Knowledge Base Audit Events

Operations for the Knowledge Base Audit Events service collection.

Language	Last Update
Python	v1.6.5
PowerShell
Go	v0.22.0
TypeScript	v0.6.0
Rust
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
CombinedKnowledgeBaseAuditEventsV1 combined_knowledge_base_audit_events_v1	Get knowledge base audit events with full event details and pagination.
EntitiesKnowledgeBaseAuditEventsV1 entities_knowledge_base_audit_events_v1	Retrieve knowledge base audit event entities by their IDs.
QueriesKnowledgeBaseAuditEventsV1 queries_knowledge_base_audit_events_v1	Query knowledge base audit event IDs with pagination and filtering.

---

CombinedKnowledgeBaseAuditEventsV1

Get knowledge base audit events with full event details and pagination.

Method GET

Route /agentic-studio/combined/knowledge_base_audit_events/v1

Scope Charlotte AI Agent Definition: READ

PEP 8 combined_knowledge_base_audit_events_v1

Parameters

knowledge_base_id query · string

ID of the knowledge base to get audit events for

offset query · integer

Starting index of overall result set from which to return events.

limit query · integer

Number of events to return.

sort query · string

desc’.

filter query · string

FQL query specifying the filter parameters.

include_deleted query · boolean

Include audit events for deleted knowledge bases. Defaults to false.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KnowledgeBaseAuditEvents

falcon = KnowledgeBaseAuditEvents(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.combined_knowledge_base_audit_events_v1(knowledge_base_id="string",
                                                          offset=integer,
                                                          limit=integer,
                                                          sort="string",
                                                          filter="string",
                                                          include_deleted=boolean)
print(response)

Operation ID

from falconpy import KnowledgeBaseAuditEvents

falcon = KnowledgeBaseAuditEvents(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.CombinedKnowledgeBaseAuditEventsV1(knowledge_base_id="string",
                                                     offset=integer,
                                                     limit=integer,
                                                     sort="string",
                                                     filter="string",
                                                     include_deleted=boolean)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("CombinedKnowledgeBaseAuditEventsV1",
                          knowledge_base_id="string",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string",
                          include_deleted=boolean)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/knowledge_base_audit_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"
  includeDeleted := boolean

  response, err := client.KnowledgeBaseAuditEvents.CombinedKnowledgeBaseAuditEventsV1(
    &knowledge_base_audit_events.CombinedKnowledgeBaseAuditEventsV1Params{
      KnowledgeBaseID: "string",
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      IncludeDeleted: &includeDeleted,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.knowledgeBaseAuditEvents.combinedKnowledgeBaseAuditEventsV1(
  "string",  // knowledgeBaseId
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string",  // filter
  boolean  // includeDeleted
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KnowledgeBaseAuditEvents.new

response = api.combined_knowledge_base_audit_events_v1('string')

puts response

Responses

200 Successfully retrieved

[
  {
    "created_at": "string",
    "details": {},
    "entity_id": "string",
    "entity_type": "string",
    "id": "string",
    "operation_type": "string",
    "parent_id": "string",
    "user": {}
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

EntitiesKnowledgeBaseAuditEventsV1

Retrieve knowledge base audit event entities by their IDs.

Method GET

Route /agentic-studio/entities/knowledge_base_audit_events/v1

Scope Charlotte AI Agent Definition: READ

PEP 8 entities_knowledge_base_audit_events_v1

Parameters

knowledge_base_id query · string

ID of the knowledge base

ids query · string or list of strings

IDs of audit events to retrieve.

include_deleted query · boolean

Include audit events for deleted knowledge bases. Defaults to false.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KnowledgeBaseAuditEvents

falcon = KnowledgeBaseAuditEvents(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_knowledge_base_audit_events_v1(knowledge_base_id="string",
                                                          ids=id_list,
                                                          include_deleted=boolean)
print(response)

Operation ID

from falconpy import KnowledgeBaseAuditEvents

falcon = KnowledgeBaseAuditEvents(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.EntitiesKnowledgeBaseAuditEventsV1(knowledge_base_id="string",
                                                     ids=id_list,
                                                     include_deleted=boolean)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("EntitiesKnowledgeBaseAuditEventsV1",
                          knowledge_base_id="string",
                          ids=id_list,
                          include_deleted=boolean)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/knowledge_base_audit_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  includeDeleted := boolean

  response, err := client.KnowledgeBaseAuditEvents.EntitiesKnowledgeBaseAuditEventsV1(
    &knowledge_base_audit_events.EntitiesKnowledgeBaseAuditEventsV1Params{
      KnowledgeBaseID: "string",
      Ids: []string{"ID1", "ID2", "ID3"},
      IncludeDeleted: &includeDeleted,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.knowledgeBaseAuditEvents.entitiesKnowledgeBaseAuditEventsV1(
  "string",  // knowledgeBaseId
  ["ID1", "ID2", "ID3"],  // ids
  boolean  // includeDeleted
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KnowledgeBaseAuditEvents.new

response = api.entities_knowledge_base_audit_events_v1('string', ['ID1', 'ID2', 'ID3'])

puts response

Responses

200 Successfully retrieved

[
  {
    "created_at": "string",
    "details": {},
    "entity_id": "string",
    "entity_type": "string",
    "id": "string",
    "operation_type": "string",
    "parent_id": "string",
    "user": {}
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

QueriesKnowledgeBaseAuditEventsV1

Query knowledge base audit event IDs with pagination and filtering.

Method GET

Route /agentic-studio/queries/knowledge_base_audit_events/v1

Scope Charlotte AI Agent Definition: READ

PEP 8 queries_knowledge_base_audit_events_v1

Parameters

knowledge_base_id query · string

ID of the knowledge base to query audit events for

offset query · integer

Starting index of overall result set from which to return ids.

limit query · integer

Number of IDs to return.

sort query · string

desc’.

filter query · string

FQL query specifying the filter parameters.

include_deleted query · boolean

Include audit events for deleted knowledge bases. Defaults to false.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KnowledgeBaseAuditEvents

falcon = KnowledgeBaseAuditEvents(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.queries_knowledge_base_audit_events_v1(knowledge_base_id="string",
                                                         offset=integer,
                                                         limit=integer,
                                                         sort="string",
                                                         filter="string",
                                                         include_deleted=boolean)
print(response)

Operation ID

from falconpy import KnowledgeBaseAuditEvents

falcon = KnowledgeBaseAuditEvents(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.QueriesKnowledgeBaseAuditEventsV1(knowledge_base_id="string",
                                                    offset=integer,
                                                    limit=integer,
                                                    sort="string",
                                                    filter="string",
                                                    include_deleted=boolean)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueriesKnowledgeBaseAuditEventsV1",
                          knowledge_base_id="string",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string",
                          include_deleted=boolean)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/knowledge_base_audit_events"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"
  includeDeleted := boolean

  response, err := client.KnowledgeBaseAuditEvents.QueriesKnowledgeBaseAuditEventsV1(
    &knowledge_base_audit_events.QueriesKnowledgeBaseAuditEventsV1Params{
      KnowledgeBaseID: "string",
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      IncludeDeleted: &includeDeleted,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.knowledgeBaseAuditEvents.queriesKnowledgeBaseAuditEventsV1(
  "string",  // knowledgeBaseId
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string",  // filter
  boolean  // includeDeleted
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KnowledgeBaseAuditEvents.new

response = api.queries_knowledge_base_audit_events_v1('string')

puts response

Responses

200 Successfully retrieved

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}