
                                           sort: 'string',
                                           offset: integer,
                                           limit: integer)

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationSearchUserGroup

Returns the list of user group ids matching the filter query parameter.

Method GET

Route /it-automation/queries/it-user-groups/v1

Scope IT Automation - User Groups: READ

PEP 8 search_user_groups

Parameters

filter query · string

The filter expression that should be used to limit the results

sort query · string

The sort expression that should be used to sort the results

offset query · integer

Starting index for record retrieval. Example: 100

limit query · integer

The maximum records to return. Example: 50

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.search_user_groups(filter="string",
                                     sort="string",
                                     offset=integer,
                                     limit=integer)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.ITAutomationSearchUserGroup(filter="string",
                                              sort="string",
                                              offset=integer,
                                              limit=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ITAutomationSearchUserGroup",
                          filter="string",
                          sort="string",
                          offset=integer,
                          limit=integer)
print(response)

Get-FalconItUserGroup -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  offset := int64(0)
  limit := int64(0)

  response, err := client.ItAutomation.ITAutomationSearchUserGroup(
    &it_automation.ITAutomationSearchUserGroupParams{
      Filter: &filter,
      Sort: &sort,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationSearchUserGroup(
  "string",  // filter
  "string",  // sort
  integer,  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_search_user_group;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = i_t_automation_search_user_group(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

response = api.i_t_automation_search_user_group(filter: 'string',
                                                sort: 'string',
                                                offset: integer,
                                                limit: integer)

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationStartExecutionResultsSearch

Starts an async task execution results search.

Method POST

Route /it-automation/entities/task-execution-results-search/v1

Scope IT Automation - Task Executions: READ

PEP 8 execution_results_search

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

filter_expressions body · array

Filter expressions to limit results. Example: [“hostname:*prod*“]

group_by_fields body · array

Fields to group results by. Example: [“hostname”, “status”]

search_end body · string

End time for the search period. Example: now

search_start body · string

Start time for the search period. Example: -1d

task_execution_id body · string

Unique identifier of the task execution to search. Example: f64b95555ef54ea682619ce880d267cc

end body · string

Task end.

start body · string

Task start.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.execution_results_search(end="string",
                                           filter_expressions=id_list,
                                           group_by_fields=id_list,
                                           start="string",
                                           task_execution_id="string")
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ITAutomationStartExecutionResultsSearch(end="string",
                                                          filter_expressions=id_list,
                                                          group_by_fields=id_list,
                                                          start="string",
                                                          task_execution_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "filter_expressions": ["string"],
    "group_by_fields": ["string"],
    "search_end": "string",
    "search_start": "string",
    "task_execution_id": "string"
}

response = falcon.command("ITAutomationStartExecutionResultsSearch", body=body_payload)
print(response)

Search-FalconItTaskExecution -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  search_end := "string"
  search_start := "string"
  task_execution_id := "string"

  response, err := client.ItAutomation.ITAutomationStartExecutionResultsSearch(
    &it_automation.ITAutomationStartExecutionResultsSearchParams{
      Body: &models.ItautomationSearchRequest{
        FilterExpressions: []string{"string"},
        GroupByFields: []string{"string"},
        SearchEnd: &search_end,
        SearchStart: &search_start,
        TaskExecutionID: &task_execution_id,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationStartExecutionResultsSearch(
  {
    filterExpressions: [],
    groupByFields: [],
    searchEnd: "string",
    searchStart: "string",
    taskExecutionId: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_start_execution_results_search;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ItautomationSearchRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ItautomationSearchRequest {
        search_end: Some("string".to_string()),
        search_start: Some("string".to_string()),
        task_execution_id: Some("string".to_string()),
        ..Default::default()
    };

    let response = i_t_automation_start_execution_results_search(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

body = Falcon::ItautomationSearchRequest.new(
  filter_expressions: [],
  group_by_fields: [],
  search_end: 'string',
  search_start: 'string',
  task_execution_id: 'string'
)

response = api.i_t_automation_start_execution_results_search(body)

puts response

Responses

[
  {
    "event_count": 0,
    "is_pending": false,
    "job_id": "string",
    "percent_complete": 0,
    "result_count": 0,
    "status": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationStartTaskExecution

Starts a new task execution from an existing task provided in the request and returns the initiated task executions

Method POST

Route /it-automation/entities/task-executions/v1

Scope IT Automation - Task Executions: WRITE

PEP 8 start_execution

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

discover_new_hosts body · boolean

Whether to discover new hosts for the scheduled task. Example: true

discover_offline_hosts body · boolean

Whether to discover offline hosts for the scheduled task. Example: true

distribute body · boolean

Whether to distribute the scheduled task. Example: true

execution_args body · object

Key-value pairs of argument values to pass to the execution. Example: {‘api_key’: ‘abc123’, ‘region’: ‘us-east-1’}

expiration_interval body · string

Duration for which the task stays active. Once expired, new and offline hosts won’t be targeted. Example: 1m

guardrails body · object

Execution guardrails and limits

scheduled_task_id body · string

Unique identifier of existing scheduled task. Scheduled task fields override all other request fields. Example: f64b95555ef54ea682619ce880d267cc

target body · string

Target filter in FQL format. Example: platform_name: ‘Windows’

task_id body · string

Unique identifier of existing saved task. Example: f64b95555ef54ea682619ce880d267cc

trigger_condition body · array

Conditions that trigger remediation scripts execution

arguments body · dictionary

Arguments to pass to the execution.

trigger_conditions body · list of dictionaries

List of task triggers.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

arguments = {
    "additionalProp1": "string",
    "additionalProp2": "string",
    "additionalProp3": "string"
}

guardrails = {
    "run_time_limit_millis": 0
}

response = falcon.start_execution(arguments=arguments,
                                  discover_new_hosts=boolean,
                                  discover_offline_hosts=boolean,
                                  distribute=boolean,
                                  expiration_interval="string",
                                  guardrails=guardrails,
                                  target="string",
                                  task_id="string",
                                  trigger_conditions=[{"key": "value"}])
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

arguments = {
    "additionalProp1": "string",
    "additionalProp2": "string",
    "additionalProp3": "string"
}

guardrails = {
    "run_time_limit_millis": 0
}

response = falcon.ITAutomationStartTaskExecution(arguments=arguments,
                                                 discover_new_hosts=boolean,
                                                 discover_offline_hosts=boolean,
                                                 distribute=boolean,
                                                 expiration_interval="string",
                                                 guardrails=guardrails,
                                                 target="string",
                                                 task_id="string",
                                                 trigger_conditions=[{"key": "value"}])
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "discover_new_hosts": boolean,
    "discover_offline_hosts": boolean,
    "distribute": boolean,
    "execution_args": {},
    "expiration_interval": "string",
    "guardrails": {
        "run_time_limit_millis": integer
    },
    "scheduled_task_id": "string",
    "target": "string",
    "task_id": "string",
    "trigger_condition": [
        {
            "groups": [
                {
                    "groups": ["string"],
                    "operator": "string",
                    "statements": ["string"]
                }
            ],
            "operator": "string",
            "statements": [
                {
                    "data_comparator": "string",
                    "data_type": "string",
                    "key": "string",
                    "task_id": "string",
                    "value": "string"
                }
            ]
        }
    ]
}

response = falcon.command("ITAutomationStartTaskExecution", body=body_payload)
print(response)

Invoke-FalconItTask -Id "string" -Target "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  discover_new_hosts := boolean
  discover_offline_hosts := boolean
  distribute := boolean
  expiration_interval := "string"
  scheduled_task_id := "string"
  target := "string"
  task_id := "string"
  operator := "string"
  data_comparator := "string"
  data_type := "string"
  key := "string"
  value := "string"

  response, err := client.ItAutomation.ITAutomationStartTaskExecution(
    &it_automation.ITAutomationStartTaskExecutionParams{
      Body: &models.ItautomationStartTaskExecutionRequest{
        DiscoverNewHosts: &discover_new_hosts,
        DiscoverOfflineHosts: &discover_offline_hosts,
        Distribute: &distribute,
        ExecutionArgs: &struct{}{},
        ExpirationInterval: &expiration_interval,
        Guardrails: &struct{}{},
        ScheduledTaskID: &scheduled_task_id,
        Target: &target,
        TaskID: &task_id,
        TriggerCondition: []interface{}{
          {
          Groups: []interface{}{
            {
            Groups: []interface{}{},
            Operator: &operator,
            Statements: []interface{}{},
            },
          },
          Operator: &operator,
          Statements: []interface{}{
            {
            DataComparator: &data_comparator,
            DataType: &data_type,
            Key: &key,
            TaskID: &task_id,
            Value: &value,
            },
          },
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationStartTaskExecution(
  {
    discoverNewHosts: boolean,
    discoverOfflineHosts: boolean,
    distribute: boolean,
    executionArgs: {},
    expirationInterval: "string",
    guardrails: {
      runTimeLimitMillis: integer
    },
    scheduledTaskId: "string",
    target: "string",
    taskId: "string",
    triggerCondition: [{
        groups: [{
            groups: [],
            operator: "string",
            statements: []
          }],
        operator: "string",
        statements: [{
            dataComparator: "string",
            dataType: "string",
            key: "string",
            taskId: "string",
            value: "string"
          }]
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_start_task_execution;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ItautomationStartTaskExecutionRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ItautomationStartTaskExecutionRequest {
        ..Default::default()
    };

    let response = i_t_automation_start_task_execution(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

body = Falcon::ItautomationStartTaskExecutionRequest.new(
  discover_new_hosts: boolean,
  discover_offline_hosts: boolean,
  distribute: boolean,
  execution_args: {},
  expiration_interval: 'string',
  guardrails: {
    run_time_limit_millis: integer
  },
  scheduled_task_id: 'string',
  target: 'string',
  task_id: 'string',
  trigger_condition: [{
      groups: [{
          groups: [],
          operator: 'string',
          statements: []
        }],
      operator: 'string',
      statements: [{
          data_comparator: 'string',
          data_type: 'string',
          key: 'string',
          task_id: 'string',
          value: 'string'
        }]
    }]
)

response = api.i_t_automation_start_task_execution(body)

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationUpdatePolicies

Updates a new policy of the specified type.

Method PATCH

Route /it-automation/entities/policies/v1

Scope IT Automation - Policies: WRITE

PEP 8 update_policy

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

config body · object

Configuration settings for the policy

description body · string

Description of the policy.Example: windows policy check

id body · string

ID of the policy. Example: f64b95555ef54ea682619ce880d267cc

is_enabled body · boolean

Whether the policy is enabled or disabled

name body · string

Name of the policy. Example: platform_policy

enable_script_execution body · boolean

Enable or disable script execution.

enable_python_execution body · boolean

Enable or disable Python execution.

enable_os_query body · boolean

Enable or disable OS Query.

execution_timeout body · integer

Specifies the timeout value for executions.

execution_timeout_unit body · string

Execution timeout unit. Allowed values:

Available values (2)

Hours Minutes

cpu_throttle body · integer

Specifies the CPU throttle value.

cpu_scheduling body · string

Sets priority to determine the order in which a query process will run on a host’s CPU.

memory_pressure_level body · string

Sets memory pressure level to control system resource allocation during task execution.

memory_allocation body · integer

Specifies the memory allocation value.

memory_allocation_unit body · string

Memory allocation unit. Allowed values:

Available values (2)

MB GB

concurrent_host_limit body · integer

Specifies the maximum number of concurrent hosts.

concurrent_task_limit body · integer

Specifies the maximum number of concurrent tasks.

concurrent_host_file_transfer_limit body · integer

Specifies the maximum number of concurrent file transfers.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.update_policy(id="string",
                                name="string",
                                description="string",
                                is_enabled=boolean,
                                enable_script_execution=boolean,
                                enable_python_execution=boolean,
                                enable_os_query=boolean,
                                execution_timeout=integer,
                                execution_timeout_unit="string",
                                cpu_throttle=integer,
                                cpu_scheduling="string",
                                memory_pressure_level="string",
                                memory_allocation=integer,
                                memory_allocation_unit="string",
                                concurrent_host_limit=integer,
                                concurrent_task_limit=integer,
                                concurrent_host_file_transfer_limit=integer)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.ITAutomationUpdatePolicies(id="string",
                                             name="string",
                                             description="string",
                                             is_enabled=boolean,
                                             enable_script_execution=boolean,
                                             enable_python_execution=boolean,
                                             enable_os_query=boolean,
                                             execution_timeout=integer,
                                             execution_timeout_unit="string",
                                             cpu_throttle=integer,
                                             cpu_scheduling="string",
                                             memory_pressure_level="string",
                                             memory_allocation=integer,
                                             memory_allocation_unit="string",
                                             concurrent_host_limit=integer,
                                             concurrent_task_limit=integer,
                                             concurrent_host_file_transfer_limit=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "config": {
        "concurrency": {
            "concurrent_host_file_transfer_limit": integer,
            "concurrent_host_limit": integer,
            "concurrent_task_limit": integer
        },
        "execution": {
            "enable_os_query": boolean,
            "enable_python_execution": boolean,
            "enable_script_execution": boolean,
            "execution_timeout": integer,
            "execution_timeout_unit": "string"
        },
        "resources": {
            "cpu_scheduling": "string",
            "cpu_throttle": integer,
            "memory_allocation": integer,
            "memory_allocation_unit": "string",
            "memory_pressure_level": "string"
        }
    },
    "description": "string",
    "id": "string",
    "is_enabled": boolean,
    "name": "string"
}

response = falcon.command("ITAutomationUpdatePolicies", body=body_payload)
print(response)

Edit-FalconItPolicy -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  id := "string"
  is_enabled := boolean
  name := "string"

  response, err := client.ItAutomation.ITAutomationUpdatePolicies(
    &it_automation.ITAutomationUpdatePoliciesParams{
      Body: &models.ItautomationUpdatePolicyRequest{
        Config: &struct{}{},
        Description: &description,
        ID: &id,
        IsEnabled: &is_enabled,
        Name: &name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationUpdatePolicies(
  {
    config: {
      concurrency: {
        concurrentHostFileTransferLimit: integer,
        concurrentHostLimit: integer,
        concurrentTaskLimit: integer
      },
      execution: {
        enableOsQuery: boolean,
        enablePythonExecution: boolean,
        enableScriptExecution: boolean,
        executionTimeout: integer,
        executionTimeoutUnit: "string"
      },
      resources: {
        cpuScheduling: "string",
        cpuThrottle: integer,
        memoryAllocation: integer,
        memoryAllocationUnit: "string",
        memoryPressureLevel: "string"
      }
    },
    description: "string",
    id: "string",
    isEnabled: boolean,
    name: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_update_policies;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ItautomationUpdatePolicyRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ItautomationUpdatePolicyRequest {
        ..Default::default()
    };

    let response = i_t_automation_update_policies(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

body = {
  config: {
    concurrency: {
      concurrent_host_file_transfer_limit: integer,
      concurrent_host_limit: integer,
      concurrent_task_limit: integer
    },
    execution: {
      enable_os_query: boolean,
      enable_python_execution: boolean,
      enable_script_execution: boolean,
      execution_timeout: integer,
      execution_timeout_unit: 'string'
    },
    resources: {
      cpu_scheduling: 'string',
      cpu_throttle: integer,
      memory_allocation: integer,
      memory_allocation_unit: 'string',
      memory_pressure_level: 'string'
    }
  },
  description: 'string',
  id: 'string',
  is_enabled: boolean,
  name: 'string'
}

response = api.i_t_automation_update_policies(body)

puts response

Responses

[
  {
    "config": {},
    "created_at": "string",
    "created_by": "string",
    "description": "string",
    "host_groups": [],
    "id": "string",
    "is_enabled": false,
    "modified_at": "string",
    "modified_by": "string",
    "name": "string",
    "precedence": 0,
    "target": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationUpdatePoliciesPrecedence

Updates the policy precedence for all policies of a specific platform.

Method PATCH

Route /it-automation/entities/policies-precedence/v1

Scope IT Automation - Policies: WRITE

PEP 8 update_policies_precedence

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

ids body · array

IDs of all the policy in precedence order for a give platform.

platform query · string

The policy platform for which to set the precedence order, must be one of:

Available values (3)

Windows Linux Mac

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_policies_precedence(ids=id_list, platform="string")
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ITAutomationUpdatePoliciesPrecedence(ids=id_list,
                                                       platform="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "ids": ["string"]
}

response = falcon.command("ITAutomationUpdatePoliciesPrecedence",
                          platform="string",
                          body=body_payload)
print(response)

Set-FalconItPolicyPrecedence -Platform "string" -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ItAutomation.ITAutomationUpdatePoliciesPrecedence(
    &it_automation.ITAutomationUpdatePoliciesPrecedenceParams{
      Body: &models.ItautomationUpdatePoliciesPrecedenceRequest{
        Ids: []string{"string"},
      },
      Platform: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationUpdatePoliciesPrecedence(
  "string",  // platform
  {  // body
      ids: []
  }
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_update_policies_precedence;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ItautomationUpdatePoliciesPrecedenceRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ItautomationUpdatePoliciesPrecedenceRequest {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = i_t_automation_update_policies_precedence(
        &falcon.cfg,  // configuration
        "string",  // platform
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

body = Falcon::ItautomationUpdatePoliciesPrecedenceRequest.new(
  ids: []
)

response = api.i_t_automation_update_policies_precedence(body, 'string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationUpdatePolicyHostGroups

Manage host groups assigned to a policy.

Method PATCH

Route /it-automation/entities/policies-host-groups/v1

Scope IT Automation - Policies: WRITE

PEP 8 update_policy_host_groups

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

action body · string

The action to perform with the provided ids, must be one of:

Available values (2)

assign unassign

host_group_ids body · array

The ids of the host groups on which to perform the action.

policy_id body · string

The id of the policy on which to perform the action.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_policy_host_groups(action="string",
                                            host_group_ids=id_list,
                                            policy_id="string")
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ITAutomationUpdatePolicyHostGroups(action="string",
                                                     host_group_ids=id_list,
                                                     policy_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "action": "string",
    "host_group_ids": ["string"],
    "policy_id": "string"
}

response = falcon.command("ITAutomationUpdatePolicyHostGroups", body=body_payload)
print(response)

Remove-FalconItHostGroup -PolicyId "string" -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  action := "string"
  policy_id := "string"

  response, err := client.ItAutomation.ITAutomationUpdatePolicyHostGroups(
    &it_automation.ITAutomationUpdatePolicyHostGroupsParams{
      Body: &models.ItautomationUpdatePoliciesHostGroupsRequest{
        Action: &action,
        HostGroupIds: []string{"string"},
        PolicyID: &policy_id,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationUpdatePolicyHostGroups(
  {
    action: "string",
    hostGroupIds: [],
    policyId: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_update_policy_host_groups;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ItautomationUpdatePoliciesHostGroupsRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ItautomationUpdatePoliciesHostGroupsRequest {
        action: Some("string".to_string()),
        host_group_ids: vec!["string".to_string()],
        policy_id: Some("string".to_string()),
        ..Default::default()
    };

    let response = i_t_automation_update_policy_host_groups(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

body = Falcon::ItautomationUpdatePoliciesHostGroupsRequest.new(
  action: 'string',
  host_group_ids: [],
  policy_id: 'string'
)

response = api.i_t_automation_update_policy_host_groups(body)

puts response

Responses

[
  {
    "config": {},
    "created_at": "string",
    "created_by": "string",
    "description": "string",
    "host_groups": [],
    "id": "string",
    "is_enabled": false,
    "modified_at": "string",
    "modified_by": "string",
    "name": "string",
    "precedence": 0,
    "target": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationUpdateScheduledTask

Update an existing scheduled task with the supplied info

Method PATCH

Route /it-automation/entities/scheduled-tasks/v1

Scope IT Automation - Task Executions: WRITE

PEP 8 update_scheduled_task

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

discover_new_hosts body · boolean

Whether to discover new hosts for the scheduled task. Example: true

discover_offline_hosts body · boolean

Whether to discover offline hosts for the scheduled task. Example: true

distribute body · boolean

Whether to distribute the scheduled task. Example: true

execution_args body · object

Additional arguments for the scheduled task

expiration_interval body · string

Duration for which the task stays active. Once expired, new and offline hosts won’t be targeted. Example: 1m

guardrails body · object

Safety limits for task execution

is_active body · boolean

Whether the scheduled task is active. Example: true

schedule body · object

Schedule details for the task execution

schedule_name body · string

Custom name for the scheduled task. Example: Weekly Security Scan

target body · string

Filter expression to select target hosts. Example: hostname:*prod*

task_id body · string

Unique identifier of the task to be scheduled. Example: f64b95555ef54ea682619ce880d267cc

trigger_condition body · array

Conditions that trigger remediation actions

id query · string

The id of the scheduled task to update

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

guardrails = {
    "run_time_limit_millis": 0
}

schedule = {
    "day_of_month": 0,
    "days_of_week": [
        "string"
    ],
    "end_time": "2025-07-13T13:39:00.637Z",
    "frequency": "One-Time",
    "interval": 0,
    "start_time": "2025-07-13T13:39:00.637Z",
    "time": "string",
    "timezone": "string"
}

trigger_condition = [
    {
        "groups": [
            null
        ],
        "operator": "AND",
        "statements": [
            {
                "data_comparator": "LessThan",
                "data_type": "StringType",
                "key": "string",
                "task_id": "string",
                "value": "string"
            }
        ]
    }
]

response = falcon.update_scheduled_task(discover_new_hosts=boolean,
                                        discover_offline_hosts=boolean,
                                        distribute=boolean,
                                        execution_args={},
                                        expiration_interval="string",
                                        guardrails=guardrails,
                                        id="string",
                                        is_active=boolean,
                                        schedule=schedule,
                                        target="string",
                                        task_id="string",
                                        trigger_condition=trigger_condition)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

guardrails = {
    "run_time_limit_millis": 0
}

schedule = {
    "day_of_month": 0,
    "days_of_week": [
        "string"
    ],
    "end_time": "2025-07-13T13:39:00.637Z",
    "frequency": "One-Time",
    "interval": 0,
    "start_time": "2025-07-13T13:39:00.637Z",
    "time": "string",
    "timezone": "string"
}

trigger_condition = [
    {
        "groups": [
            null
        ],
        "operator": "AND",
        "statements": [
            {
                "data_comparator": "LessThan",
                "data_type": "StringType",
                "key": "string",
                "task_id": "string",
                "value": "string"
            }
        ]
    }
]

response = falcon.ITAutomationUpdateScheduledTask(discover_new_hosts=boolean,
                                                  discover_offline_hosts=boolean,
                                                  distribute=boolean,
                                                  execution_args={},
                                                  expiration_interval="string",
                                                  guardrails=guardrails,
                                                  id="string",
                                                  is_active=boolean,
                                                  schedule=schedule,
                                                  target="string",
                                                  task_id="string",
                                                  trigger_condition=trigger_condition)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "discover_new_hosts": boolean,
    "discover_offline_hosts": boolean,
    "distribute": boolean,
    "execution_args": {},
    "expiration_interval": "string",
    "guardrails": {
        "run_time_limit_millis": integer
    },
    "is_active": boolean,
    "schedule": {
        "day_of_month": integer,
        "days_of_week": ["string"],
        "end_time": "string",
        "frequency": "string",
        "interval": integer,
        "start_time": "string",
        "time": "string",
        "timezone": "string"
    },
    "schedule_name": "string",
    "target": "string",
    "task_id": "string",
    "trigger_condition": [
        {
            "groups": [
                {
                    "groups": ["string"],
                    "operator": "string",
                    "statements": ["string"]
                }
            ],
            "operator": "string",
            "statements": [
                {
                    "data_comparator": "string",
                    "data_type": "string",
                    "key": "string",
                    "task_id": "string",
                    "value": "string"
                }
            ]
        }
    ]
}

response = falcon.command("ITAutomationUpdateScheduledTask",
                          id="string",
                          body=body_payload)
print(response)

Edit-FalconItScheduledTask -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  discover_new_hosts := boolean
  discover_offline_hosts := boolean
  distribute := boolean
  expiration_interval := "string"
  is_active := boolean
  schedule_name := "string"
  target := "string"
  task_id := "string"
  operator := "string"
  data_comparator := "string"
  data_type := "string"
  key := "string"
  value := "string"

  response, err := client.ItAutomation.ITAutomationUpdateScheduledTask(
    &it_automation.ITAutomationUpdateScheduledTaskParams{
      Body: &models.ItautomationUpdateScheduledTaskRequest{
        DiscoverNewHosts: &discover_new_hosts,
        DiscoverOfflineHosts: &discover_offline_hosts,
        Distribute: &distribute,
        ExecutionArgs: &struct{}{},
        ExpirationInterval: &expiration_interval,
        Guardrails: &struct{}{},
        IsActive: &is_active,
        Schedule: &struct{}{},
        ScheduleName: &schedule_name,
        Target: &target,
        TaskID: &task_id,
        TriggerCondition: []interface{}{
          {
          Groups: []interface{}{
            {
            Groups: []interface{}{},
            Operator: &operator,
            Statements: []interface{}{},
            },
          },
          Operator: &operator,
          Statements: []interface{}{
            {
            DataComparator: &data_comparator,
            DataType: &data_type,
            Key: &key,
            TaskID: &task_id,
            Value: &value,
            },
          },
          },
        },
      },
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationUpdateScheduledTask(
  "string",  // id
  {  // body
      discoverNewHosts: boolean,
      discoverOfflineHosts: boolean,
      distribute: boolean,
      executionArgs: {},
      expirationInterval: "string",
      guardrails: {
        runTimeLimitMillis: integer
      },
      isActive: boolean,
      schedule: {
        dayOfMonth: integer,
        daysOfWeek: [],
        endTime: "string",
        frequency: "string",
        interval: integer,
        startTime: "string",
        time: "string",
        timezone: "string"
      },
      scheduleName: "string",
      target: "string",
      taskId: "string",
      triggerCondition: [{
          groups: [{
              groups: [],
              operator: "string",
              statements: []
            }],
          operator: "string",
          statements: [{
              dataComparator: "string",
              dataType: "string",
              key: "string",
              taskId: "string",
              value: "string"
            }]
        }]
  }
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_update_scheduled_task;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ItautomationUpdateScheduledTaskRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ItautomationUpdateScheduledTaskRequest {
        ..Default::default()
    };

    let response = i_t_automation_update_scheduled_task(
        &falcon.cfg,  // configuration
        "string",  // id
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

body = Falcon::ItautomationUpdateScheduledTaskRequest.new(
  discover_new_hosts: boolean,
  discover_offline_hosts: boolean,
  distribute: boolean,
  execution_args: {},
  expiration_interval: 'string',
  guardrails: {
    run_time_limit_millis: integer
  },
  is_active: boolean,
  schedule: {
    day_of_month: integer,
    days_of_week: [],
    end_time: 'string',
    frequency: 'string',
    interval: integer,
    start_time: 'string',
    time: 'string',
    timezone: 'string'
  },
  schedule_name: 'string',
  target: 'string',
  task_id: 'string',
  trigger_condition: [{
      groups: [{
          groups: [],
          operator: 'string',
          statements: []
        }],
      operator: 'string',
      statements: [{
          data_comparator: 'string',
          data_type: 'string',
          key: 'string',
          task_id: 'string',
          value: 'string'
        }]
    }]
)

response = api.i_t_automation_update_scheduled_task(body, 'string')

puts response

Responses

[
  {
    "created_by": "string",
    "created_time": "string",
    "discover_new_hosts": false,
    "discover_offline_hosts": false,
    "distribute": false,
    "execution_args": {},
    "expiration_interval": "string",
    "groups": [],
    "guardrails": {},
    "id": "string",
    "is_active": false,
    "is_preset": false,
    "last_run": "string",
    "modified_by": "string",
    "modified_time": "string",
    "next_run_time": "string",
    "schedule": {},
    "schedule_name": "string",
    "target": "string",
    "task_id": "string",
    "task_name": "string",
    "task_type": "string",
    "trigger_condition": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationUpdateTask

Update a task with details from the given request.

Method PATCH

Route /it-automation/entities/tasks/v1

Scope IT Automation - Tasks: WRITE

PEP 8 update_task

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

access_type body · string

Access type of the task

Available values (2)

Public Shared

add_assigned_user_group_ids body · array

User group IDs to add to the assigned user group IDs of the task, when access_type is Shared. Use GET /it-automation/queries/it-user-groups/v1 to fetch user group IDs

add_assigned_user_ids body · array

User IDs to add to the assigned user IDs of the task, when access_type is Shared. Use GET /user-management/queries/users/v1 to fetch user IDs

composite_query body · object

Composite query configuration containing task IDs and host attributes for multi-task execution

description body · string

Detailed description of what the task does. Example: User Table Validation Check

name body · string

Name of the task. Example: OSQuery Check

os_query body · string

OSQuery to execute. Example: select * from users

output_parser_config body · object

Specifies the columns and delimiter used to parse script execution results

queries body · object

Script queries to run per platform

remediations body · object

Remediation scripts to run per platform

remove_assigned_user_group_ids body · array

User group IDs to remove from the assigned user group IDs of the task, when access_type is Shared. Use GET /it-automation/queries/it-user-groups/v1 to fetch user group IDs

remove_assigned_user_ids body · array

User IDs to remove from the assigned user IDs of the task, when access_type is Shared. Use GET /user-management/queries/users/v1 to fetch user IDs

rows_parser_config body · object

Configuration for parsing script output into multiple rows

target body · string

Target filter in FQL format. Example: platform_name: ‘Windows’

task_group_id body · string

ID of the task group to associate this task with

task_parameters body · array

Parameters for the task

task_type body · string

Type of task

Available values (2)

query remediation

trigger_condition body · array

Conditions that trigger remediation scripts execution

verification_condition body · array

Conditions that verify the outcome of the remediation scripts execution

id query · string

ID of the task to update. Use ITAutomationSearchTasks to fetch IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

removed_assigned_user_group_ids body · string or list of strings

User group IDs to be removed.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

output_parser_config = {
    "columns": [
        {
            "name": "string"
        }
    ],
    "default_group_by": "boolean",
    "delimiter": "string"
}

queries = {
    "linux": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    },
    "mac": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    },
    "windows": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    }
}

remediations = {
    "linux": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    },
    "mac": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    },
    "windows": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    }
}

trigger_condition = [
    {
        "groups": [
            null
        ],
        "operator": "AND",
        "statements": [
            {
                "data_comparator": "LessThan",
                "data_type": "StringType",
                "key": "string",
                "task_id": "string",
                "value": "string"
            }
        ]
    }
]

verification_condition = [
    {
        "groups": [
            null
        ],
        "operator": "AND",
        "statements": [
            {
                "data_comparator": "LessThan",
                "data_type": "StringType",
                "key": "string",
                "task_id": "string",
                "value": "string"
            }
        ]
    }
]

response = falcon.update_task(access_type="string",
                              add_assigned_user_group_ids=id_list,
                              add_assigned_user_ids=id_list,
                              description="string",
                              id="string",
                              name="string",
                              os_query="string",
                              output_parser_config=output_parser_config,
                              queries=queries,
                              remediations=remediations,
                              removed_assigned_user_group_ids=id_list,
                              remove_assigned_user_ids=id_list,
                              target="string",
                              task_parameters=["string"],
                              task_group_id="string",
                              task_type="string",
                              trigger_condition=trigger_condition,
                              verification_condition=verification_condition)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

output_parser_config = {
    "columns": [
        {
            "name": "string"
        }
    ],
    "default_group_by": "boolean",
    "delimiter": "string"
}

queries = {
    "linux": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    },
    "mac": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    },
    "windows": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    }
}

remediations = {
    "linux": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    },
    "mac": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    },
    "windows": {
        "action_type": "script",
        "args": "string",
        "content": "string",
        "file_ids": [
            "string"
        ],
        "language": "bash",
        "script_file_id": "string"
    }
}

trigger_condition = [
    {
        "groups": [
            null
        ],
        "operator": "AND",
        "statements": [
            {
                "data_comparator": "LessThan",
                "data_type": "StringType",
                "key": "string",
                "task_id": "string",
                "value": "string"
            }
        ]
    }
]

verification_condition = [
    {
        "groups": [
            null
        ],
        "operator": "AND",
        "statements": [
            {
                "data_comparator": "LessThan",
                "data_type": "StringType",
                "key": "string",
                "task_id": "string",
                "value": "string"
            }
        ]
    }
]

response = falcon.ITAutomationUpdateTask(access_type="string",
                                         add_assigned_user_group_ids=id_list,
                                         add_assigned_user_ids=id_list,
                                         description="string",
                                         id="string",
                                         name="string",
                                         os_query="string",
                                         output_parser_config=output_parser_config,
                                         queries=queries,
                                         remediations=remediations,
                                         removed_assigned_user_group_ids=id_list,
                                         remove_assigned_user_ids=id_list,
                                         target="string",
                                         task_parameters=["string"],
                                         task_group_id="string",
                                         task_type="string",
                                         trigger_condition=trigger_condition,
                                         verification_condition=verification_condition)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "access_type": "string",
    "add_assigned_user_group_ids": ["string"],
    "add_assigned_user_ids": ["string"],
    "composite_query": {
        "host_attributes": ["string"],
        "task_ids": ["string"]
    },
    "description": "string",
    "name": "string",
    "os_query": "string",
    "output_parser_config": {
        "columns": [
            {
                "name": "string"
            }
        ],
        "default_group_by": boolean,
        "delimiter": "string"
    },
    "queries": {
        "linux": {
            "action_type": "string",
            "content": "string",
            "file_ids": ["string"],
            "language": "string",
            "script_args": "string",
            "script_file_id": "string"
        },
        "mac": {
            "action_type": "string",
            "content": "string",
            "file_ids": ["string"],
            "language": "string",
            "script_args": "string",
            "script_file_id": "string"
        },
        "windows": {
            "action_type": "string",
            "content": "string",
            "file_ids": ["string"],
            "language": "string",
            "script_args": "string",
            "script_file_id": "string"
        }
    },
    "remediations": {
        "linux": {
            "action_type": "string",
            "content": "string",
            "file_ids": ["string"],
            "language": "string",
            "script_args": "string",
            "script_file_id": "string"
        },
        "mac": {
            "action_type": "string",
            "content": "string",
            "file_ids": ["string"],
            "language": "string",
            "script_args": "string",
            "script_file_id": "string"
        },
        "windows": {
            "action_type": "string",
            "content": "string",
            "file_ids": ["string"],
            "language": "string",
            "script_args": "string",
            "script_file_id": "string"
        }
    },
    "remove_assigned_user_group_ids": ["string"],
    "remove_assigned_user_ids": ["string"],
    "rows_parser_config": {
        "delimiter": "string"
    },
    "target": "string",
    "task_group_id": "string",
    "task_parameters": [
        {
            "custom_validation_message": "string",
            "custom_validation_regex": "string",
            "default_value": "string",
            "format_hint": "string",
            "input_type": "string",
            "is_optional": boolean,
            "key": "string",
            "label": "string",
            "options": [
                {
                    "key": "string",
                    "value": "string"
                }
            ],
            "purpose": "string",
            "validation_type": "string"
        }
    ],
    "task_type": "string",
    "trigger_condition": [
        {
            "groups": [
                {
                    "groups": ["string"],
                    "operator": "string",
                    "statements": ["string"]
                }
            ],
            "operator": "string",
            "statements": [
                {
                    "data_comparator": "string",
                    "data_type": "string",
                    "key": "string",
                    "task_id": "string",
                    "value": "string"
                }
            ]
        }
    ],
    "verification_condition": [
        {
            "groups": [
                {
                    "groups": ["string"],
                    "operator": "string",
                    "statements": ["string"]
                }
            ],
            "operator": "string",
            "statements": [
                {
                    "data_comparator": "string",
                    "data_type": "string",
                    "key": "string",
                    "task_id": "string",
                    "value": "string"
                }
            ]
        }
    ]
}

response = falcon.command("ITAutomationUpdateTask",
                          id="string",
                          body=body_payload)
print(response)

Edit-FalconItTask -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  access_type := "string"
  description := "string"
  name := "string"
  os_query := "string"
  target := "string"
  task_group_id := "string"
  custom_validation_message := "string"
  custom_validation_regex := "string"
  default_value := "string"
  format_hint := "string"
  input_type := "string"
  is_optional := boolean
  key := "string"
  label := "string"
  value := "string"
  purpose := "string"
  validation_type := "string"
  task_type := "string"
  operator := "string"
  data_comparator := "string"
  data_type := "string"
  task_id := "string"

  response, err := client.ItAutomation.ITAutomationUpdateTask(
    &it_automation.ITAutomationUpdateTaskParams{
      Body: &models.ItautomationUpdateTaskRequest{
        AccessType: &access_type,
        AddAssignedUserGroupIds: []string{"string"},
        AddAssignedUserIds: []string{"string"},
        CompositeQuery: &struct{}{},
        Description: &description,
        Name: &name,
        OsQuery: &os_query,
        OutputParserConfig: &struct{}{},
        Queries: &struct{}{},
        Remediations: &struct{}{},
        RemoveAssignedUserGroupIds: []string{"string"},
        RemoveAssignedUserIds: []string{"string"},
        RowsParserConfig: &struct{}{},
        Target: &target,
        TaskGroupID: &task_group_id,
        TaskParameters: []interface{}{
          {
          CustomValidationMessage: &custom_validation_message,
          CustomValidationRegex: &custom_validation_regex,
          DefaultValue: &default_value,
          FormatHint: &format_hint,
          InputType: &input_type,
          IsOptional: &is_optional,
          Key: &key,
          Label: &label,
          Options: []interface{}{
            {
            Key: &key,
            Value: &value,
            },
          },
          Purpose: &purpose,
          ValidationType: &validation_type,
          },
        },
        TaskType: &task_type,
        TriggerCondition: []interface{}{
          {
          Groups: []interface{}{
            {
            Groups: []interface{}{},
            Operator: &operator,
            Statements: []interface{}{},
            },
          },
          Operator: &operator,
          Statements: []interface{}{
            {
            DataComparator: &data_comparator,
            DataType: &data_type,
            Key: &key,
            TaskID: &task_id,
            Value: &value,
            },
          },
          },
        },
        VerificationCondition: []interface{}{
          {
          Groups: []interface{}{
            {
            Groups: []interface{}{},
            Operator: &operator,
            Statements: []interface{}{},
            },
          },
          Operator: &operator,
          Statements: []interface{}{
            {
            DataComparator: &data_comparator,
            DataType: &data_type,
            Key: &key,
            TaskID: &task_id,
            Value: &value,
            },
          },
          },
        },
      },
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationUpdateTask(
  "string",  // id
  {  // body
      accessType: "string",
      addAssignedUserGroupIds: [],
      addAssignedUserIds: [],
      compositeQuery: {
        hostAttributes: [],
        taskIds: []
      },
      description: "string",
      name: "string",
      osQuery: "string",
      outputParserConfig: {
        columns: [{
            name: "string"
          }],
        defaultGroupBy: boolean,
        delimiter: "string"
      },
      queries: {
        linux: {
          actionType: "string",
          content: "string",
          fileIds: [],
          language: "string",
          scriptArgs: "string",
          scriptFileId: "string"
        },
        mac: {
          actionType: "string",
          content: "string",
          fileIds: [],
          language: "string",
          scriptArgs: "string",
          scriptFileId: "string"
        },
        windows: {
          actionType: "string",
          content: "string",
          fileIds: [],
          language: "string",
          scriptArgs: "string",
          scriptFileId: "string"
        }
      },
      remediations: {
        linux: {
          actionType: "string",
          content: "string",
          fileIds: [],
          language: "string",
          scriptArgs: "string",
          scriptFileId: "string"
        },
        mac: {
          actionType: "string",
          content: "string",
          fileIds: [],
          language: "string",
          scriptArgs: "string",
          scriptFileId: "string"
        },
        windows: {
          actionType: "string",
          content: "string",
          fileIds: [],
          language: "string",
          scriptArgs: "string",
          scriptFileId: "string"
        }
      },
      removeAssignedUserGroupIds: [],
      removeAssignedUserIds: [],
      rowsParserConfig: {
        delimiter: "string"
      },
      target: "string",
      taskGroupId: "string",
      taskParameters: [{
          customValidationMessage: "string",
          customValidationRegex: "string",
          defaultValue: "string",
          formatHint: "string",
          inputType: "string",
          isOptional: boolean,
          key: "string",
          label: "string",
          options: [{
              key: "string",
              value: "string"
            }],
          purpose: "string",
          validationType: "string"
        }],
      taskType: "string",
      triggerCondition: [{
          groups: [{
              groups: [],
              operator: "string",
              statements: []
            }],
          operator: "string",
          statements: [{
              dataComparator: "string",
              dataType: "string",
              key: "string",
              taskId: "string",
              value: "string"
            }]
        }],
      verificationCondition: [{
          groups: [{
              groups: [],
              operator: "string",
              statements: []
            }],
          operator: "string",
          statements: [{
              dataComparator: "string",
              dataType: "string",
              key: "string",
              taskId: "string",
              value: "string"
            }]
        }]
  }
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_update_task;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ItautomationUpdateTaskRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ItautomationUpdateTaskRequest {
        ..Default::default()
    };

    let response = i_t_automation_update_task(
        &falcon.cfg,  // configuration
        "string",  // id
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

body = Falcon::ItautomationUpdateTaskRequest.new(
  access_type: 'string',
  add_assigned_user_group_ids: [],
  add_assigned_user_ids: [],
  composite_query: {
    host_attributes: [],
    task_ids: []
  },
  description: 'string',
  name: 'string',
  os_query: 'string',
  output_parser_config: {
    columns: [{
        name: 'string'
      }],
    default_group_by: boolean,
    delimiter: 'string'
  },
  queries: {
    linux: {
      action_type: 'string',
      content: 'string',
      file_ids: [],
      language: 'string',
      script_args: 'string',
      script_file_id: 'string'
    },
    mac: {
      action_type: 'string',
      content: 'string',
      file_ids: [],
      language: 'string',
      script_args: 'string',
      script_file_id: 'string'
    },
    windows: {
      action_type: 'string',
      content: 'string',
      file_ids: [],
      language: 'string',
      script_args: 'string',
      script_file_id: 'string'
    }
  },
  remediations: {
    linux: {
      action_type: 'string',
      content: 'string',
      file_ids: [],
      language: 'string',
      script_args: 'string',
      script_file_id: 'string'
    },
    mac: {
      action_type: 'string',
      content: 'string',
      file_ids: [],
      language: 'string',
      script_args: 'string',
      script_file_id: 'string'
    },
    windows: {
      action_type: 'string',
      content: 'string',
      file_ids: [],
      language: 'string',
      script_args: 'string',
      script_file_id: 'string'
    }
  },
  remove_assigned_user_group_ids: [],
  remove_assigned_user_ids: [],
  rows_parser_config: {
    delimiter: 'string'
  },
  target: 'string',
  task_group_id: 'string',
  task_parameters: [{
      custom_validation_message: 'string',
      custom_validation_regex: 'string',
      default_value: 'string',
      format_hint: 'string',
      input_type: 'string',
      is_optional: boolean,
      key: 'string',
      label: 'string',
      options: [{
          key: 'string',
          value: 'string'
        }],
      purpose: 'string',
      validation_type: 'string'
    }],
  task_type: 'string',
  trigger_condition: [{
      groups: [{
          groups: [],
          operator: 'string',
          statements: []
        }],
      operator: 'string',
      statements: [{
          data_comparator: 'string',
          data_type: 'string',
          key: 'string',
          task_id: 'string',
          value: 'string'
        }]
    }],
  verification_condition: [{
      groups: [{
          groups: [],
          operator: 'string',
          statements: []
        }],
      operator: 'string',
      statements: [{
          data_comparator: 'string',
          data_type: 'string',
          key: 'string',
          task_id: 'string',
          value: 'string'
        }]
    }]
)

response = api.i_t_automation_update_task(body, 'string')

puts response

Responses

[
  {
    "access_type": "string",
    "assigned_user_group_ids": [],
    "assigned_user_ids": [],
    "composite_query": {},
    "created_by": "string",
    "created_time": "string",
    "description": "string",
    "groups": [],
    "has_task_parameters": false,
    "id": "string",
    "last_run_time": "string",
    "modified_by": "string",
    "modified_time": "string",
    "name": "string",
    "os_query": "string",
    "output_parser_config": {},
    "queries": {},
    "remediations": {},
    "rows_parser_config": {},
    "runs": 0,
    "supported_os": [],
    "target": "string",
    "task_parameters": [],
    "task_type": "string",
    "trigger_condition": [],
    "verification_condition": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationUpdateTaskGroup

Update a task group for a given id

Method PATCH

Route /it-automation/entities/task-groups/v1

Scope IT Automation - Tasks: WRITE

PEP 8 update_task_group

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

access_type body · string

Access type of the group

Available values (2)

Public Shared

add_assigned_user_group_ids body · array

User group IDs to add to the group, when access_type is Shared. Use GET /it-automation/queries/it-user-groups/v1 to fetch user group IDs

add_assigned_user_ids body · array

User IDs to add to the group, when access_type is Shared. Use GET /user-management/queries/users/v1 to fetch user IDs

add_task_ids body · array

IDs of existing tasks to add to task group. Get task ids via GET /it-automation/queries/task-groups/v1

description body · string

Description of the task group

name body · string

Name of the task group

remove_assigned_user_group_ids body · array

User group IDs to remove from the group, when access_type is Shared. Use GET /it-automation/queries/it-user-groups/v1 to fetch user group IDs

remove_assigned_user_ids body · array

User IDs to remove from the group, when access_type is Shared. Use GET /user-management/queries/users/v1 to fetch user IDs

remove_task_ids body · array

IDs of existing tasks to remove from task group. Get task ids via GET /it-automation/queries/task-groups/v1

id query · string

The id of the task group to update

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

removed_assigned_user_group_ids body · string or list of strings

User group IDs to be removed.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_task_group(access_type="string",
                                    add_assigned_user_group_ids=id_list,
                                    add_assigned_user_ids=id_list,
                                    add_task_ids=id_list,
                                    description="string",
                                    id="string",
                                    name="string",
                                    removed_assigned_user_group_ids=id_list,
                                    remove_assigned_user_ids=id_list,
                                    remove_task_ids=id_list)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ITAutomationUpdateTaskGroup(access_type="string",
                                              add_assigned_user_group_ids=id_list,
                                              add_assigned_user_ids=id_list,
                                              add_task_ids=id_list,
                                              description="string",
                                              id="string",
                                              name="string",
                                              removed_assigned_user_group_ids=id_list,
                                              remove_assigned_user_ids=id_list,
                                              remove_task_ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "access_type": "string",
    "add_assigned_user_group_ids": ["string"],
    "add_assigned_user_ids": ["string"],
    "add_task_ids": ["string"],
    "description": "string",
    "name": "string",
    "remove_assigned_user_group_ids": ["string"],
    "remove_assigned_user_ids": ["string"],
    "remove_task_ids": ["string"]
}

response = falcon.command("ITAutomationUpdateTaskGroup",
                          id="string",
                          body=body_payload)
print(response)

Edit-FalconItTaskGroup -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  access_type := "string"
  description := "string"
  name := "string"

  response, err := client.ItAutomation.ITAutomationUpdateTaskGroup(
    &it_automation.ITAutomationUpdateTaskGroupParams{
      Body: &models.ItautomationUpdateTaskGroupRequest{
        AccessType: &access_type,
        AddAssignedUserGroupIds: []string{"string"},
        AddAssignedUserIds: []string{"string"},
        AddTaskIds: []string{"string"},
        Description: &description,
        Name: &name,
        RemoveAssignedUserGroupIds: []string{"string"},
        RemoveAssignedUserIds: []string{"string"},
        RemoveTaskIds: []string{"string"},
      },
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationUpdateTaskGroup(
  "string",  // id
  {  // body
      accessType: "string",
      addAssignedUserGroupIds: [],
      addAssignedUserIds: [],
      addTaskIds: [],
      description: "string",
      name: "string",
      removeAssignedUserGroupIds: [],
      removeAssignedUserIds: [],
      removeTaskIds: []
  }
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_update_task_group;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ItautomationUpdateTaskGroupRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ItautomationUpdateTaskGroupRequest {
        ..Default::default()
    };

    let response = i_t_automation_update_task_group(
        &falcon.cfg,  // configuration
        "string",  // id
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

body = Falcon::ItautomationUpdateTaskGroupRequest.new(
  access_type: 'string',
  add_assigned_user_group_ids: [],
  add_assigned_user_ids: [],
  add_task_ids: [],
  description: 'string',
  name: 'string',
  remove_assigned_user_group_ids: [],
  remove_assigned_user_ids: [],
  remove_task_ids: []
)

response = api.i_t_automation_update_task_group(body, 'string')

puts response

Responses

[
  {
    "access_type": "string",
    "assigned_user_group_ids": [],
    "assigned_user_ids": [],
    "created_by": "string",
    "created_time": "string",
    "description": "string",
    "id": "string",
    "is_preset": false,
    "modified_by": "string",
    "modified_time": "string",
    "name": "string",
    "supported_os": [],
    "task_ids": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ITAutomationUpdateUserGroup

Update a user group for a given id

Method PATCH

Route /it-automation/entities/it-user-groups/v1

Scope IT Automation - User Groups: WRITE

PEP 8 update_user_group

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

add_user_ids body · array

IDs of the users being added to the user group

description body · string

Description of the user group

name body · string

Name of the user group

remove_user_ids body · array

IDs of the users being removed from the user group

id query · string

The id of the user groups to update

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_user_group(add_user_ids=id_list,
                                    description="string",
                                    name="string",
                                    id="string",
                                    remove_user_ids=id_list)
print(response)

from falconpy import ITAutomation

falcon = ITAutomation(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ITAutomationUpdateUserGroup(add_user_ids=id_list,
                                              description="string",
                                              name="string",
                                              id="string",
                                              remove_user_ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "add_user_ids": ["string"],
    "description": "string",
    "name": "string",
    "remove_user_ids": ["string"]
}

response = falcon.command("ITAutomationUpdateUserGroup",
                          id="string",
                          body=body_payload)
print(response)

Edit-FalconItUserGroup -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/it_automation"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  name := "string"

  response, err := client.ItAutomation.ITAutomationUpdateUserGroup(
    &it_automation.ITAutomationUpdateUserGroupParams{
      Body: &models.ItautomationUpdateUserGroupRequest{
        AddUserIds: []string{"string"},
        Description: &description,
        Name: &name,
        RemoveUserIds: []string{"string"},
      },
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.itAutomation.iTAutomationUpdateUserGroup(
  "string",  // id
  {  // body
      addUserIds: [],
      description: "string",
      name: "string",
      removeUserIds: []
  }
);

console.log(response);

use rusty_falcon::apis::it_automation_api::i_t_automation_update_user_group;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ItautomationUpdateUserGroupRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ItautomationUpdateUserGroupRequest {
        ..Default::default()
    };

    let response = i_t_automation_update_user_group(
        &falcon.cfg,  // configuration
        "string",  // id
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ItAutomation.new

body = Falcon::ItautomationUpdateUserGroupRequest.new(
  add_user_ids: [],
  description: 'string',
  name: 'string',
  remove_user_ids: []
)

response = api.i_t_automation_update_user_group(body, 'string')

puts response

Responses

[
  {
    "created_by": "string",
    "created_time": "string",
    "description": "string",
    "id": "string",
    "modified_by": "string",
    "modified_time": "string",
    "name": "string",
    "task_group_ids": [],
    "task_ids": [],
    "users": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

IT Automation

Table of Contents

ITAutomationCancelTaskExecution

Parameters

ITAutomationCombinedScheduledTasks

Parameters

ITAutomationCreatePolicy

Parameters

ITAutomationCreateScheduledTask

Parameters

ITAutomationCreateTask

Parameters

ITAutomationCreateTaskGroup

Parameters

ITAutomationCreateUserGroup

Parameters

ITAutomationDeletePolicy

Parameters

ITAutomationDeleteScheduledTasks

Parameters

ITAutomationDeleteTask

Parameters

ITAutomationDeleteTaskGroups

Parameters

ITAutomationDeleteUserGroup

Parameters

ITAutomationGetAssociatedTasks

Parameters

ITAutomationGetExecutionResults

Parameters

ITAutomationGetExecutionResultsSearchStatus

Parameters

ITAutomationGetPolicies

Parameters

ITAutomationGetScheduledTasks

Parameters

ITAutomationGetTaskExecution

Parameters

ITAutomationGetTaskExecutionHostStatus

Parameters

ITAutomationGetTaskExecutionsByQuery

Parameters

ITAutomationGetTaskGroups

Parameters

ITAutomationGetTaskGroupsByQuery

Parameters

ITAutomationGetTasks

Parameters

ITAutomationGetTasksByQuery

Parameters

ITAutomationGetUserGroup

Parameters

ITAutomationQueryPolicies

Parameters

ITAutomationRerunTaskExecution

Parameters

ITAutomationRunLiveQuery

Parameters

ITAutomationSearchScheduledTasks

Parameters

ITAutomationSearchTaskExecutions

Parameters

ITAutomationSearchTaskGroups

Parameters

ITAutomationSearchTasks

Parameters

ITAutomationSearchUserGroup

Parameters

ITAutomationStartExecutionResultsSearch

Parameters

ITAutomationStartTaskExecution

Parameters

ITAutomationUpdatePolicies

Parameters

ITAutomationUpdatePoliciesPrecedence

Parameters

ITAutomationUpdatePolicyHostGroups

Parameters

ITAutomationUpdateScheduledTask

Parameters