Kubernetes Protection

The Kubernetes Protection service collection provides operations for managing Kubernetes cluster security. Query container vulnerabilities, cloud accounts, nodes, deployments, namespaces, and pods. Manage agent configurations and regenerate API keys.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

This service collection has code examples posted to the repository.

---

---

Table of Contents

Operation	Description
CreateAWSAccount create_aws_account	Creates a new AWS account in our system for a customer and generates the installation script
CreateAzureSubscription create_azure_subscription	Creates a new Azure Subscription in our system
DeleteAWSAccountsMixin0 delete_aws_accounts	Delete AWS accounts.
DeleteAzureSubscription delete_azure_subscription	Deletes a new Azure Subscription in our system
FindContainersByContainerRunTimeVersion find_containers_by_runtime_version	Retrieve containers by container_runtime_version
FindContainersCountAffectedByZeroDayVulnerabilities read_zero_day_affected_counts	Retrieve containers count affected by zero day vulnerabilities
GetAWSAccountsMixin0 get_aws_accounts	Provides a list of AWS accounts.
GetAzureInstallScript get_azure_install_script	Provides the script to run for a given tenant id and subscription IDs
GetAzureTenantConfig get_azure_tenant_config	Gets the Azure tenant Config
GetAzureTenantIDs get_azure_tenant_ids	Provides all the azure subscriptions and tenants
GetClusters get_clusters	Provides the clusters acknowledged by the Kubernetes Protection service
GetCombinedCloudClusters get_cloud_clusters	Returns a combined list of provisioned cloud accounts and known kubernetes clusters
GetHelmValuesYaml get_helm_values_yaml	Provides a sample Helm values.yaml file for a customer to install alongside the agent Helm chart
GetLocations get_locations	Provides the cloud locations acknowledged by the Kubernetes Protection service
GetStaticScripts get_static_scripts	Gets static bash scripts that are used during registration
GroupContainersByManaged group_managed_containers	Group the containers by Managed
ListAzureAccounts list_azure_accounts	Provides the azure subscriptions registered to Kubernetes Protection
PatchAzureServicePrincipal update_azure_service_principal	Adds the client ID for the given tenant ID to our system
PostAggregatesPods post_aggregates_pods	Get aggregate query result for pods
PostSearchKubernetesIOMEntities search_kubernetes_ioms	Search for Kubernetes IOMs with filtering options.Pagination is supported via Elasticsearch’s search_after search param and point in time.
ReadClusterCombined read_clusters_combined	Retrieve kubernetes clusters identified by the provided filter criteria
ReadClusterCombinedV2 read_clusters_combined_v2	Retrieve Kubernetes cluster data
ReadClusterCount read_cluster_count	Retrieve cluster counts
ReadClusterEnrichment read_cluster_enrichment	Retrieve cluster enrichment data
ReadClustersByDateRangeCount read_clusters_by_date_range	Retrieve clusters by date range counts
ReadClustersByKubernetesVersionCount read_clusters_by_version	Bucket clusters by kubernetes version
ReadClustersByStatusCount read_clusters_by_status	Bucket clusters by status
ReadContainerCombined read_containers_combined	Retrieves a paginated list of containers identified by the provided filter criteria.
ReadContainerCount read_container_counts	Retrieve container counts
ReadContainerCountByRegistry read_containers_by_registry	Retrieves a list with the top container image registries.
ReadContainerEnrichment read_container_enrichment	Retrieve container enrichment data
ReadContainerImageDetectionsCountByDate read_detections_count_by_date	Retrieve count of image assessment detections on running containers over a period of time
ReadContainerImagesByMostUsed read_images_by_most_used	Bucket container by image-digest
ReadContainerImagesByState read_images_by_state	Retrieve count of image states running on containers
ReadContainersByDateRangeCount read_containers_by_date_range	Retrieve containers by date range counts
ReadContainersSensorCoverage read_sensor_coverage	Bucket containers by agent type and calculate sensor coverage
ReadContainerVulnerabilitiesBySeverityCount read_vulnerability_counts_by_severity	Retrieve container vulnerabilities by severity counts
ReadDeploymentCombined read_deployments_combined	Retrieve kubernetes deployments identified by the provided filter criteria
ReadDeploymentCount read_deployment_count	Retrieve deployment counts
ReadDeploymentEnrichment read_deployment_enrichment	Retrieve deployment enrichment data
ReadDeploymentsByDateRangeCount read_deployment_counts_by_date_range	Retrieve deployments by date range counts
ReadDistinctContainerImageCount read_distinct_image_count	Retrieve count of distinct images running on containers
ReadKubernetesIomByDateRange read_iom_count_by_date_range	Returns the count of Kubernetes IOMs by the date. by default it’s for 7 days.
ReadKubernetesIomCount read_iom_count	Returns the total count of Kubernetes IOMs over the past seven days
ReadKubernetesIomEntities read_iom_entities	Retrieve Kubernetes IOM entities identified by the provided IDs
ReadNamespaceCount read_namespace_count	Retrieve namespace counts
ReadNamespacesByDateRangeCount read_namespaces_by_date_range_count	Retrieve namespaces by date range counts
ReadNodeCombined read_nodes_combined	Retrieve kubernetes nodes identified by the provided filter criteria
ReadNodeCount read_node_count	Retrieve node counts
ReadNodeEnrichment read_node_enrichment	Retrieve node enrichment data
ReadNodesByCloudCount read_node_counts_by_cloud	Bucket nodes by cloud providers
ReadNodesByContainerEngineVersionCount read_nodes_by_container_engine_version	Bucket nodes by their container engine version
ReadNodesByDateRangeCount read_node_counts_by_date_range	Retrieve nodes by date range counts
ReadPodCombined read_pods_combined	Retrieve kubernetes pods identified by the provided filter criteria
ReadPodCount read_pod_counts	Retrieve pod counts
ReadPodEnrichment read_pod_enrichment	Retrieve pod enrichment data
ReadPodsByDateRangeCount read_pod_counts_by_date_range	Retrieve pods by date range counts
ReadRunningContainerImages read_running_images	Retrieve images on running containers
ReadVulnerableContainerImageCount read_vulnerable_container_count	Retrieve count of vulnerable images running on containers
RegenerateAPIKey regenerate	Regenerate API key for docker registry integrations
SearchAndReadKubernetesIomEntities search_and_read_ioms	Retrieves a list of Kubernetes IOMs identified by the provided search criteria.
SearchKubernetesIoms search_ioms	Search Kubernetes IOMs by the provided search criteria. this endpoint returns a list of Kubernetes IOM UUIDs matching the query
TriggerScan trigger_scan	Triggers a dry run or a full scan of a customer’s kubernetes footprint
UpdateAWSAccount update_aws_account	Updates the AWS account per the query parameters provided

---

CreateAWSAccount

Creates a new AWS account in our system for a customer and generates the installation script

Method POST

Route /kubernetes-protection/entities/accounts/aws/v1

Scope Kubernetes Protection: WRITE

PEP 8 create_aws_account

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

account_id body · string

Account ID.

region body · string

Region.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.create_aws_account(account_id="string", region="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.CreateAWSAccount(account_id="string", region="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "account_id": "string",
            "region": "string"
        }
    ]
}

response = falcon.command("CreateAWSAccount", body=body_payload)
print(response)

PowerShell

New-FalconContainerAwsAccount -Region "string" -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  account_id := "string"
  region := "string"

  response, err := client.KubernetesProtection.CreateAWSAccount(
    &kubernetes_protection.CreateAWSAccountParams{
      Body: &models.K8sregCreateAWSAccReq{
        Resources: []interface{}{
          {
          AccountID: &account_id,
          Region: &region,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.createAWSAccount(
  {
    resources: [{
        accountId: "string",
        region: "string"
      }]
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::create_aws_account;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::K8sregCreateAwsAccReq;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = K8sregCreateAwsAccReq {
        resources: vec![resources {
            account_id: Some("string".to_string()),
            region: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = create_aws_account(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

body = Falcon::K8sregCreateAWSAccReq.new(
  resources: [{
      account_id: 'string',
      region: 'string'
    }]
)

response = api.create_aws_account(body)

puts response

Responses

201 Created

[
  {
    "account_id": "string",
    "aws_permissions_status": [],
    "cid": "string",
    "cloudformation_url": "string",
    "created_at": "string",
    "from_cspm": false,
    "iam_role_arn": "string",
    "is_master": false,
    "organization_id": "string",
    "region": "string",
    "status": "string",
    "updated_at": "string"
  }
]

207 Multi-Status

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "account_id": "string",
      "aws_permissions_status": [],
      "cid": "string",
      "cloudformation_url": "string",
      "created_at": "string",
      "from_cspm": false,
      "iam_role_arn": "string",
      "is_master": false,
      "organization_id": "string",
      "region": "string",
      "status": "string",
      "updated_at": "string"
    }
  ]
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "account_id": "string",
      "aws_permissions_status": [],
      "cid": "string",
      "cloudformation_url": "string",
      "created_at": "string",
      "from_cspm": false,
      "iam_role_arn": "string",
      "is_master": false,
      "organization_id": "string",
      "region": "string",
      "status": "string",
      "updated_at": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "account_id": "string",
      "aws_permissions_status": [],
      "cid": "string",
      "cloudformation_url": "string",
      "created_at": "string",
      "from_cspm": false,
      "iam_role_arn": "string",
      "is_master": false,
      "organization_id": "string",
      "region": "string",
      "status": "string",
      "updated_at": "string"
    }
  ]
}

---

---

CreateAzureSubscription

Creates a new Azure Subscription in our system

Method POST

Route /kubernetes-protection/entities/accounts/azure/v1

Scope Kubernetes Protection: WRITE

PEP 8 create_azure_subscription

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

subscription_id body · string

Azure subscription ID.

tenant_id body · string

Tenant ID.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.create_azure_subscription(subscription_id="string",
                                            tenant_id="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.CreateAzureSubscription(subscription_id="string",
                                          tenant_id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "subscription_id": "string",
            "tenant_id": "string"
        }
    ]
}

response = falcon.command("CreateAzureSubscription", body=body_payload)
print(response)

PowerShell

New-FalconContainerAzureAccount

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  subscription_id := "string"
  tenant_id := "string"

  response, err := client.KubernetesProtection.CreateAzureSubscription(
    &kubernetes_protection.CreateAzureSubscriptionParams{
      Body: &models.K8sregCreateAzureSubReq{
        Resources: []interface{}{
          {
          SubscriptionID: &subscription_id,
          TenantID: &tenant_id,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.createAzureSubscription(
  {
    resources: [{
        subscriptionId: "string",
        tenantId: "string"
      }]
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::create_azure_subscription;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::K8sregCreateAzureSubReq;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = K8sregCreateAzureSubReq {
        resources: vec![AzureSubEntity {
            subscription_id: Some("string".to_string()),
            tenant_id: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = create_azure_subscription(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

body = Falcon::K8sregCreateAzureSubReq.new(
  resources: [{
      subscription_id: 'string',
      tenant_id: 'string'
    }]
)

response = api.create_azure_subscription(body)

puts response

Responses

201 Created

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

207 Multi-Status

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

DeleteAWSAccountsMixin0

Delete AWS accounts.

Method DELETE

Route /kubernetes-protection/entities/accounts/aws/v1

Scope Kubernetes Protection: WRITE

PEP 8 delete_aws_accounts

Parameters

ids query · string or list of strings

AWS Account IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_aws_accounts(ids=id_list)
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteAWSAccountsMixin0(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteAWSAccountsMixin0",
                          ids=id_list)
print(response)

PowerShell

Remove-FalconContainerAwsAccount -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesProtection.DeleteAWSAccountsMixin0(
    &kubernetes_protection.DeleteAWSAccountsMixin0Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.deleteAWSAccountsMixin0(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::delete_aws_accounts_mixin0;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_aws_accounts_mixin0(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.delete_aws_accounts_mixin0(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

{
  "pagination": {
    "limit": 0,
    "offset": 0,
    "total": 0
  },
  "powered_by": "string",
  "query_time": 0.0,
  "trace_id": "string",
  "writes": {
    "resources_affected": 0
  }
}

207 Multi-Status

{
  "pagination": {
    "limit": 0,
    "offset": 0,
    "total": 0
  },
  "powered_by": "string",
  "query_time": 0.0,
  "trace_id": "string",
  "writes": {
    "resources_affected": 0
  }
}

400 Bad Request

{
  "pagination": {
    "limit": 0,
    "offset": 0,
    "total": 0
  },
  "powered_by": "string",
  "query_time": 0.0,
  "trace_id": "string",
  "writes": {
    "resources_affected": 0
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "pagination": {
    "limit": 0,
    "offset": 0,
    "total": 0
  },
  "powered_by": "string",
  "query_time": 0.0,
  "trace_id": "string",
  "writes": {
    "resources_affected": 0
  }
}

---

---

DeleteAzureSubscription

Deletes a new Azure Subscription in our system

Method DELETE

Route /kubernetes-protection/entities/accounts/azure/v1

Scope Kubernetes Protection: WRITE

PEP 8 delete_azure_subscription

Parameters

ids query · string or list of strings

Azure Subscription IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_azure_subscription(ids=id_list)
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteAzureSubscription(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteAzureSubscription",
                          ids=id_list)
print(response)

PowerShell

Remove-FalconContainerAzureAccount -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesProtection.DeleteAzureSubscription(
    &kubernetes_protection.DeleteAzureSubscriptionParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.deleteAzureSubscription(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::delete_azure_subscription;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_azure_subscription(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.delete_azure_subscription(ids: ['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

207 Multi-Status

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

FindContainersByContainerRunTimeVersion

Retrieve containers by container_runtime_version

Method GET

Route /container-security/aggregates/containers/find-by-runtimeversion/v1

Scope Falcon Container Image: READ

PEP 8 find_containers_by_runtime_version

Parameters

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 200.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

sort query · string

Field to sort results by

filter query · string

Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). Supported filter fields:

Available values (48)

agent_id	agent_type	ai_related
allow_privilege_escalation	app_name	cid
cloud_account_id	cloud_instance_id	cloud_name
cloud_region	cloud_service	cluster_id
cluster_name	container_id	container_image_id
container_name	cve_id	detection_name
first_seen	image_detection_count	image_digest
image_has_been_assessed	image_id	image_registry
image_repository	image_tag	image_vulnerability_count
insecure_mount_source	insecure_mount_type	insecure_propagation_mode
interactive_mode	ipv4	ipv6
kac_agent_id	labels	last_seen
namespace	node_name	node_uid
package_name_version	pod_id	pod_name
port	privileged	root_write_access
run_as_root_group	run_as_root_user	running_status

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.find_containers_by_runtime_version(limit=integer,
                                                     offset=integer,
                                                     sort="string",
                                                     filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.FindContainersByContainerRunTimeVersion(limit=integer,
                                                          offset=integer,
                                                          sort="string",
                                                          filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("FindContainersByContainerRunTimeVersion",
                          limit=integer,
                          offset=integer,
                          sort="string",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.KubernetesProtection.FindContainersByContainerRunTimeVersion(
    &kubernetes_protection.FindContainersByContainerRunTimeVersionParams{
      Limit: &limit,
      Offset: &offset,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.findContainersByContainerRunTimeVersion(
  integer,  // limit
  integer,  // offset
  "string",  // sort
  "string"  // filter
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::find_containers_by_container_run_time_version;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = find_containers_by_container_run_time_version(
        &falcon.cfg,  // configuration
        Some(integer),  // limit
        Some(integer),  // offset
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.find_containers_by_container_run_time_version(limit: integer,
                                                             offset: integer,
                                                             sort: 'string',
                                                             filter: 'string')

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "cloud_name": "string",
    "cluster_name": "string",
    "container_runtime_version": "string",
    "created_at": "string",
    "first_seen": "string",
    "last_seen": "string",
    "node_name": "string",
    "pod_name": []
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

FindContainersCountAffectedByZeroDayVulnerabilities

Retrieve containers count affected by zero day vulnerabilities

Method GET

Route /container-security/aggregates/containers/count-by-zero-day/v1

Scope Falcon Container Image: READ

PEP 8 read_zero_day_affected_counts

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_zero_day_affected_counts()
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.FindContainersCountAffectedByZeroDayVulnerabilities()
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("FindContainersCountAffectedByZeroDayVulnerabilities")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesProtection.FindContainersCountAffectedByZeroDayVulnerabilities(
    &kubernetes_protection.FindContainersCountAffectedByZeroDayVulnerabilitiesParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.findContainersCountAffectedByZeroDayVulnerabilities();

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::find_containers_count_affected_by_zero_day_vulnerabilities;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = find_containers_count_affected_by_zero_day_vulnerabilities(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.find_containers_count_affected_by_zero_day_vulnerabilities

puts response

Responses

200 OK

{
  "Resources": [
    {
      "count": 0,
      "label": "string"
    }
  ],
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

GetAWSAccountsMixin0

Provides a list of AWS accounts.

Method GET

Route /kubernetes-protection/entities/accounts/aws/v1

Scope Kubernetes Protection: READ

PEP 8 get_aws_accounts

Parameters

ids query · string or list of strings

AWS Account IDs

is_horizon_acct query · string

Filter by whether an account originates from Horizon or not

Available values (2)

false

true

status query · string

Filter by account status

Available values (2)

operational

provisioned

limit query · integer

Limit returned accounts

offset query · integer

Offset returned accounts

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_aws_accounts(ids=id_list,
                                   is_horizon_acct="string",
                                   limit=integer,
                                   offset=integer,
                                   status="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetAWSAccountsMixin0(ids=id_list,
                                       is_horizon_acct="string",
                                       limit=integer,
                                       offset=integer,
                                       status="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetAWSAccountsMixin0",
                          ids=id_list,
                          is_horizon_acct="string",
                          status="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconContainerAwsAccount

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  isHorizonAcct := "string"
  status := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.GetAWSAccountsMixin0(
    &kubernetes_protection.GetAWSAccountsMixin0Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      IsHorizonAcct: &isHorizonAcct,
      Status: &status,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.getAWSAccountsMixin0(
  ["ID1", "ID2", "ID3"],  // ids
  "string",  // isHorizonAcct
  "string",  // status
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::get_aws_accounts_mixin0;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_aws_accounts_mixin0(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
        Some("string"),  // is_horizon_acct
        Some("string"),  // status
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.get_aws_accounts_mixin0(ids: ['ID1', 'ID2', 'ID3'],
                                       is_horizon_acct: 'string',
                                       status: 'string',
                                       limit: integer,
                                       offset: integer)

puts response

Responses

200 OK

[
  {
    "account_id": "string",
    "aws_permissions_status": [],
    "cid": "string",
    "cloudformation_url": "string",
    "created_at": "string",
    "from_cspm": false,
    "iam_role_arn": "string",
    "is_master": false,
    "organization_id": "string",
    "region": "string",
    "status": "string",
    "updated_at": "string"
  }
]

207 Multi-Status

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "account_id": "string",
      "aws_permissions_status": [],
      "cid": "string",
      "cloudformation_url": "string",
      "created_at": "string",
      "from_cspm": false,
      "iam_role_arn": "string",
      "is_master": false,
      "organization_id": "string",
      "region": "string",
      "status": "string",
      "updated_at": "string"
    }
  ]
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "account_id": "string",
      "aws_permissions_status": [],
      "cid": "string",
      "cloudformation_url": "string",
      "created_at": "string",
      "from_cspm": false,
      "iam_role_arn": "string",
      "is_master": false,
      "organization_id": "string",
      "region": "string",
      "status": "string",
      "updated_at": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "account_id": "string",
      "aws_permissions_status": [],
      "cid": "string",
      "cloudformation_url": "string",
      "created_at": "string",
      "from_cspm": false,
      "iam_role_arn": "string",
      "is_master": false,
      "organization_id": "string",
      "region": "string",
      "status": "string",
      "updated_at": "string"
    }
  ]
}

---

---

GetAzureInstallScript

Provides the script to run for a given tenant id and subscription IDs

Method GET

Route /kubernetes-protection/entities/user-script/azure/v1

Scope Kubernetes Protection: READ

PEP 8 get_azure_install_script

Parameters

id query · string

Azure Tenant ID

subscription_id query · string or list of strings

Azure Subscription IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_azure_install_script(id="string", subscription_id=id_list)
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetAzureInstallScript(id="string", subscription_id=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetAzureInstallScript",
                          id="string",
                          subscription_id=id_list)
print(response)

PowerShell

Get-FalconContainerAzureScript -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  iD := "string"

  response, err := client.KubernetesProtection.GetAzureInstallScript(
    &kubernetes_protection.GetAzureInstallScriptParams{
      ID: &iD,
      SubscriptionID: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.getAzureInstallScript(
  "string",  // id
  ["ID1", "ID2", "ID3"]  // subscriptionId
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::get_azure_install_script;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_azure_install_script(
        &falcon.cfg,  // configuration
        Some("string"),  // id
        Some(vec!["string".to_string()]),  // subscription_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.get_azure_install_script(id: 'string',
                                        subscription_id: ['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "script": "string",
    "service_account_public_keys": []
  }
]

207 Multi-Status

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "script": "string",
      "service_account_public_keys": []
    }
  ]
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "script": "string",
      "service_account_public_keys": []
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "script": "string",
      "service_account_public_keys": []
    }
  ]
}

---

---

GetAzureTenantConfig

Gets the Azure tenant Config

Method GET

Route /kubernetes-protection/entities/config/azure/v1

Scope Kubernetes Protection: READ

PEP 8 get_azure_tenant_config

Parameters

ids query · string or list of strings

Azure Tenant IDs

limit query · integer

Limit returned accounts

offset query · integer

Offset returned accounts

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_azure_tenant_config(ids=id_list,
                                          limit=integer,
                                          offset=integer)
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetAzureTenantConfig(ids=id_list,
                                       limit=integer,
                                       offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetAzureTenantConfig",
                          ids=id_list,
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconContainerAzureConfig

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.GetAzureTenantConfig(
    &kubernetes_protection.GetAzureTenantConfigParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.getAzureTenantConfig(
  ["ID1", "ID2", "ID3"],  // ids
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::get_azure_tenant_config;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_azure_tenant_config(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.get_azure_tenant_config(ids: ['ID1', 'ID2', 'ID3'],
                                       limit: integer,
                                       offset: integer)

puts response

Responses

200 OK

[
  {
    "client_id": "string",
    "public_certificate": "string",
    "tenant_id": "string"
  }
]

207 Multi-Status

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_id": "string",
      "public_certificate": "string",
      "tenant_id": "string"
    }
  ]
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_id": "string",
      "public_certificate": "string",
      "tenant_id": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_id": "string",
      "public_certificate": "string",
      "tenant_id": "string"
    }
  ]
}

---

---

GetAzureTenantIDs

Provides all the azure subscriptions and tenants

Method GET

Route /kubernetes-protection/entities/tenants/azure/v1

Scope Kubernetes Protection: READ

PEP 8 get_azure_tenant_ids

Parameters

ids query · string or list of strings

Azure Tenant IDs

status query · string

Cluster Status

Available values (3)

Not Installed

Running

Stopped

limit query · integer

Limit returned accounts

offset query · integer

Offset returned accounts

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_azure_tenant_ids(ids=id_list,
                                       status="string",
                                       limit=integer,
                                       offset=integer)
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetAzureTenantIDs(ids=id_list,
                                    status="string",
                                    limit=integer,
                                    offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetAzureTenantIDs",
                          ids=id_list,
                          status="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconContainerAzureTenant

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  status := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.GetAzureTenantIDs(
    &kubernetes_protection.GetAzureTenantIDsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Status: &status,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.getAzureTenantIDs(
  ["ID1", "ID2", "ID3"],  // ids
  "string",  // status
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::get_azure_tenant_ids;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_azure_tenant_ids(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
        Some("string"),  // status
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.get_azure_tenant_ids(ids: ['ID1', 'ID2', 'ID3'],
                                    status: 'string',
                                    limit: integer,
                                    offset: integer)

puts response

Responses

200 OK

[
  {
    "subscription_ids": [],
    "tenant_id": "string"
  }
]

207 Multi-Status

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "subscription_ids": [],
      "tenant_id": "string"
    }
  ]
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "subscription_ids": [],
      "tenant_id": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "subscription_ids": [],
      "tenant_id": "string"
    }
  ]
}

---

---

GetClusters

Provides the clusters acknowledged by the Kubernetes Protection service

Method GET

Route /kubernetes-protection/entities/kubernetes/clusters/v1

Scope Kubernetes Protection: READ

PEP 8 get_clusters

Parameters

cluster_names query · string or list of strings

Cluster name. For EKS it will be cluster ARN.

status query · string or list of strings

Cluster Status

Available values (3)

Not Installed

Running

Stopped

account_ids query · string or list of strings

Cluster Account id. For EKS it will be AWS account ID.

locations query · string or list of strings

Cloud location

cluster_service query · string

Cluster Service

Available values (2)

aks

eks

limit query · integer

Limit returned accounts

offset query · integer

Offset returned accounts

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_clusters(account_ids=id_list,
                               cluster_names=id_list,
                               cluster_service="string",
                               limit=integer,
                               locations=id_list,
                               status=id_list,
                               offset=integer)
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetClusters(account_ids=id_list,
                              cluster_names=id_list,
                              cluster_service="string",
                              limit=integer,
                              locations=id_list,
                              status=id_list,
                              offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetClusters",
                          cluster_names=id_list,
                          status=id_list,
                          account_ids=id_list,
                          locations=id_list,
                          cluster_service="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  clusterService := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.GetClusters(
    &kubernetes_protection.GetClustersParams{
      ClusterNames: []string{"ID1", "ID2", "ID3"},
      Status: []string{"ID1", "ID2", "ID3"},
      AccountIds: []string{"ID1", "ID2", "ID3"},
      Locations: []string{"ID1", "ID2", "ID3"},
      ClusterService: &clusterService,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.getClusters(
  ["ID1", "ID2", "ID3"],  // clusterNames
  ["ID1", "ID2", "ID3"],  // status
  ["ID1", "ID2", "ID3"],  // accountIds
  ["ID1", "ID2", "ID3"],  // locations
  "string",  // clusterService
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::get_clusters;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_clusters(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // cluster_names
        Some(vec!["string".to_string()]),  // status
        Some(vec!["string".to_string()]),  // account_ids
        Some(vec!["string".to_string()]),  // locations
        Some("string"),  // cluster_service
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.get_clusters(cluster_names: ['ID1', 'ID2', 'ID3'],
                            status: ['ID1', 'ID2', 'ID3'],
                            account_ids: ['ID1', 'ID2', 'ID3'],
                            locations: ['ID1', 'ID2', 'ID3'],
                            cluster_service: 'string',
                            limit: integer,
                            offset: integer)

puts response

Responses

200 OK

[
  {
    "account_id": "string",
    "agent_version": {},
    "cid": "string",
    "cluster_id": "string",
    "cluster_name": "string",
    "cluster_service": "string",
    "created_at": "string",
    "helm_version": {},
    "k8s_version": {},
    "last_heartbeat_at": "string",
    "location": "string",
    "status": "string",
    "updated_at": "string"
  }
]

207 Multi-Status

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "account_id": "string",
      "agent_version": {},
      "cid": "string",
      "cluster_id": "string",
      "cluster_name": "string",
      "cluster_service": "string",
      "created_at": "string",
      "helm_version": {},
      "k8s_version": {},
      "last_heartbeat_at": "string",
      "location": "string",
      "status": "string",
      "updated_at": "string"
    }
  ]
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "account_id": "string",
      "agent_version": {},
      "cid": "string",
      "cluster_id": "string",
      "cluster_name": "string",
      "cluster_service": "string",
      "created_at": "string",
      "helm_version": {},
      "k8s_version": {},
      "last_heartbeat_at": "string",
      "location": "string",
      "status": "string",
      "updated_at": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "account_id": "string",
      "agent_version": {},
      "cid": "string",
      "cluster_id": "string",
      "cluster_name": "string",
      "cluster_service": "string",
      "created_at": "string",
      "helm_version": {},
      "k8s_version": {},
      "last_heartbeat_at": "string",
      "location": "string",
      "status": "string",
      "updated_at": "string"
    }
  ]
}

---

---

GetCombinedCloudClusters

Returns a combined list of provisioned cloud accounts and known kubernetes clusters

Method GET

Route /kubernetes-protection/entities/cloud_cluster/v1

Scope Kubernetes Protection: READ

PEP 8 get_cloud_clusters

Parameters

locations query · string or list of strings

Cloud location

ids query · string or list of strings

Cloud Account IDs

cluster_service query · string or list of strings

Cluster Service

Available values (2)

aks

eks

cluster_status query · string or list of strings

Cluster Status

Available values (3)

Not Installed

Running

Stopped

limit query · integer

Limit returned accounts

offset query · integer

Offset returned accounts

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

cluser_service body · string or list of strings

Cluster Service.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_cloud_clusters(cluser_service=id_list,
                                     cluster_status=id_list,
                                     ids=id_list,
                                     locations=id_list,
                                     limit=integer,
                                     offset=integer)
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetCombinedCloudClusters(cluser_service=id_list,
                                           cluster_status=id_list,
                                           ids=id_list,
                                           locations=id_list,
                                           limit=integer,
                                           offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetCombinedCloudClusters",
                          locations=id_list,
                          ids=id_list,
                          cluster_service=id_list,
                          cluster_status=id_list,
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconContainerAccount

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.GetCombinedCloudClusters(
    &kubernetes_protection.GetCombinedCloudClustersParams{
      Locations: []string{"ID1", "ID2", "ID3"},
      Ids: []string{"ID1", "ID2", "ID3"},
      ClusterService: []string{"ID1", "ID2", "ID3"},
      ClusterStatus: []string{"ID1", "ID2", "ID3"},
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.getCombinedCloudClusters(
  ["ID1", "ID2", "ID3"],  // locations
  ["ID1", "ID2", "ID3"],  // ids
  ["ID1", "ID2", "ID3"],  // clusterService
  ["ID1", "ID2", "ID3"],  // clusterStatus
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::get_combined_cloud_clusters;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_combined_cloud_clusters(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // locations
        Some(vec!["string".to_string()]),  // ids
        Some(vec!["string".to_string()]),  // cluster_service
        Some(vec!["string".to_string()]),  // cluster_status
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.get_combined_cloud_clusters(locations: ['ID1', 'ID2', 'ID3'],
                                           ids: ['ID1', 'ID2', 'ID3'],
                                           cluster_service: ['ID1', 'ID2', 'ID3'],
                                           cluster_status: ['ID1', 'ID2', 'ID3'],
                                           limit: integer,
                                           offset: integer)

puts response

Responses

200 OK

[
  {
    "account_id": "string",
    "aws_meta": {},
    "azure_meta": {},
    "cloud_status": "string",
    "cluster_name": "string",
    "cluster_service": "string",
    "cluster_status": "string",
    "from_cspm": false,
    "location": "string"
  }
]

207 Multi-Status

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "account_id": "string",
      "aws_meta": {},
      "azure_meta": {},
      "cloud_status": "string",
      "cluster_name": "string",
      "cluster_service": "string",
      "cluster_status": "string",
      "from_cspm": false,
      "location": "string"
    }
  ]
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "account_id": "string",
      "aws_meta": {},
      "azure_meta": {},
      "cloud_status": "string",
      "cluster_name": "string",
      "cluster_service": "string",
      "cluster_status": "string",
      "from_cspm": false,
      "location": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "account_id": "string",
      "aws_meta": {},
      "azure_meta": {},
      "cloud_status": "string",
      "cluster_name": "string",
      "cluster_service": "string",
      "cluster_status": "string",
      "from_cspm": false,
      "location": "string"
    }
  ]
}

---

---

GetHelmValuesYaml

Provides a sample Helm values.yaml file for a customer to install alongside the agent Helm chart

Method GET

Route /kubernetes-protection/entities/integration/agent/v1

Scope Kubernetes Protection: READ

PEP 8 get_helm_values_yaml

Parameters

cluster_name query · string

Cluster name. For EKS it will be cluster ARN.

is_self_managed_cluster query · boolean

Set to true if the cluster is not managed by a cloud provider, false if it is.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.get_helm_values_yaml(cluster_name="string",
                                       is_self_managed_cluster=boolean)
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.GetHelmValuesYaml(cluster_name="string",
                                    is_self_managed_cluster=boolean)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetHelmValuesYaml",
                          cluster_name="string",
                          is_self_managed_cluster=boolean)
print(response)

PowerShell

Receive-FalconContainerYaml -ClusterName "string" -Path "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  isSelfManagedCluster := boolean

  response, err := client.KubernetesProtection.GetHelmValuesYaml(
    &kubernetes_protection.GetHelmValuesYamlParams{
      ClusterName: "string",
      IsSelfManagedCluster: &isSelfManagedCluster,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.getHelmValuesYaml(
  "string",  // clusterName
  boolean  // isSelfManagedCluster
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::get_helm_values_yaml;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_helm_values_yaml(
        &falcon.cfg,  // configuration
        "string",  // cluster_name
        Some(boolean),  // is_self_managed_cluster
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.get_helm_values_yaml('string')

puts response

Responses

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

GetLocations

Provides the cloud locations acknowledged by the Kubernetes Protection service

Method GET

Route /kubernetes-protection/entities/cloud-locations/v1

Scope Kubernetes Protection: READ

PEP 8 get_locations

Parameters

clouds query · string or list of strings

Cloud Provider

Available values (3)

aws

azure

gcp

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_locations(clouds=id_list)
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetLocations(clouds=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetLocations",
                          clouds=id_list)
print(response)

PowerShell

Get-FalconContainerCloud

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesProtection.GetLocations(
    &kubernetes_protection.GetLocationsParams{
      Clouds: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.getLocations(["ID1", "ID2", "ID3"]);  // clouds

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::get_locations;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_locations(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // clouds
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.get_locations(clouds: ['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "cloud": "string",
    "location": "string"
  }
]

207 Multi-Status

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cloud": "string",
      "location": "string"
    }
  ]
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cloud": "string",
      "location": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cloud": "string",
      "location": "string"
    }
  ]
}

---

---

GetStaticScripts

Gets static bash scripts that are used during registration

Method GET

Route /kubernetes-protection/entities/gen/scripts/v1

Scope Kubernetes Protection: READ

PEP 8 get_static_scripts

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.get_static_scripts()
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.GetStaticScripts()
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetStaticScripts")
print(response)

PowerShell

Get-FalconContainerScript

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesProtection.GetStaticScripts(
    &kubernetes_protection.GetStaticScriptsParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.getStaticScripts();

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::get_static_scripts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_static_scripts(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.get_static_scripts

puts response

Responses

200 OK

[
  {}
]

207 Multi-Status

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {}
  ]
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {}
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {}
  ]
}

---

---

GroupContainersByManaged

Group the containers by Managed

Method GET

Route /container-security/aggregates/containers/group-by-managed/v1

Scope Falcon Container Image: READ

PEP 8 group_managed_containers

Parameters

filter query · string

Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). Supported filter fields:

Available values (46)

agent_id	ai_related	allow_privilege_escalation
app_name	cid	cloud_account_id
cloud_instance_id	cloud_name	cloud_region
cloud_service	cluster_id	cluster_name
container_id	container_image_id	container_name
cve_id	detection_name	first_seen
image_detection_count	image_digest	image_has_been_assessed
image_id	image_registry	image_repository
image_tag	image_vulnerability_count	insecure_mount_source
insecure_mount_type	insecure_propagation_mode	interactive_mode
ipv4	ipv6	kac_agent_id
labels	last_seen	namespace
node_name	node_uid	pod_id
pod_name	port	privileged
root_write_access	run_as_root_group	run_as_root_user
running_status

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.group_managed_containers(filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.GroupContainersByManaged(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GroupContainersByManaged",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.GroupContainersByManaged(
    &kubernetes_protection.GroupContainersByManagedParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.groupContainersByManaged("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::group_containers_by_managed;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = group_containers_by_managed(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.group_containers_by_managed(filter: 'string')

puts response

Responses

200 OK

[
  {
    "managed": 0,
    "unmanaged": 0
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ListAzureAccounts

Provides the azure subscriptions registered to Kubernetes Protection

Method GET

Route /kubernetes-protection/entities/accounts/azure/v1

Scope Kubernetes Protection: READ

PEP 8 list_azure_accounts

Parameters

ids query · string or list of strings

Azure Tenant IDs

subscription_id query · string or list of strings

Azure Subscription IDs

status query · string

Filter by account status

Available values (2)

operational

provisioned

is_horizon_acct query · string

Filter by whether an account originates from Horizon or not

Available values (2)

false

true

limit query · integer

Limit returned accounts

offset query · integer

Offset returned accounts

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.list_azure_accounts(ids=id_list,
                                      is_horizon_acct="string",
                                      subscription_id=id_list,
                                      limit=integer,
                                      offset=integer,
                                      status="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ListAzureAccounts(ids=id_list,
                                    is_horizon_acct="string",
                                    subscription_id=id_list,
                                    limit=integer,
                                    offset=integer,
                                    status="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ListAzureAccounts",
                          ids=id_list,
                          subscription_id=id_list,
                          status="string",
                          is_horizon_acct="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconContainerAzureAccount

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  status := "string"
  isHorizonAcct := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.ListAzureAccounts(
    &kubernetes_protection.ListAzureAccountsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      SubscriptionID: []string{"ID1", "ID2", "ID3"},
      Status: &status,
      IsHorizonAcct: &isHorizonAcct,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.listAzureAccounts(
  ["ID1", "ID2", "ID3"],  // ids
  ["ID1", "ID2", "ID3"],  // subscriptionId
  "string",  // status
  "string",  // isHorizonAcct
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::list_azure_accounts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = list_azure_accounts(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
        Some(vec!["string".to_string()]),  // subscription_id
        Some("string"),  // status
        Some("string"),  // is_horizon_acct
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.list_azure_accounts(ids: ['ID1', 'ID2', 'ID3'],
                                   subscription_id: ['ID1', 'ID2', 'ID3'],
                                   status: 'string',
                                   is_horizon_acct: 'string',
                                   limit: integer,
                                   offset: integer)

puts response

Responses

200 OK

[
  {
    "azure_permissions_status": [],
    "created_at": "string",
    "from_cspm": false,
    "status": "string",
    "subscription_id": "string",
    "tenant_id": "string",
    "updated_at": "string"
  }
]

207 Multi-Status

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "azure_permissions_status": [],
      "created_at": "string",
      "from_cspm": false,
      "status": "string",
      "subscription_id": "string",
      "tenant_id": "string",
      "updated_at": "string"
    }
  ]
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "azure_permissions_status": [],
      "created_at": "string",
      "from_cspm": false,
      "status": "string",
      "subscription_id": "string",
      "tenant_id": "string",
      "updated_at": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "azure_permissions_status": [],
      "created_at": "string",
      "from_cspm": false,
      "status": "string",
      "subscription_id": "string",
      "tenant_id": "string",
      "updated_at": "string"
    }
  ]
}

---

---

PatchAzureServicePrincipal

Adds the client ID for the given tenant ID to our system

Method PATCH

Route /kubernetes-protection/entities/service-principal/azure/v1

Scope Kubernetes Protection: WRITE

PEP 8 update_azure_service_principal

Parameters

id query · string

Azure Tenant ID

client_id query · string

Azure Client ID

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.update_azure_service_principal(id="string",
                                                 client_id="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.PatchAzureServicePrincipal(id="string", client_id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("PatchAzureServicePrincipal",
                          id="string",
                          client_id="string")
print(response)

PowerShell

Edit-FalconContainerAzureAccount -ClientId "string" -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesProtection.PatchAzureServicePrincipal(
    &kubernetes_protection.PatchAzureServicePrincipalParams{
      ID: "string",
      ClientID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.patchAzureServicePrincipal(
  "string",  // id
  "string"  // clientId
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::patch_azure_service_principal;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = patch_azure_service_principal(
        &falcon.cfg,  // configuration
        "string",  // id
        "string",  // client_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.patch_azure_service_principal('string', 'string')

puts response

Responses

201 Created

[
  {
    "client_id": "string",
    "public_certificate": "string",
    "tenant_id": "string"
  }
]

207 Multi-Status

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_id": "string",
      "public_certificate": "string",
      "tenant_id": "string"
    }
  ]
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_id": "string",
      "public_certificate": "string",
      "tenant_id": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "client_id": "string",
      "public_certificate": "string",
      "tenant_id": "string"
    }
  ]
}

---

---

PostAggregatesPods

Get aggregate query result for pods

Method POST

Route /container-security/aggregates/pods/v1

Scope Falcon Container Image: WRITE

PEP 8 post_aggregates_pods

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

date_ranges body · list of dictionaries

List of date range objects.

field body · string

The field to aggregate on.

filter body · string

FQL filter expression.

interval body · string

Time interval for aggregation.

min_doc_count body · integer

Minimum document count threshold.

missing body · string

Missing value handling.

name body · string

Name of the aggregation.

q body · string

Full text search across all metadata fields.

ranges body · list of dictionaries

List of range objects.

size body · integer

Maximum number of results.

sort body · string

Sort expression.

sub_aggregates body · list of strings

List of sub-aggregate expressions.

time_zone body · string

Time zone for date operations.

type body · string

Type of aggregation (terms, date_histogram, etc.)

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

ranges = [
    {
        "From": 0,
        "To": 0
    }
]

response = falcon.post_aggregates_pods(date_ranges=date_ranges,
                                       field="string",
                                       filter="string",
                                       interval="string",
                                       min_doc_count=integer,
                                       missing="string",
                                       name="string",
                                       q="string",
                                       ranges=ranges,
                                       size=integer,
                                       sort="string",
                                       sub_aggregates=["string"],
                                       time_zone="string",
                                       type="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

ranges = [
    {
        "From": 0,
        "To": 0
    }
]

response = falcon.PostAggregatesPods(date_ranges=date_ranges,
                                     field="string",
                                     filter="string",
                                     interval="string",
                                     min_doc_count=integer,
                                     missing="string",
                                     name="string",
                                     q="string",
                                     ranges=ranges,
                                     size=integer,
                                     sort="string",
                                     sub_aggregates=["string"],
                                     time_zone="string",
                                     type="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("PostAggregatesPods", body={})
print(response)

PowerShell

Examples coming soon.

Go

Examples coming soon.

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.postAggregatesPods([{}]);  // body

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

body = [{}]

response = api.post_aggregates_pods(body)

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "buckets": [],
      "doc_count_error_upper_bound": 0,
      "hits": {},
      "name": "string",
      "sum_other_doc_count": 0
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "buckets": [],
      "doc_count_error_upper_bound": 0,
      "hits": {},
      "name": "string",
      "sum_other_doc_count": 0
    }
  ]
}

---

---

PostSearchKubernetesIOMEntities

Search for Kubernetes IOMs with filtering options.Pagination is supported via Elasticsearch’s search_after search param and point in time.

Method POST

Route /container-security/combined/kubernetes-ioms/search/v1

Scope Falcon Container Image: WRITE

PEP 8 search_kubernetes_ioms

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

pit body · string

Elasticsearch Point in Time ID used to paginate

search_after body · array

Sort value to continue the pagination from

filter query · string

FQL filter to search Kubernetes IOM entities

sort query · string

Sort specification for results

limit query · integer

Maximum number of records to return (default: 100, max: 500)

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.search_kubernetes_ioms(filter="string",
                                         sort="string",
                                         limit=integer)
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.PostSearchKubernetesIOMEntities(filter="string",
                                                  sort="string",
                                                  limit=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "pit": "string",
    "search_after": ["string"]
}

response = falcon.command("PostSearchKubernetesIOMEntities",
                          filter="string",
                          sort="string",
                          limit=integer,
                          body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  pit := "string"
  filter := "string"
  sort := "string"
  limit := int64(0)

  response, err := client.KubernetesProtection.PostSearchKubernetesIOMEntities(
    &kubernetes_protection.PostSearchKubernetesIOMEntitiesParams{
      Body: &models.K8siomsSearchRequest{
        Pit: &pit,
        SearchAfter: []interface{}{},
      },
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.postSearchKubernetesIOMEntities(
  {  // body
      pit: "string",
      searchAfter: []
  },
  "string",  // filter
  "string",  // sort
  integer  // limit
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::post_search_kubernetes_iom_entities;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::K8siomsSearchRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = K8siomsSearchRequest {
        pit: Some("string".to_string()),
        search_after: vec![],
        ..Default::default()
    };

    let response = post_search_kubernetes_iom_entities(
        &falcon.cfg,  // configuration
        body,  // body
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

body = {
  pit: 'string',
  search_after: []
}

response = api.post_search_kubernetes_iom_entities(body)

puts response

Responses

200 OK

[
  {
    "pit": "string",
    "results": {},
    "search_after": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadClusterCombined

Retrieve kubernetes clusters identified by the provided filter criteria

Method GET

Route /container-security/combined/clusters/v1

Scope Falcon Container Image: READ

PEP 8 read_clusters_combined

Parameters

filter query · string

Search Kubernetes clusters using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (23)

access	agent_id	agent_status
agent_type	cid	cloud_account_id
cloud_name	cloud_region	cloud_service
cluster_id	cluster_name	cluster_status
container_count	iar_coverage	kac_agent_id
kubernetes_version	last_seen	management_status
namespace	node_count	pod_count
pod_name	tags

sort query · string

Field to sort results by

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 200.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_clusters_combined(filter="string",
                                         limit=integer,
                                         offset=integer,
                                         sort="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadClusterCombined(filter="string",
                                      limit=integer,
                                      offset=integer,
                                      sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadClusterCombined",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconContainerCluster -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.ClusterCombined(
    &kubernetes_protection.ClusterCombinedParams{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.clusterCombined(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_cluster_combined;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_cluster_combined(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_cluster_combined(filter: 'string',
                                     sort: 'string',
                                     limit: integer,
                                     offset: integer)

puts response

Responses

200 OK

[
  {
    "access": "string",
    "agent_status": "string",
    "agents": [],
    "cid": "string",
    "cloud_account_id": "string",
    "cloud_name": "string",
    "cloud_region": "string",
    "cloud_service": "string",
    "cluster_id": "string",
    "cluster_name": "string",
    "cluster_security_group": "string",
    "cluster_status": "string",
    "container_count": 0,
    "first_seen": "string",
    "iar_coverage": false,
    "kac_agent_active": false,
    "kac_agent_id": "string",
    "kubernetes_version": "string",
    "labels_list": [],
    "last_seen": "string",
    "management_status": "string",
    "node_count": 0,
    "pod_count": 0,
    "security_group": "string",
    "tags": {},
    "virtual_network": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadClusterCombinedV2

Retrieve Kubernetes cluster data

Method GET

Route /container-security/combined/clusters/v2

Scope Falcon Container Image: READ

PEP 8 read_clusters_combined_v2

Parameters

filter query · string

Search Kubernetes clusters using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (23)

access	agent_id	agent_status
agent_type	cid	cloud_account_id
cloud_name	cloud_region	cloud_service
cluster_id	cluster_name	cluster_status
container_count	iar_coverage	kac_agent_id
kubernetes_version	last_seen	management_status
namespace	node_count	pod_count
pod_name	tags

sort query · string

The fields to sort the records on.

include_counts query · boolean

Flag to include node, pod and container counts in the response

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 200.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_clusters_combined_v2(filter="string",
                                            include_counts=boolean,
                                            limit=integer,
                                            offset=integer,
                                            sort="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadClusterCombinedV2(filter="string",
                                        include_counts=boolean,
                                        limit=integer,
                                        offset=integer,
                                        sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadClusterCombinedV2",
                          filter="string",
                          sort="string",
                          include_counts=boolean,
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  includeCounts := boolean
  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.ReadClusterCombinedV2(
    &kubernetes_protection.ReadClusterCombinedV2Params{
      Filter: &filter,
      Sort: &sort,
      IncludeCounts: &includeCounts,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.readClusterCombinedV2(
  "string",  // filter
  "string",  // sort
  boolean,  // includeCounts
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_cluster_combined_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_cluster_combined_v2(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(boolean),  // include_counts
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_cluster_combined_v2(filter: 'string',
                                        sort: 'string',
                                        include_counts: boolean,
                                        limit: integer,
                                        offset: integer)

puts response

Responses

200 OK

[
  {
    "access": "string",
    "agent_coverage": {},
    "cid": "string",
    "cloud_provider_info": {},
    "cloud_resource_id": "string",
    "cluster_id": "string",
    "cluster_name": "string",
    "cluster_status": "string",
    "kubernetes_version": "string",
    "labels": {},
    "management_status": "string",
    "resource_counts": {},
    "security_group": "string",
    "tags": {},
    "timestamps": {},
    "virtual_network": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadClusterCount

Retrieve cluster counts

Method GET

Route /container-security/aggregates/clusters/count/v1

Scope Falcon Container Image: READ

PEP 8 read_cluster_count

Parameters

filter query · string

Retrieve count of Kubernetes clusters that match a query in Falcon Query Language (FQL). Supported filter fields:

Available values (23)

access	agent_id	agent_status
agent_type	cid	cloud_account_id
cloud_name	cloud_region	cloud_service
cluster_id	cluster_name	cluster_status
container_count	iar_coverage	kac_agent_id
kubernetes_version	last_seen	management_status
namespace	node_count	pod_count
pod_name	tags

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_cluster_count(filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadClusterCount(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadClusterCount",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.ClusterCount(
    &kubernetes_protection.ClusterCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.clusterCount("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_cluster_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_cluster_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_cluster_count(filter: 'string')

puts response

Responses

200 OK

{
  "Resources": [
    {
      "count": 0,
      "label": "string"
    }
  ],
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadClusterEnrichment

Retrieve cluster enrichment data

Method GET

Route /container-security/aggregates/enrichment/clusters/entities/v1

Scope Falcon Container Image: READ

PEP 8 read_cluster_enrichment

Parameters

cluster_id query · string or list of strings

One or more cluster ids for which to retrieve enrichment info

filter query · string

Supported filter fields:

Available values (7)

cloud_account_id	cloud_name	cloud_region
cluster_id	cluster_name	last_seen
namespace

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.read_cluster_enrichment(cluster_id=id_list, filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ReadClusterEnrichment(cluster_id=id_list, filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ReadClusterEnrichment",
                          cluster_id=id_list,
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.ClusterEnrichment(
    &kubernetes_protection.ClusterEnrichmentParams{
      ClusterID: []string{"ID1", "ID2", "ID3"},
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.clusterEnrichment(
  ["ID1", "ID2", "ID3"],  // clusterId
  "string"  // filter
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_cluster_enrichment;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_cluster_enrichment(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // cluster_id
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_cluster_enrichment(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

{
  "EnrichmentData": [
    {
      "cluster_id": "string",
      "enrichment_data": {}
    }
  ],
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadClustersByDateRangeCount

Retrieve clusters by date range counts

Method GET

Route /container-security/aggregates/clusters/count-by-date/v1

Scope Falcon Container Image: READ

PEP 8 read_clusters_by_date_range

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_clusters_by_date_range()
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadClustersByDateRangeCount()
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadClustersByDateRangeCount")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesProtection.ClustersByDateRangeCount(
    &kubernetes_protection.ClustersByDateRangeCountParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.clustersByDateRangeCount();

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_clusters_by_date_range_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_clusters_by_date_range_count(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_clusters_by_date_range_count

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "name": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadClustersByKubernetesVersionCount

Bucket clusters by kubernetes version

Method GET

Route /container-security/aggregates/clusters/count-by-kubernetes-version/v1

Scope Falcon Container Image: READ

PEP 8 read_clusters_by_version

Parameters

filter query · string

Retrieve count of Kubernetes clusters that match a query in Falcon Query Language (FQL). Supported filter fields:

Available values (23)

access	agent_id	agent_status
agent_type	cid	cloud_account_id
cloud_name	cloud_region	cloud_service
cluster_id	cluster_name	cluster_status
container_count	iar_coverage	kac_agent_id
kubernetes_version	last_seen	management_status
namespace	node_count	pod_count
pod_name	tags

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_clusters_by_version(filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadClustersByKubernetesVersionCount(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadClustersByKubernetesVersionCount",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.ClustersByKubernetesVersionCount(
    &kubernetes_protection.ClustersByKubernetesVersionCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.clustersByKubernetesVersionCount("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_clusters_by_kubernetes_version_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_clusters_by_kubernetes_version_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_clusters_by_kubernetes_version_count(filter: 'string')

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "name": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadClustersByStatusCount

Bucket clusters by status

Method GET

Route /container-security/aggregates/clusters/count-by-status/v1

Scope Falcon Container Image: READ

PEP 8 read_clusters_by_status

Parameters

filter query · string

Retrieve count of Kubernetes clusters that match a query in Falcon Query Language (FQL). Supported filter fields:

Available values (23)

access	agent_id	agent_status
agent_type	cid	cloud_account_id
cloud_name	cloud_region	cloud_service
cluster_id	cluster_name	cluster_status
container_count	iar_coverage	kac_agent_id
kubernetes_version	last_seen	management_status
namespace	node_count	pod_count
pod_name	tags

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_clusters_by_status(filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadClustersByStatusCount(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadClustersByStatusCount",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.ClustersByStatusCount(
    &kubernetes_protection.ClustersByStatusCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.clustersByStatusCount("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_clusters_by_status_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_clusters_by_status_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_clusters_by_status_count(filter: 'string')

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "name": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadContainerCombined

Retrieves a paginated list of containers identified by the provided filter criteria.

Method GET

Route /container-security/combined/containers/v1

Scope Falcon Container Image: READ

PEP 8 read_containers_combined

Parameters

filter query · string

Search Kubernetes containers using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (48)

agent_id	agent_type	ai_related
allow_privilege_escalation	app_name	cid
cloud_account_id	cloud_instance_id	cloud_name
cloud_region	cloud_service	cluster_id
cluster_name	container_id	container_image_id
container_name	cve_id	detection_name
first_seen	image_detection_count	image_digest
image_has_been_assessed	image_id	image_registry
image_repository	image_tag	image_vulnerability_count
insecure_mount_source	insecure_mount_type	insecure_propagation_mode
interactive_mode	ipv4	ipv6
kac_agent_id	labels	last_seen
namespace	node_name	node_uid
package_name_version	pod_id	pod_name
port	privileged	root_write_access
run_as_root_group	run_as_root_user	running_status

sort query · string

Field to sort results by

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 200.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_containers_combined(filter="string",
                                           limit=integer,
                                           offset=integer,
                                           sort="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadContainerCombined(filter="string",
                                        limit=integer,
                                        offset=integer,
                                        sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadContainerCombined",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconContainer -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.ContainerCombined(
    &kubernetes_protection.ContainerCombinedParams{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.containerCombined(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_container_combined;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_container_combined(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_container_combined(filter: 'string',
                                       sort: 'string',
                                       limit: integer,
                                       offset: integer)

puts response

Responses

200 OK

[
  {
    "agents": [],
    "allow_privilege_escalation": false,
    "cid": "string",
    "cloud": "string",
    "cloud_account_id": "string",
    "cloud_region": "string",
    "cluster_id": "string",
    "cluster_name": "string",
    "config_labels": "string",
    "config_user": "string",
    "container_image_id": "string",
    "created_at": 0,
    "cve_ids": [],
    "first_seen": 0,
    "host_config_devices": "string",
    "id": "string",
    "image_application_package_count": 0,
    "image_assessed_at": 0,
    "image_detection_count": 0,
    "image_detection_id_list": [],
    "image_detection_name_list": [],
    "image_detection_severity_by_type": {},
    "image_digest": "string",
    "image_has_been_assessed": false,
    "image_highest_severity_vulnerability": "string",
    "image_id": "string",
    "image_package_count": 0,
    "image_registry": "string",
    "image_repo": "string",
    "image_tag": "string",
    "image_vulnerability_count": 0,
    "image_vulnerability_severity_by_type": {},
    "insecure_mount_source": "string",
    "insecure_mount_type": "string",
    "insecure_propagation_mode": false,
    "interactive_mode": false,
    "ipv4": "string",
    "ipv6": "string",
    "kpa_coverage": false,
    "labels": {},
    "labels_list": [],
    "last_seen": 0,
    "linux_sensor_aid": "string",
    "linux_sensor_config_build": "string",
    "linux_sensor_coverage": false,
    "lumos_sensor_aid": "string",
    "lumos_sensor_config_build": "string",
    "lumos_sensor_coverage": false,
    "name": "string",
    "namespace": "string",
    "node_id": "string",
    "node_name": "string",
    "pod_id": "string",
    "pod_name": "string",
    "port_list": [],
    "privileged": false,
    "root_write_access": false,
    "rpd": [],
    "run_as_root_group": false,
    "run_as_root_user": false,
    "running_status": false,
    "snapshot_coverage": false,
    "unidentified": false,
    "volume_mounts": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadContainerCount

Retrieve container counts

Method GET

Route /container-security/aggregates/containers/count/v1

Scope Falcon Container Image: READ

PEP 8 read_container_counts

Parameters

filter query · string

Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). Supported filter fields:

Available values (48)

agent_id	agent_type	ai_related
allow_privilege_escalation	app_name	cid
cloud_account_id	cloud_instance_id	cloud_name
cloud_region	cloud_service	cluster_id
cluster_name	container_id	container_image_id
container_name	cve_id	detection_name
first_seen	image_detection_count	image_digest
image_has_been_assessed	image_id	image_registry
image_repository	image_tag	image_vulnerability_count
insecure_mount_source	insecure_mount_type	insecure_propagation_mode
interactive_mode	ipv4	ipv6
kac_agent_id	labels	last_seen
namespace	node_name	node_uid
package_name_version	pod_id	pod_name
port	privileged	root_write_access
run_as_root_group	run_as_root_user	running_status

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_container_counts(filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadContainerCount(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadContainerCount",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.ContainerCount(
    &kubernetes_protection.ContainerCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.containerCount("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_container_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_container_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_container_count(filter: 'string')

puts response

Responses

200 OK

{
  "Resources": [
    {
      "count": 0,
      "label": "string"
    }
  ],
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadContainerCountByRegistry

Retrieves a list with the top container image registries.

Method GET

Route /container-security/aggregates/containers/count-by-registry/v1

Scope Falcon Container Image: READ

PEP 8 read_containers_by_registry

Parameters

under_assessment query · boolean

(true/false) whether to return registries under assessment or not under assessment. If not provided all registries are considered

limit query · integer

The upper-bound on the number of records to retrieve.

filter query · string

Retrieve count of Kubernetes container image registries that match a query in Falcon Query Language (FQL). Supported filter fields:

Available values (48)

agent_id	agent_type	ai_related
allow_privilege_escalation	app_name	cid
cloud_account_id	cloud_instance_id	cloud_name
cloud_region	cloud_service	cluster_id
cluster_name	container_id	container_image_id
container_name	cve_id	detection_name
first_seen	image_detection_count	image_digest
image_has_been_assessed	image_id	image_registry
image_repository	image_tag	image_vulnerability_count
insecure_mount_source	insecure_mount_type	insecure_propagation_mode
interactive_mode	ipv4	ipv6
kac_agent_id	labels	last_seen
namespace	node_name	node_uid
package_name_version	pod_id	pod_name
port	privileged	root_write_access
run_as_root_group	run_as_root_user	running_status

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_containers_by_registry(filter="string",
                                              under_assessment=boolean,
                                              limit=integer)
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadContainerCountByRegistry(filter="string",
                                               under_assessment=boolean,
                                               limit=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadContainerCountByRegistry",
                          under_assessment=boolean,
                          limit=integer,
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  underAssessment := boolean
  limit := int64(0)
  filter := "string"

  response, err := client.KubernetesProtection.ContainerCountByRegistry(
    &kubernetes_protection.ContainerCountByRegistryParams{
      UnderAssessment: &underAssessment,
      Limit: &limit,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.containerCountByRegistry(
  boolean,  // underAssessment
  integer,  // limit
  "string"  // filter
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_container_count_by_registry;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_container_count_by_registry(
        &falcon.cfg,  // configuration
        Some(boolean),  // under_assessment
        Some(integer),  // limit
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_container_count_by_registry(under_assessment: boolean,
                                                limit: integer,
                                                filter: 'string')

puts response

Responses

200 OK

{
  "buckets": [
    {
      "count": 0,
      "label": "string"
    }
  ],
  "name": "string"
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadContainerEnrichment

Retrieve container enrichment data

Method GET

Route /container-security/aggregates/enrichment/containers/entities/v1

Scope Falcon Container Image: READ

PEP 8 read_container_enrichment

Parameters

container_id query · string or list of strings

One or more container ids for which to retrieve enrichment info

filter query · string

Supported filter fields:

Available values (7)

cloud_account_id	cloud_name	cloud_region
cluster_id	cluster_name	last_seen
namespace

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.read_container_enrichment(container_id=id_list,
                                            filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ReadContainerEnrichment(container_id=id_list, filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ReadContainerEnrichment",
                          container_id=id_list,
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.ContainerEnrichment(
    &kubernetes_protection.ContainerEnrichmentParams{
      ContainerID: []string{"ID1", "ID2", "ID3"},
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.containerEnrichment(
  ["ID1", "ID2", "ID3"],  // containerId
  "string"  // filter
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_container_enrichment;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_container_enrichment(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // container_id
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_container_enrichment(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

{
  "EnrichmentData": [
    {
      "container_id": "string",
      "enrichment_data": {}
    }
  ],
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadContainerImageDetectionsCountByDate

Retrieve count of image assessment detections on running containers over a period of time

Method GET

Route /container-security/aggregates/containers/image-detections-count-by-date/v1

Scope Falcon Container Image: READ

PEP 8 read_detections_count_by_date

Parameters

filter query · string

Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). Supported filter fields:

Available values (48)

agent_id	agent_type	ai_related
allow_privilege_escalation	app_name	cid
cloud_account_id	cloud_instance_id	cloud_name
cloud_region	cloud_service	cluster_id
cluster_name	container_id	container_image_id
container_name	cve_id	detection_name
first_seen	image_detection_count	image_digest
image_has_been_assessed	image_id	image_registry
image_repository	image_tag	image_vulnerability_count
insecure_mount_source	insecure_mount_type	insecure_propagation_mode
interactive_mode	ipv4	ipv6
kac_agent_id	labels	last_seen
namespace	node_name	node_uid
package_name_version	pod_id	pod_name
port	privileged	root_write_access
run_as_root_group	run_as_root_user	running_status

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_detections_count_by_date(filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadContainerImageDetectionsCountByDate(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadContainerImageDetectionsCountByDate",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.ContainerImageDetectionsCountByDate(
    &kubernetes_protection.ContainerImageDetectionsCountByDateParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.containerImageDetectionsCountByDate("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_container_image_detections_count_by_date;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_container_image_detections_count_by_date(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_container_image_detections_count_by_date(filter: 'string')

puts response

Responses

200 OK

{
  "buckets": [
    {
      "count": 0,
      "label": "string"
    }
  ],
  "name": "string"
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadContainerImagesByMostUsed

Bucket container by image-digest

Method GET

Route /container-security/aggregates/images/most-used/v1

Scope Falcon Container Image: READ

PEP 8 read_images_by_most_used

Parameters

filter query · string

Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). Supported filter fields:

Available values (48)

agent_id	agent_type	ai_related
allow_privilege_escalation	app_name	cid
cloud_account_id	cloud_instance_id	cloud_name
cloud_region	cloud_service	cluster_id
cluster_name	container_id	container_image_id
container_name	cve_id	detection_name
first_seen	image_detection_count	image_digest
image_has_been_assessed	image_id	image_registry
image_repository	image_tag	image_vulnerability_count
insecure_mount_source	insecure_mount_type	insecure_propagation_mode
interactive_mode	ipv4	ipv6
kac_agent_id	labels	last_seen
namespace	node_name	node_uid
package_name_version	pod_id	pod_name
port	privileged	root_write_access
run_as_root_group	run_as_root_user	running_status

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_images_by_most_used(filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadContainerImagesByMostUsed(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadContainerImagesByMostUsed",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.ContainerImagesByMostUsed(
    &kubernetes_protection.ContainerImagesByMostUsedParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.containerImagesByMostUsed("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_container_images_by_most_used;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_container_images_by_most_used(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_container_images_by_most_used(filter: 'string')

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "name": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadContainerImagesByState

Retrieve count of image states running on containers

Method GET

Route /container-security/aggregates/containers/images-by-state/v1

Scope Falcon Container Image: READ

PEP 8 read_images_by_state

Parameters

filter query · string

Filter using a query in Falcon Query Language (FQL). Supported filters: cid

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_images_by_state(filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadContainerImagesByState(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadContainerImagesByState",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.ContainerImagesByState(
    &kubernetes_protection.ContainerImagesByStateParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.containerImagesByState("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_container_images_by_state;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_container_images_by_state(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_container_images_by_state(filter: 'string')

puts response

Responses

200 OK

{
  "buckets": [
    {
      "count": 0,
      "label": "string"
    }
  ],
  "name": "string"
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadContainersByDateRangeCount

Retrieve containers by date range counts

Method GET

Route /container-security/aggregates/containers/count-by-date/v1

Scope Falcon Container Image: READ

PEP 8 read_containers_by_date_range

Parameters

filter query · string

Get container counts using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (48)

agent_id	agent_type	ai_related
allow_privilege_escalation	app_name	cid
cloud_account_id	cloud_instance_id	cloud_name
cloud_region	cloud_service	cluster_id
cluster_name	container_id	container_image_id
container_name	cve_id	detection_name
first_seen	image_detection_count	image_digest
image_has_been_assessed	image_id	image_registry
image_repository	image_tag	image_vulnerability_count
insecure_mount_source	insecure_mount_type	insecure_propagation_mode
interactive_mode	ipv4	ipv6
kac_agent_id	labels	last_seen
namespace	node_name	node_uid
package_name_version	pod_id	pod_name
port	privileged	root_write_access
run_as_root_group	run_as_root_user	running_status

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_containers_by_date_range(filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadContainersByDateRangeCount(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadContainersByDateRangeCount",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.ContainersByDateRangeCount(
    &kubernetes_protection.ContainersByDateRangeCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.containersByDateRangeCount("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_containers_by_date_range_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_containers_by_date_range_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_containers_by_date_range_count(filter: 'string')

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "name": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadContainersSensorCoverage

Bucket containers by agent type and calculate sensor coverage

Method GET

Route /container-security/aggregates/containers/sensor-coverage/v1

Scope Falcon Container Image: READ

PEP 8 read_sensor_coverage

Parameters

filter query · string

Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). Supported filter fields:

Available values (48)

agent_id	agent_type	ai_related
allow_privilege_escalation	app_name	cid
cloud_account_id	cloud_instance_id	cloud_name
cloud_region	cloud_service	cluster_id
cluster_name	container_id	container_image_id
container_name	cve_id	detection_name
first_seen	image_detection_count	image_digest
image_has_been_assessed	image_id	image_registry
image_repository	image_tag	image_vulnerability_count
insecure_mount_source	insecure_mount_type	insecure_propagation_mode
interactive_mode	ipv4	ipv6
kac_agent_id	labels	last_seen
namespace	node_name	node_uid
package_name_version	pod_id	pod_name
port	privileged	root_write_access
run_as_root_group	run_as_root_user	running_status

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_sensor_coverage(filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadContainersSensorCoverage(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadContainersSensorCoverage",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.ContainersSensorCoverage(
    &kubernetes_protection.ContainersSensorCoverageParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.containersSensorCoverage("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_containers_sensor_coverage;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_containers_sensor_coverage(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_containers_sensor_coverage(filter: 'string')

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "name": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadContainerVulnerabilitiesBySeverityCount

Retrieve container vulnerabilities by severity counts

Method GET

Route /container-security/aggregates/containers/vulnerability-count-by-severity/v1

Scope Falcon Container Image: READ

PEP 8 read_vulnerability_counts_by_severity

Parameters

filter query · string

Get vulnerabilities count by severity for container using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (48)

agent_id	agent_type	ai_related
allow_privilege_escalation	app_name	cid
cloud_account_id	cloud_instance_id	cloud_name
cloud_region	cloud_service	cluster_id
cluster_name	container_id	container_image_id
container_name	cve_id	detection_name
first_seen	image_detection_count	image_digest
image_has_been_assessed	image_id	image_registry
image_repository	image_tag	image_vulnerability_count
insecure_mount_source	insecure_mount_type	insecure_propagation_mode
interactive_mode	ipv4	ipv6
kac_agent_id	labels	last_seen
namespace	node_name	node_uid
package_name_version	pod_id	pod_name
port	privileged	root_write_access
run_as_root_group	run_as_root_user	running_status

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_vulnerability_counts_by_severity(filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadContainerVulnerabilitiesBySeverityCount(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadContainerVulnerabilitiesBySeverityCount",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.ContainerVulnerabilitiesBySeverityCount(
    &kubernetes_protection.ContainerVulnerabilitiesBySeverityCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.containerVulnerabilitiesBySeverityCount("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_container_vulnerabilities_by_severity_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_container_vulnerabilities_by_severity_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_container_vulnerabilities_by_severity_count(filter: 'string')

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "name": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadDeploymentCombined

Retrieve kubernetes deployments identified by the provided filter criteria

Method GET

Route /container-security/combined/deployments/v1

Scope Falcon Container Image: READ

PEP 8 read_deployments_combined

Parameters

filter query · string

Search Kubernetes deployments using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (19)

agent_id	agent_type	annotations_list
cid	cloud_account_id	cloud_name
cloud_region	cloud_service	cluster_id
cluster_name	deployment_id	deployment_name
deployment_status	first_seen	kac_agent_id
last_seen	namespace	pod_count
resource_status

sort query · string

Field to sort results by

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 200.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_deployments_combined(filter="string",
                                            limit=integer,
                                            offset=integer,
                                            sort="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadDeploymentCombined(filter="string",
                                         limit=integer,
                                         offset=integer,
                                         sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadDeploymentCombined",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconContainerDeployment -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.DeploymentCombined(
    &kubernetes_protection.DeploymentCombinedParams{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.deploymentCombined(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_deployment_combined;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_deployment_combined(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_deployment_combined(filter: 'string',
                                        sort: 'string',
                                        limit: integer,
                                        offset: integer)

puts response

Responses

200 OK

[
  {
    "account_id": "string",
    "asset_identifier": "string",
    "cloud_provider": "string",
    "id": "string",
    "instance_type": "string",
    "last_updated_timestamp": "string",
    "region": "string",
    "status": "string",
    "status_detail": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadDeploymentCount

Retrieve deployment counts

Method GET

Route /container-security/aggregates/deployments/count/v1

Scope Falcon Container Image: READ

PEP 8 read_deployment_count

Parameters

filter query · string

Retrieve count of Kubernetes deployments that match a query in Falcon Query Language (FQL). Supported filter fields:

Available values (19)

agent_id	agent_type	annotations_list
cid	cloud_account_id	cloud_name
cloud_region	cloud_service	cluster_id
cluster_name	deployment_id	deployment_name
deployment_status	first_seen	kac_agent_id
last_seen	namespace	pod_count
resource_status

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_deployment_count(filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadDeploymentCount(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadDeploymentCount",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.DeploymentCount(
    &kubernetes_protection.DeploymentCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.deploymentCount("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_deployment_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_deployment_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_deployment_count(filter: 'string')

puts response

Responses

200 OK

{
  "Resources": [
    {
      "count": 0,
      "label": "string"
    }
  ],
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadDeploymentEnrichment

Retrieve deployment enrichment data

Method GET

Route /container-security/aggregates/enrichment/deployments/entities/v1

Scope Falcon Container Image: READ

PEP 8 read_deployment_enrichment

Parameters

deployment_id query · string or list of strings

One or more deployment ids for which to retrieve enrichment info

filter query · string

Supported filter fields:

Available values (7)

cloud_account_id	cloud_name	cloud_region
cluster_id	cluster_name	last_seen
namespace

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.read_deployment_enrichment(deployment_id=id_list,
                                             filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ReadDeploymentEnrichment(deployment_id=id_list,
                                           filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ReadDeploymentEnrichment",
                          deployment_id=id_list,
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.DeploymentEnrichment(
    &kubernetes_protection.DeploymentEnrichmentParams{
      DeploymentID: []string{"ID1", "ID2", "ID3"},
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.deploymentEnrichment(
  ["ID1", "ID2", "ID3"],  // deploymentId
  "string"  // filter
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_deployment_enrichment;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_deployment_enrichment(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // deployment_id
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_deployment_enrichment(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

{
  "EnrichmentData": [
    {
      "deployment_id": "string",
      "enrichment_data": {}
    }
  ],
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadDeploymentsByDateRangeCount

Retrieve deployments by date range counts

Method GET

Route /container-security/aggregates/deployments/count-by-date/v1

Scope Falcon Container Image: READ

PEP 8 read_deployment_counts_by_date_range

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_deployment_counts_by_date_range()
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadDeploymentsByDateRangeCount()
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadDeploymentsByDateRangeCount")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesProtection.DeploymentsByDateRangeCount(
    &kubernetes_protection.DeploymentsByDateRangeCountParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.deploymentsByDateRangeCount();

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_deployments_by_date_range_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_deployments_by_date_range_count(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_deployments_by_date_range_count

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "name": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadDistinctContainerImageCount

Retrieve count of distinct images running on containers

Method GET

Route /container-security/aggregates/images/count-by-distinct/v1

Scope Falcon Container Image: READ

PEP 8 read_distinct_image_count

Parameters

filter query · string

Search Kubernetes containers using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (48)

agent_id	agent_type	ai_related
allow_privilege_escalation	app_name	cid
cloud_account_id	cloud_instance_id	cloud_name
cloud_region	cloud_service	cluster_id
cluster_name	container_id	container_image_id
container_name	cve_id	detection_name
first_seen	image_detection_count	image_digest
image_has_been_assessed	image_id	image_registry
image_repository	image_tag	image_vulnerability_count
insecure_mount_source	insecure_mount_type	insecure_propagation_mode
interactive_mode	ipv4	ipv6
kac_agent_id	labels	last_seen
namespace	node_name	node_uid
package_name_version	pod_id	pod_name
port	privileged	root_write_access
run_as_root_group	run_as_root_user	running_status

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_distinct_image_count(filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadDistinctContainerImageCount(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadDistinctContainerImageCount",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.DistinctContainerImageCount(
    &kubernetes_protection.DistinctContainerImageCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.distinctContainerImageCount("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_distinct_container_image_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_distinct_container_image_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_distinct_container_image_count(filter: 'string')

puts response

Responses

200 OK

{
  "buckets": [
    {
      "count": 0,
      "label": "string"
    }
  ],
  "name": "string"
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadKubernetesIomByDateRange

Returns the count of Kubernetes IOMs by the date. by default it’s for 7 days.

Method GET

Route /container-security/aggregates/kubernetes-ioms/count-by-date/v1

Scope Falcon Container Image: READ

PEP 8 read_iom_count_by_date_range

Parameters

filter query · string

Filter Kubernetes IOMs using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (5)

cid	created_timestamp	detect_timestamp
prevented	severity

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_iom_count_by_date_range(filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadKubernetesIomByDateRange(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadKubernetesIomByDateRange",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.KubernetesIomByDateRange(
    &kubernetes_protection.KubernetesIomByDateRangeParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.kubernetesIomByDateRange("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_kubernetes_iom_by_date_range;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_kubernetes_iom_by_date_range(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_kubernetes_iom_by_date_range(filter: 'string')

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "name": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadKubernetesIomCount

Returns the total count of Kubernetes IOMs over the past seven days

Method GET

Route /container-security/aggregates/kubernetes-ioms/count/v1

Scope Falcon Container Image: READ

PEP 8 read_iom_count

Parameters

filter query · string

Filter Kubernetes IOMs using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (5)

cid	created_timestamp	detect_timestamp
prevented	severity

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_iom_count(filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadKubernetesIomCount(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadKubernetesIomCount",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.KubernetesIomCount(
    &kubernetes_protection.KubernetesIomCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.kubernetesIomCount("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_kubernetes_iom_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_kubernetes_iom_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_kubernetes_iom_count(filter: 'string')

puts response

Responses

200 OK

[
  {
    "count": 0,
    "label": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadKubernetesIomEntities

Retrieve Kubernetes IOM entities identified by the provided IDs

Method GET

Route /container-security/entities/kubernetes-ioms/v1

Scope Falcon Container Image: READ

PEP 8 read_iom_entities

Parameters

ids query · string or list of strings

Search Kubernetes IOMs by ids - The maximum amount is 100 IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.read_iom_entities(ids=id_list)
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ReadKubernetesIomEntities(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ReadKubernetesIomEntities",
                          ids=id_list)
print(response)

PowerShell

Get-FalconContainerIom -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesProtection.KubernetesIomEntities(
    &kubernetes_protection.KubernetesIomEntitiesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.kubernetesIomEntities(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_kubernetes_iom_entities;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_kubernetes_iom_entities(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_kubernetes_iom_entities(ids: ['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "admission_review_action": "string",
    "admission_review_id": "string",
    "admission_review_msg": "string",
    "admission_review_operation": "string",
    "cid": "string",
    "cis_id": [],
    "cloud_service": "string",
    "cluster_id": "string",
    "cluster_name": "string",
    "containers_impacted_ai_related": false,
    "containers_impacted_count": "string",
    "containers_impacted_ids": [],
    "custom_rego_uuid": "string",
    "description": "string",
    "detect_timestamp": "string",
    "detection_id": "string",
    "detection_name": "string",
    "detection_type": "string",
    "image_assessment_matched_cves": [],
    "image_assessment_policy_description": "string",
    "image_assessment_policy_id": "string",
    "image_assessment_policy_name": "string",
    "image_digest": "string",
    "image_has_been_assessed": false,
    "image_id": "string",
    "image_registry": "string",
    "image_repository": "string",
    "image_tag": "string",
    "last_seen_timestamp": "string",
    "mitigation_id": "string",
    "mitigation_name": "string",
    "namespace": "string",
    "nist_id": "string",
    "pod_label": "string",
    "pods_impacted_count": "string",
    "policy_id": "string",
    "policy_name": "string",
    "ports": [],
    "prevented": "string",
    "remediation": "string",
    "resource_creation_timestamp": "string",
    "resource_group_name": "string",
    "resource_id": "string",
    "resource_name": "string",
    "resource_type": "string",
    "sensitive_env_vars": [],
    "service_type": "string",
    "severity": "string",
    "tactic_id": "string",
    "tactic_name": "string",
    "technique_id": "string",
    "technique_name": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadNamespaceCount

Retrieve namespace counts

Method GET

Route /container-security/aggregates/namespaces/count/v1

Scope Falcon Container Image: READ

PEP 8 read_namespace_count

Parameters

filter query · string

Retrieve count of Kubernetes namespaces that match a query in Falcon Query Language (FQL). Supported filter fields:

Available values (16)

agent_id	agent_type	annotations_list
cid	cloud_account_id	cloud_name
cloud_region	cloud_service	cluster_id
cluster_name	first_seen	kac_agent_id
last_seen	namespace_id	namespace_name
resource_status

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_namespace_count(filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadNamespaceCount(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadNamespaceCount",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.ReadNamespaceCount(
    &kubernetes_protection.ReadNamespaceCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.readNamespaceCount("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_namespace_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_namespace_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_namespace_count(filter: 'string')

puts response

Responses

200 OK

{
  "Resources": [
    {
      "count": 0,
      "label": "string"
    }
  ],
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadNamespacesByDateRangeCount

Retrieve namespaces by date range counts

Method GET

Route /container-security/aggregates/namespaces/count-by-date/v1

Scope Falcon Container Image: READ

PEP 8 read_namespaces_by_date_range_count

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_namespaces_by_date_range_count()
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadNamespacesByDateRangeCount()
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadNamespacesByDateRangeCount")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesProtection.ReadNamespacesByDateRangeCount(
    &kubernetes_protection.ReadNamespacesByDateRangeCountParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.readNamespacesByDateRangeCount();

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_namespaces_by_date_range_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_namespaces_by_date_range_count(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_namespaces_by_date_range_count

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "name": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadNodeCombined

Retrieve kubernetes nodes identified by the provided filter criteria

Method GET

Route /container-security/combined/nodes/v1

Scope Falcon Container Image: READ

PEP 8 read_nodes_combined

Parameters

filter query · string

Search Kubernetes nodes using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (22)

agent_id	agent_type	annotations_list
cid	cloud_account_id	cloud_name
cloud_region	cloud_service	cluster_id
cluster_name	container_count	container_runtime_version
first_seen	image_digest	ipv4
kac_agent_id	last_seen	linux_sensor_coverage
node_name	node_uid	pod_count
resource_status

sort query · string

Field to sort results by

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 200.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_nodes_combined(filter="string",
                                      limit=integer,
                                      offset=integer,
                                      sort="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadNodeCombined(filter="string",
                                   limit=integer,
                                   offset=integer,
                                   sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadNodeCombined",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconContainerNode -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.NodeCombined(
    &kubernetes_protection.NodeCombinedParams{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.nodeCombined(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_node_combined;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_node_combined(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_node_combined(filter: 'string',
                                  sort: 'string',
                                  limit: integer,
                                  offset: integer)

puts response

Responses

200 OK

[
  {
    "agents": [],
    "annotations_list": [],
    "architecture": "string",
    "base_image": "string",
    "cid": "string",
    "cloud_account_id": "string",
    "cloud_instance_id": "string",
    "cloud_instance_type": "string",
    "cloud_name": "string",
    "cloud_region": "string",
    "cloud_service": "string",
    "cluster_id": "string",
    "cluster_name": "string",
    "container_count": 0,
    "container_runtime_version": "string",
    "cpu": "string",
    "created_at": "string",
    "deleted_at": "string",
    "external_ip": "string",
    "first_seen": "string",
    "ipv4": "string",
    "ipv6": "string",
    "kac_agent_id": "string",
    "kernel_version": "string",
    "kubernetes_version": "string",
    "labels": {},
    "labels_list": [],
    "last_seen": "string",
    "linux_sensor_coverage": false,
    "memory": "string",
    "node_id": "string",
    "node_name": "string",
    "os": "string",
    "pod_cidr": "string",
    "pod_count": 0,
    "provider_id": "string",
    "resource_status": "string",
    "storage": "string",
    "uid": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadNodeCount

Retrieve node counts

Method GET

Route /container-security/aggregates/nodes/count/v1

Scope Falcon Container Image: READ

PEP 8 read_node_count

Parameters

filter query · string

Retrieve count of Kubernetes nodes that match a query in Falcon Query Language (FQL). Supported filter fields:

Available values (22)

agent_id	agent_type	annotations_list
cid	cloud_account_id	cloud_name
cloud_region	cloud_service	cluster_id
cluster_name	container_count	container_runtime_version
first_seen	image_digest	ipv4
kac_agent_id	last_seen	linux_sensor_coverage
node_name	node_uid	pod_count
resource_status

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_node_count(filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadNodeCount(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadNodeCount",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.NodeCount(
    &kubernetes_protection.NodeCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.nodeCount("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_node_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_node_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_node_count(filter: 'string')

puts response

Responses

200 OK

{
  "Resources": [
    {
      "count": 0,
      "label": "string"
    }
  ],
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadNodeEnrichment

Retrieve node enrichment data

Method GET

Route /container-security/aggregates/enrichment/nodes/entities/v1

Scope Falcon Container Image: READ

PEP 8 read_node_enrichment

Parameters

node_name query · string or list of strings

One or more node names for which to retrieve enrichment info

filter query · string

Supported filter fields:

Available values (7)

cloud_account_id	cloud_name	cloud_region
cluster_id	cluster_name	last_seen
namespace

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.read_node_enrichment(node_name=id_list, filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ReadNodeEnrichment(node_name=id_list, filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ReadNodeEnrichment",
                          node_name=id_list,
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.NodeEnrichment(
    &kubernetes_protection.NodeEnrichmentParams{
      NodeName: []string{"ID1", "ID2", "ID3"},
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.nodeEnrichment(
  ["ID1", "ID2", "ID3"],  // nodeName
  "string"  // filter
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_node_enrichment;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_node_enrichment(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // node_name
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_node_enrichment(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

{
  "EnrichmentData": [
    {
      "enrichment_data": {},
      "node_name": "string"
    }
  ],
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadNodesByCloudCount

Bucket nodes by cloud providers

Method GET

Route /container-security/aggregates/nodes/count-by-cloud/v1

Scope Falcon Container Image: READ

PEP 8 read_node_counts_by_cloud

Parameters

filter query · string

Search Kubernetes nodes using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (22)

agent_id	agent_type	annotations_list
cid	cloud_account_id	cloud_name
cloud_region	cloud_service	cluster_id
cluster_name	container_count	container_runtime_version
first_seen	image_digest	ipv4
kac_agent_id	last_seen	linux_sensor_coverage
node_name	node_uid	pod_count
resource_status

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_node_counts_by_cloud(filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadNodesByCloudCount(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadNodesByCloudCount",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.NodesByCloudCount(
    &kubernetes_protection.NodesByCloudCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.nodesByCloudCount("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_nodes_by_cloud_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_nodes_by_cloud_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_nodes_by_cloud_count(filter: 'string')

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "name": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadNodesByContainerEngineVersionCount

Bucket nodes by their container engine version

Method GET

Route /container-security/aggregates/nodes/count-by-container-engine-version/v1

Scope Falcon Container Image: READ

PEP 8 read_nodes_by_container_engine_version

Parameters

filter query · string

Search Kubernetes nodes using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (22)

agent_id	agent_type	annotations_list
cid	cloud_account_id	cloud_name
cloud_region	cloud_service	cluster_id
cluster_name	container_count	container_runtime_version
first_seen	image_digest	ipv4
kac_agent_id	last_seen	linux_sensor_coverage
node_name	node_uid	pod_count
resource_status

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_nodes_by_container_engine_version(filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadNodesByContainerEngineVersionCount(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadNodesByContainerEngineVersionCount",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.NodesByContainerEngineVersionCount(
    &kubernetes_protection.NodesByContainerEngineVersionCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.nodesByContainerEngineVersionCount("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_nodes_by_container_engine_version_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_nodes_by_container_engine_version_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_nodes_by_container_engine_version_count(filter: 'string')

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "name": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadNodesByDateRangeCount

Retrieve nodes by date range counts

Method GET

Route /container-security/aggregates/nodes/count-by-date/v1

Scope Falcon Container Image: READ

PEP 8 read_node_counts_by_date_range

Parameters

filter query · string

Search Kubernetes nodes using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (22)

agent_id	agent_type	annotations_list
cid	cloud_account_id	cloud_name
cloud_region	cloud_service	cluster_id
cluster_name	container_count	container_runtime_version
first_seen	image_digest	ipv4
kac_agent_id	last_seen	linux_sensor_coverage
node_name	node_uid	pod_count
resource_status

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_node_counts_by_date_range(filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadNodesByDateRangeCount(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadNodesByDateRangeCount",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.NodesByDateRangeCount(
    &kubernetes_protection.NodesByDateRangeCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.nodesByDateRangeCount("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_nodes_by_date_range_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_nodes_by_date_range_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_nodes_by_date_range_count(filter: 'string')

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "name": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadPodCombined

Retrieve kubernetes pods identified by the provided filter criteria

Method GET

Route /container-security/combined/pods/v1

Scope Falcon Container Image: READ

PEP 8 read_pods_combined

Parameters

filter query · string

Search Kubernetes pods using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (33)

agent_id	agent_type	allow_privilege_escalation
annotations_list	app_name	cid
cloud_account_id	cloud_name	cloud_region
cloud_service	cluster_id	cluster_name
container_count	first_seen	ipv4
ipv6	kac_agent_id	labels
last_seen	namespace	node_name
node_uid	owner_id	owner_type
pod_external_id	pod_id	pod_name
port	privileged	resource_status
root_write_access	run_as_root_group	run_as_root_user

sort query · string

Field to sort results by

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 200.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_pods_combined(filter="string",
                                     limit=integer,
                                     offset=integer,
                                     sort="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadPodCombined(filter="string",
                                  limit=integer,
                                  offset=integer,
                                  sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadPodCombined",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconContainerPod -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.PodCombined(
    &kubernetes_protection.PodCombinedParams{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.podCombined(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_pod_combined;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_pod_combined(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_pod_combined(filter: 'string',
                                 sort: 'string',
                                 limit: integer,
                                 offset: integer)

puts response

Responses

200 OK

[
  {
    "agents": [],
    "allow_privilege_escalation": false,
    "annotations_list": [],
    "app_name": "string",
    "automount_service_token": false,
    "cid": "string",
    "cloud_account_id": "string",
    "cloud_name": "string",
    "cloud_region": "string",
    "cloud_service": "string",
    "cluster_id": "string",
    "cluster_name": "string",
    "container_count": 0,
    "containers": [],
    "created_at": "string",
    "deleted_at": "string",
    "first_seen": "string",
    "host_ipc": false,
    "host_network": false,
    "host_pid": false,
    "image_pull_secrets": [],
    "ipv4": "string",
    "ipv6": "string",
    "kac_agent_id": "string",
    "labels": {},
    "labels_list": [],
    "last_seen": "string",
    "namespace": "string",
    "node_ipv4": "string",
    "node_name": "string",
    "node_selector": "string",
    "node_uid": "string",
    "owner_id": "string",
    "owner_type": "string",
    "pod_external_id": "string",
    "pod_id": "string",
    "pod_name": "string",
    "ports": [],
    "privileged": false,
    "resource_status": "string",
    "root_write_access": false,
    "run_as_root_group": false,
    "run_as_root_user": false,
    "scheduler_name": "string",
    "service_account_name": "string",
    "share_process_namespace": false,
    "volume_mounts": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadPodCount

Retrieve pod counts

Method GET

Route /container-security/aggregates/pods/count/v1

Scope Falcon Container Image: READ

PEP 8 read_pod_counts

Parameters

filter query · string

Retrieve count of Kubernetes pods that match a query in Falcon Query Language (FQL). Supported filter fields:

Available values (33)

agent_id	agent_type	allow_privilege_escalation
annotations_list	app_name	cid
cloud_account_id	cloud_name	cloud_region
cloud_service	cluster_id	cluster_name
container_count	first_seen	ipv4
ipv6	kac_agent_id	labels
last_seen	namespace	node_name
node_uid	owner_id	owner_type
pod_external_id	pod_id	pod_name
port	privileged	resource_status
root_write_access	run_as_root_group	run_as_root_user

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_pod_counts(filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadPodCount(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadPodCount",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.PodCount(
    &kubernetes_protection.PodCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.podCount("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_pod_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_pod_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_pod_count(filter: 'string')

puts response

Responses

200 OK

{
  "Resources": [
    {
      "count": 0,
      "label": "string"
    }
  ],
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadPodEnrichment

Retrieve pod enrichment data

Method GET

Route /container-security/aggregates/enrichment/pods/entities/v1

Scope Falcon Container Image: READ

PEP 8 read_pod_enrichment

Parameters

pod_id query · string or list of strings

One or more pod ids for which to retrieve enrichment info

filter query · string

Supported filter fields:

Available values (7)

cloud_account_id	cloud_name	cloud_region
cluster_id	cluster_name	last_seen
namespace

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.read_pod_enrichment(pod_id=id_list, filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ReadPodEnrichment(pod_id=id_list, filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ReadPodEnrichment",
                          pod_id=id_list,
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.PodEnrichment(
    &kubernetes_protection.PodEnrichmentParams{
      PodID: []string{"ID1", "ID2", "ID3"},
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.podEnrichment(
  ["ID1", "ID2", "ID3"],  // podId
  "string"  // filter
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_pod_enrichment;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_pod_enrichment(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // pod_id
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_pod_enrichment(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

{
  "EnrichmentData": [
    {
      "enrichment_data": {},
      "pod_id": "string"
    }
  ],
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadPodsByDateRangeCount

Retrieve pods by date range counts

Method GET

Route /container-security/aggregates/pods/count-by-date/v1

Scope Falcon Container Image: READ

PEP 8 read_pod_counts_by_date_range

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_pod_counts_by_date_range()
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadPodsByDateRangeCount()
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadPodsByDateRangeCount")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesProtection.PodsByDateRangeCount(
    &kubernetes_protection.PodsByDateRangeCountParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.podsByDateRangeCount();

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_pods_by_date_range_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_pods_by_date_range_count(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_pods_by_date_range_count

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "name": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadRunningContainerImages

Retrieve images on running containers

Method GET

Route /container-security/combined/container-images/v1

Scope Falcon Container Image: READ

PEP 8 read_running_images

Parameters

filter query · string

Retrieve list of images on running containers using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (17)

cid	cloud_account_id	cloud_name
cloud_region	cluster_id	cluster_name
hosts	image_digest	image_has_been_assessed
image_id	image_name	image_registry
image_repository	image_tag	last_seen
namespace	running_status

sort query · string

Field to sort results by

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 200.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_running_images(filter="string",
                                      limit=integer,
                                      offset=integer,
                                      sort="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadRunningContainerImages(filter="string",
                                             limit=integer,
                                             offset=integer,
                                             sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadRunningContainerImages",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconContainerImage -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.RunningContainerImages(
    &kubernetes_protection.RunningContainerImagesParams{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.runningContainerImages(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_running_container_images;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_running_container_images(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_running_container_images(filter: 'string',
                                             sort: 'string',
                                             limit: integer,
                                             offset: integer)

puts response

Responses

200 OK

{
  "cid": "string",
  "cluster_info": [
    {
      "cloud": "string",
      "cloud_account_id": "string",
      "cloud_region": "string",
      "cloud_service": "string",
      "cluster_id": "string",
      "cluster_name": "string",
      "k8s_distro": "string"
    }
  ],
  "container_count": 0,
  "containers_running_status": {},
  "hosts": [
    "string"
  ],
  "id": "string",
  "image_detection_count": 0,
  "image_digest": "string",
  "image_has_been_assessed": false,
  "image_id": "string",
  "image_name": "string",
  "image_registry": "string",
  "image_repository": "string",
  "image_tag": "string",
  "image_vulnerability_count": 0,
  "last_seen": "string",
  "running_container_count": 0
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadVulnerableContainerImageCount

Retrieve count of vulnerable images running on containers

Method GET

Route /container-security/aggregates/containers/count-vulnerable-images/v1

Scope Falcon Container Image: READ

PEP 8 read_vulnerable_container_count

Parameters

filter query · string

Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). Supported filter fields:

Available values (48)

agent_id	agent_type	ai_related
allow_privilege_escalation	app_name	cid
cloud_account_id	cloud_instance_id	cloud_name
cloud_region	cloud_service	cluster_id
cluster_name	container_id	container_image_id
container_name	cve_id	detection_name
first_seen	image_detection_count	image_digest
image_has_been_assessed	image_id	image_registry
image_repository	image_tag	image_vulnerability_count
insecure_mount_source	insecure_mount_type	insecure_propagation_mode
interactive_mode	ipv4	ipv6
kac_agent_id	labels	last_seen
namespace	node_name	node_uid
package_name_version	pod_id	pod_name
port	privileged	root_write_access
run_as_root_group	run_as_root_user	running_status

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_vulnerable_container_count(filter="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadVulnerableContainerImageCount(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadVulnerableContainerImageCount",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.VulnerableContainerImageCount(
    &kubernetes_protection.VulnerableContainerImageCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.vulnerableContainerImageCount("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::read_vulnerable_container_image_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_vulnerable_container_image_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_vulnerable_container_image_count(filter: 'string')

puts response

Responses

200 OK

{
  "buckets": [
    {
      "count": 0,
      "label": "string"
    }
  ],
  "name": "string"
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

RegenerateAPIKey

Regenerate API key for docker registry integrations

Method POST

Route /kubernetes-protection/entities/integration/api-key/v1

Scope Kubernetes Protection: WRITE

PEP 8 regenerate

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.regenerate()
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.RegenerateAPIKey()
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RegenerateAPIKey")
print(response)

PowerShell

New-FalconContainerKey

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesProtection.RegenerateAPIKey(
    &kubernetes_protection.RegenerateAPIKeyParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.regenerateAPIKey();

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::regenerate_api_key;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = regenerate_api_key(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.regenerate_api_key

puts response

Responses

200 OK

[
  {
    "api_key": "string"
  }
]

207 Multi-Status

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "api_key": "string"
    }
  ]
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "api_key": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "api_key": "string"
    }
  ]
}

---

---

SearchAndReadKubernetesIomEntities

Retrieves a list of Kubernetes IOMs identified by the provided search criteria.

Method GET

Route /container-security/combined/kubernetes-ioms/v1

Scope Falcon Container Image: READ

PEP 8 search_and_read_ioms

Parameters

filter query · string

Search Kubernetes IOMs using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (16)

cid	cis_id	cloud_service
cluster_id	cluster_name	containers_impacted_ai_related
containers_impacted_count	containers_impacted_ids	detection_type
name	namespace	prevented
resource_id	resource_name	resource_type
severity

sort query · string

The fields to sort the records on.

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 100.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.search_and_read_ioms(filter="string",
                                       limit=integer,
                                       offset=integer,
                                       sort="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.SearchAndReadKubernetesIomEntities(filter="string",
                                                     limit=integer,
                                                     offset=integer,
                                                     sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("SearchAndReadKubernetesIomEntities",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconContainerIom -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.KubernetesIomEntitiesCombined(
    &kubernetes_protection.KubernetesIomEntitiesCombinedParams{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.kubernetesIomEntitiesCombined(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::search_and_read_kubernetes_iom_entities;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = search_and_read_kubernetes_iom_entities(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.search_and_read_kubernetes_iom_entities(filter: 'string',
                                                       sort: 'string',
                                                       limit: integer,
                                                       offset: integer)

puts response

Responses

200 OK

[
  {
    "admission_review_action": "string",
    "admission_review_id": "string",
    "admission_review_msg": "string",
    "admission_review_operation": "string",
    "cid": "string",
    "cis_id": [],
    "cloud_service": "string",
    "cluster_id": "string",
    "cluster_name": "string",
    "containers_impacted_ai_related": false,
    "containers_impacted_count": "string",
    "containers_impacted_ids": [],
    "custom_rego_uuid": "string",
    "description": "string",
    "detect_timestamp": "string",
    "detection_id": "string",
    "detection_name": "string",
    "detection_type": "string",
    "image_assessment_matched_cves": [],
    "image_assessment_policy_description": "string",
    "image_assessment_policy_id": "string",
    "image_assessment_policy_name": "string",
    "image_digest": "string",
    "image_has_been_assessed": false,
    "image_id": "string",
    "image_registry": "string",
    "image_repository": "string",
    "image_tag": "string",
    "last_seen_timestamp": "string",
    "mitigation_id": "string",
    "mitigation_name": "string",
    "namespace": "string",
    "nist_id": "string",
    "pod_label": "string",
    "pods_impacted_count": "string",
    "policy_id": "string",
    "policy_name": "string",
    "ports": [],
    "prevented": "string",
    "remediation": "string",
    "resource_creation_timestamp": "string",
    "resource_group_name": "string",
    "resource_id": "string",
    "resource_name": "string",
    "resource_type": "string",
    "sensitive_env_vars": [],
    "service_type": "string",
    "severity": "string",
    "tactic_id": "string",
    "tactic_name": "string",
    "technique_id": "string",
    "technique_name": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

SearchKubernetesIoms

Search Kubernetes IOMs by the provided search criteria. this endpoint returns a list of Kubernetes IOM UUIDs matching the query

Method GET

Route /container-security/queries/kubernetes-ioms/v1

Scope Falcon Container Image: READ

PEP 8 search_ioms

Parameters

filter query · string

Search Kubernetes IOMs using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (16)

cid	cis_id	cloud_service
cluster_id	cluster_name	containers_impacted_ai_related
containers_impacted_count	containers_impacted_ids	detection_type
name	namespace	prevented
resource_id	resource_name	resource_type
severity

sort query · string

The fields to sort the records on.

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 100.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.search_ioms(filter="string",
                              limit=integer,
                              offset=integer,
                              sort="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.SearchKubernetesIoms(filter="string",
                                       limit=integer,
                                       offset=integer,
                                       sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("SearchKubernetesIoms",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconContainerIom -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.QueryKubernetesIoms(
    &kubernetes_protection.QueryKubernetesIomsParams{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.queryKubernetesIoms(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::search_kubernetes_ioms;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = search_kubernetes_ioms(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.search_kubernetes_ioms(filter: 'string',
                                      sort: 'string',
                                      limit: integer,
                                      offset: integer)

puts response

Responses

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

TriggerScan

Triggers a dry run or a full scan of a customer’s kubernetes footprint

Method POST

Route /kubernetes-protection/entities/scan/trigger/v1

Scope Kubernetes Protection: WRITE

PEP 8 trigger_scan

Parameters

scan_type query · string

Scan Type to do

Available values (3)

cluster-refresh

dry-run

full

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.trigger_scan(scan_type="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.TriggerScan(scan_type="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("TriggerScan",
                          scan_type="string")
print(response)

PowerShell

Invoke-FalconContainerScan -ScanType "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesProtection.TriggerScan(
    &kubernetes_protection.TriggerScanParams{
      ScanType: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.triggerScan("string");  // scanType

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::trigger_scan;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = trigger_scan(
        &falcon.cfg,  // configuration
        "string",  // scan_type
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.trigger_scan('string')

puts response

Responses

201 Created

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

207 Multi-Status

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

UpdateAWSAccount

Updates the AWS account per the query parameters provided

Method PATCH

Route /kubernetes-protection/entities/accounts/aws/v1

Scope Kubernetes Protection: WRITE

PEP 8 update_aws_account

Parameters

ids query · string or list of strings

AWS Account ID

region query · string

Default Region for Account Automation

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_aws_account(ids=id_list, region="string")
print(response)

Operation ID

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.UpdateAWSAccount(ids=id_list, region="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("UpdateAWSAccount",
                          ids=id_list,
                          region="string")
print(response)

PowerShell

Edit-FalconContainerAwsAccount -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  region := "string"

  response, err := client.KubernetesProtection.UpdateAWSAccount(
    &kubernetes_protection.UpdateAWSAccountParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Region: &region,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.updateAWSAccount(
  ["ID1", "ID2", "ID3"],  // ids
  "string"  // region
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_protection_api::update_aws_account;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = update_aws_account(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
        Some("string"),  // region
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.update_aws_account(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

207 Multi-Status

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}