Knowledge Bases

Operations for the Knowledge Bases service collection.

Language	Last Update
Python	v1.6.1
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

Operation	Description
aggregates_knowledge_bases_v1	Aggregate knowledge bases based on the provided msa criteria.
entities_knowledge_bases_v1	Retrieve knowledge base entities for the provided id.
entities_knowledge_bases_create_v1	Create or update a knowledge base. For deletion, provide knowledge base with IsDeleted=true.
entities_knowledge_bases_update_v1	Update an existing knowledge base.
queries_knowledge_bases_v1	Query knowledge bases based on the provided filters.

aggregates_knowledge_bases_v1

Aggregate knowledge bases based on the provided msa criteria.

POST /agentic-studio/aggregates/knowledge_bases/v1

Scope Charlotte Ai Agent Definition: READ Consumes · Produces application/json

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload as JSON formatted dictionary.
date_ranges	body	array
exclude	body	string
extended_bounds	body	object
field	body	string
filter	body	string
filters_spec	body	object
from	body	integer
include	body	string
interval	body	string
max_doc_count	body	integer
min_doc_count	body	integer
missing	body	string
name	body	string
percents	body	array
q	body	string
ranges	body	array
size	body	integer
sort	body	string
sub_aggregates	body	array
time_zone	body	string
type	body	string
include_deleted	query	boolean	Include deleted knowledge bases in the result. Defaults to false.

Code Examples

Examples coming soon.

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/knowledge_bases"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  from := "string"
  to := "string"
  exclude := "string"
  field := "string"
  filter := "string"
  from := integer
  include := "string"
  interval := "string"
  max_doc_count := integer
  min_doc_count := integer
  missing := "string"
  name := "string"
  q := "string"
  From := integer
  To := integer
  size := integer
  sort := "string"
  time_zone := "string"
  type := "string"
  includeDeleted := boolean

  response, err := client.KnowledgeBases.AggregatesKnowledgeBasesV1(
    &knowledge_bases.AggregatesKnowledgeBasesV1Params{
      Body: []*models.MsaAggregateQueryRequest{
        {
          DateRanges: []interface{}{
            {
            From: &from,
            To: &to,
            },
          },
          Exclude: &exclude,
          ExtendedBounds: &struct{}{},
          Field: &field,
          Filter: &filter,
          FiltersSpec: &struct{}{},
          From: &from,
          Include: &include,
          Interval: &interval,
          MaxDocCount: &max_doc_count,
          MinDocCount: &min_doc_count,
          Missing: &missing,
          Name: &name,
          Percents: []interface{}{},
          Q: &q,
          Ranges: []interface{}{
            {
            From: &From,
            To: &To,
            },
          },
          Size: &size,
          Sort: &sort,
          SubAggregates: []interface{}{
            {
            DateRanges: []interface{}{
              {
              From: &from,
              To: &to,
              },
            },
            Exclude: &exclude,
            ExtendedBounds: &struct{}{},
            Field: &field,
            Filter: &filter,
            FiltersSpec: &struct{}{},
            From: &from,
            Include: &include,
            Interval: &interval,
            MaxDocCount: &max_doc_count,
            MinDocCount: &min_doc_count,
            Missing: &missing,
            Name: &name,
            Percents: []interface{}{},
            Q: &q,
            Ranges: []interface{}{
              {
              From: &From,
              To: &To,
              },
            },
            Size: &size,
            Sort: &sort,
            SubAggregates: []interface{}{
              {
              DateRanges: []interface{}{},
              Exclude: &exclude,
              ExtendedBounds: &struct{}{},
              Field: &field,
              Filter: &filter,
              FiltersSpec: &struct{}{},
              From: &from,
              Include: &include,
              Interval: &interval,
              MaxDocCount: &max_doc_count,
              MinDocCount: &min_doc_count,
              Missing: &missing,
              Name: &name,
              Percents: []interface{}{},
              Q: &q,
              Ranges: []interface{}{},
              Size: &size,
              Sort: &sort,
              SubAggregates: []interface{}{},
              TimeZone: &time_zone,
              Type: &type,
              },
            },
            TimeZone: &time_zone,
            Type: &type,
            },
          },
          TimeZone: &time_zone,
          Type: &type,
        },
      },
      IncludeDeleted: &includeDeleted,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.knowledgeBases.aggregatesKnowledgeBasesV1(
  [{  // body
      dateRanges: [{
          from: "string",
          to: "string"
        }],
      exclude: "string",
      extendedBounds: {
        max: "string",
        min: "string"
      },
      field: "string",
      filter: "string",
      filtersSpec: {
        filters: {},
        otherBucket: boolean,
        otherBucketKey: "string"
      },
      from: integer,
      include: "string",
      interval: "string",
      maxDocCount: integer,
      minDocCount: integer,
      missing: "string",
      name: "string",
      percents: [],
      q: "string",
      ranges: [{
          From: integer,
          To: integer
        }],
      size: integer,
      sort: "string",
      subAggregates: [{
          dateRanges: [{
              from: "string",
              to: "string"
            }],
          exclude: "string",
          extendedBounds: {
            max: "string",
            min: "string"
          },
          field: "string",
          filter: "string",
          filtersSpec: {
            filters: {},
            otherBucket: boolean,
            otherBucketKey: "string"
          },
          from: integer,
          include: "string",
          interval: "string",
          maxDocCount: integer,
          minDocCount: integer,
          missing: "string",
          name: "string",
          percents: [],
          q: "string",
          ranges: [{
              From: integer,
              To: integer
            }],
          size: integer,
          sort: "string",
          subAggregates: [{
              dateRanges: [],
              exclude: "string",
              extendedBounds: {},
              field: "string",
              filter: "string",
              filtersSpec: {},
              from: integer,
              include: "string",
              interval: "string",
              maxDocCount: integer,
              minDocCount: integer,
              missing: "string",
              name: "string",
              percents: [],
              q: "string",
              ranges: [],
              size: integer,
              sort: "string",
              subAggregates: [],
              timeZone: "string",
              type: "string"
            }],
          timeZone: "string",
          type: "string"
        }],
      timeZone: "string",
      type: "string"
  }],
  boolean  // includeDeleted
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KnowledgeBases.new

body = [Falcon::MsaAggregateQueryRequest.new(
  date_ranges: [{
      from: 'string',
      to: 'string'
    }],
  exclude: 'string',
  extended_bounds: {
    max: 'string',
    min: 'string'
  },
  field: 'string',
  filter: 'string',
  filters_spec: {
    filters: {},
    other_bucket: boolean,
    other_bucket_key: 'string'
  },
  from: integer,
  include: 'string',
  interval: 'string',
  max_doc_count: integer,
  min_doc_count: integer,
  missing: 'string',
  name: 'string',
  percents: [],
  q: 'string',
  ranges: [{
      From: integer,
      To: integer
    }],
  size: integer,
  sort: 'string',
  sub_aggregates: [{
      date_ranges: [{
          from: 'string',
          to: 'string'
        }],
      exclude: 'string',
      extended_bounds: {
        max: 'string',
        min: 'string'
      },
      field: 'string',
      filter: 'string',
      filters_spec: {
        filters: {},
        other_bucket: boolean,
        other_bucket_key: 'string'
      },
      from: integer,
      include: 'string',
      interval: 'string',
      max_doc_count: integer,
      min_doc_count: integer,
      missing: 'string',
      name: 'string',
      percents: [],
      q: 'string',
      ranges: [{
          From: integer,
          To: integer
        }],
      size: integer,
      sort: 'string',
      sub_aggregates: [{
          date_ranges: [],
          exclude: 'string',
          extended_bounds: {},
          field: 'string',
          filter: 'string',
          filters_spec: {},
          from: integer,
          include: 'string',
          interval: 'string',
          max_doc_count: integer,
          min_doc_count: integer,
          missing: 'string',
          name: 'string',
          percents: [],
          q: 'string',
          ranges: [],
          size: integer,
          sort: 'string',
          sub_aggregates: [],
          time_zone: 'string',
          type: 'string'
        }],
      time_zone: 'string',
      type: 'string'
    }],
  time_zone: 'string',
  type: 'string'
)]

response = api.aggregates_knowledge_bases_v1(body)

puts response

entities_knowledge_bases_v1

Retrieve knowledge base entities for the provided id.

GET /agentic-studio/entities/knowledge_bases/v1

Scope Charlotte Ai Agent Definition: READ Consumes · Produces application/json

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	IDs of entities to retrieve.
include_deleted	query	boolean	Include deleted knowledge bases in the result. Defaults to false.

Code Examples

Examples coming soon.

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/knowledge_bases"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  includeDeleted := boolean

  response, err := client.KnowledgeBases.EntitiesKnowledgeBasesV1(
    &knowledge_bases.EntitiesKnowledgeBasesV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      IncludeDeleted: &includeDeleted,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.knowledgeBases.entitiesKnowledgeBasesV1(
  ["ID1", "ID2", "ID3"],  // ids
  boolean  // includeDeleted
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KnowledgeBases.new

response = api.entities_knowledge_bases_v1(['ID1', 'ID2', 'ID3'])

puts response

entities_knowledge_bases_create_v1

Create or update a knowledge base. For deletion, provide knowledge base with IsDeleted=true.

POST /agentic-studio/entities/knowledge_bases/v1

Scope Charlotte Ai Agent Definition: WRITE Consumes · Produces application/json

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload as JSON formatted dictionary.
created_at	body	string
created_by	body	object
description	body	string
embedding_model	body	string
files_count	body	integer
id	body	string
is_deleted	body	boolean
name	body	string
updated_at	body	string
updated_by	body	object

Code Examples

Examples coming soon.

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/knowledge_bases"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  created_at := "string"
  description := "string"
  embedding_model := "string"
  files_count := integer
  id := "string"
  is_deleted := boolean
  name := "string"
  updated_at := "string"

  response, err := client.KnowledgeBases.EntitiesKnowledgeBasesCreateV1(
    &knowledge_bases.EntitiesKnowledgeBasesCreateV1Params{
      Body: &models.DomainKnowledgeBase{
        CreatedAt: &created_at,
        CreatedBy: &struct{}{},
        Description: &description,
        EmbeddingModel: &embedding_model,
        FilesCount: &files_count,
        ID: &id,
        IsDeleted: &is_deleted,
        Name: &name,
        UpdatedAt: &updated_at,
        UpdatedBy: &struct{}{},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.knowledgeBases.entitiesKnowledgeBasesCreateV1(
  {
    createdAt: "string",
    createdBy: {
      cid: "string",
      createdAt: "string",
      factors: [],
      firstName: "string",
      lastLoginAt: "string",
      lastName: "string",
      status: "string",
      uid: "string",
      updatedAt: "string",
      userType: "string",
      uuid: "string"
    },
    description: "string",
    embeddingModel: "string",
    filesCount: integer,
    id: "string",
    isDeleted: boolean,
    name: "string",
    updatedAt: "string",
    updatedBy: {
      cid: "string",
      createdAt: "string",
      factors: [],
      firstName: "string",
      lastLoginAt: "string",
      lastName: "string",
      status: "string",
      uid: "string",
      updatedAt: "string",
      userType: "string",
      uuid: "string"
    }
}  // body
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KnowledgeBases.new

body = Falcon::DomainKnowledgeBase.new(
  created_at: 'string',
  created_by: {
    cid: 'string',
    created_at: 'string',
    factors: [],
    first_name: 'string',
    last_login_at: 'string',
    last_name: 'string',
    status: 'string',
    uid: 'string',
    updated_at: 'string',
    user_type: 'string',
    uuid: 'string'
  },
  description: 'string',
  embedding_model: 'string',
  files_count: integer,
  id: 'string',
  is_deleted: boolean,
  name: 'string',
  updated_at: 'string',
  updated_by: {
    cid: 'string',
    created_at: 'string',
    factors: [],
    first_name: 'string',
    last_login_at: 'string',
    last_name: 'string',
    status: 'string',
    uid: 'string',
    updated_at: 'string',
    user_type: 'string',
    uuid: 'string'
  }
)

response = api.entities_knowledge_bases_create_v1(body)

puts response

entities_knowledge_bases_update_v1

Update an existing knowledge base.

PATCH /agentic-studio/entities/knowledge_bases/v1

Scope Charlotte Ai Agent Definition: WRITE Consumes · Produces application/json

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload as JSON formatted dictionary.
created_at	body	string
created_by	body	object
description	body	string
embedding_model	body	string
files_count	body	integer
id	body	string
is_deleted	body	boolean
name	body	string
updated_at	body	string
updated_by	body	object

Code Examples

Examples coming soon.

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/knowledge_bases"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  created_at := "string"
  description := "string"
  embedding_model := "string"
  files_count := integer
  id := "string"
  is_deleted := boolean
  name := "string"
  updated_at := "string"

  response, err := client.KnowledgeBases.EntitiesKnowledgeBasesUpdateV1(
    &knowledge_bases.EntitiesKnowledgeBasesUpdateV1Params{
      Body: &models.DomainKnowledgeBase{
        CreatedAt: &created_at,
        CreatedBy: &struct{}{},
        Description: &description,
        EmbeddingModel: &embedding_model,
        FilesCount: &files_count,
        ID: &id,
        IsDeleted: &is_deleted,
        Name: &name,
        UpdatedAt: &updated_at,
        UpdatedBy: &struct{}{},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.knowledgeBases.entitiesKnowledgeBasesUpdateV1(
  {
    createdAt: "string",
    createdBy: {
      cid: "string",
      createdAt: "string",
      factors: [],
      firstName: "string",
      lastLoginAt: "string",
      lastName: "string",
      status: "string",
      uid: "string",
      updatedAt: "string",
      userType: "string",
      uuid: "string"
    },
    description: "string",
    embeddingModel: "string",
    filesCount: integer,
    id: "string",
    isDeleted: boolean,
    name: "string",
    updatedAt: "string",
    updatedBy: {
      cid: "string",
      createdAt: "string",
      factors: [],
      firstName: "string",
      lastLoginAt: "string",
      lastName: "string",
      status: "string",
      uid: "string",
      updatedAt: "string",
      userType: "string",
      uuid: "string"
    }
}  // body
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KnowledgeBases.new

body = Falcon::DomainKnowledgeBase.new(
  created_at: 'string',
  created_by: {
    cid: 'string',
    created_at: 'string',
    factors: [],
    first_name: 'string',
    last_login_at: 'string',
    last_name: 'string',
    status: 'string',
    uid: 'string',
    updated_at: 'string',
    user_type: 'string',
    uuid: 'string'
  },
  description: 'string',
  embedding_model: 'string',
  files_count: integer,
  id: 'string',
  is_deleted: boolean,
  name: 'string',
  updated_at: 'string',
  updated_by: {
    cid: 'string',
    created_at: 'string',
    factors: [],
    first_name: 'string',
    last_login_at: 'string',
    last_name: 'string',
    status: 'string',
    uid: 'string',
    updated_at: 'string',
    user_type: 'string',
    uuid: 'string'
  }
)

response = api.entities_knowledge_bases_update_v1(body)

puts response

queries_knowledge_bases_v1

Query knowledge bases based on the provided filters.

GET /agentic-studio/queries/knowledge_bases/v1

Scope Charlotte Ai Agent Definition: READ Consumes · Produces application/json

Parameters

Name	Type	Data type	Description
offset	query	integer	Starting index of overall result set from which to return ids.
limit	query	integer	Number of IDs to return. Offset + limit should NOT be above 10K.
sort	query	string	Possible order by fields: name, created_at. Ex: ‘created_at\|desc’ or ‘name\|asc’.
filter	query	string	FQL query specifying the filter parameters.
include_deleted	query	boolean	Include deleted knowledge bases in the result. Defaults to false.

Code Examples

Examples coming soon.

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/knowledge_bases"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"
  includeDeleted := boolean

  response, err := client.KnowledgeBases.QueriesKnowledgeBasesV1(
    &knowledge_bases.QueriesKnowledgeBasesV1Params{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      IncludeDeleted: &includeDeleted,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.knowledgeBases.queriesKnowledgeBasesV1(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string",  // filter
  boolean  // includeDeleted
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KnowledgeBases.new

response = api.queries_knowledge_bases_v1(offset: integer,
                                          limit: integer,
                                          sort: 'string',
                                          filter: 'string',
                                          include_deleted: boolean)

puts response

Knowledge Bases

Table of Contents

aggregates_knowledge_bases_v1

Parameters

Code Examples

entities_knowledge_bases_v1

Parameters

Code Examples

entities_knowledge_bases_create_v1

Parameters

Code Examples

entities_knowledge_bases_update_v1

Parameters

Code Examples

queries_knowledge_bases_v1

Parameters

Code Examples