Kubernetes Protection

The Kubernetes Protection service collection provides operations for managing Kubernetes cluster security. Query container vulnerabilities, cloud accounts, nodes, deployments, namespaces, and pods. Manage agent configurations and regenerate API keys.

Language	Last Update
Python	v1.6.1
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

Operation	Description
ReadClustersByDateRangeCount `read_clusters_by_date_range`	Retrieve clusters by date range counts
ReadClustersByKubernetesVersionCount `read_clusters_by_version`	Bucket clusters by kubernetes version
ReadClustersByStatusCount `read_clusters_by_status`	Bucket clusters by status
ReadClusterCount `read_cluster_count`	Retrieve cluster counts
ReadContainersByDateRangeCount `read_containers_by_date_range`	Retrieve containers by date range counts
ReadContainerCountByRegistry `read_containers_by_registry`	Retrieve top container image registries
FindContainersCountAffectedByZeroDayVulnerabilities `read_zero_day_affected_counts`	Retrieve containers count affected by zero day vulnerabilities
ReadVulnerableContainerImageCount `read_vulnerable_container_count`	Retrieve count of vulnerable images running on containers
ReadContainerCount `read_container_counts`	Retrieve container counts
FindContainersByContainerRunTimeVersion `find_containers_by_runtime_version`	Retrieve containers by container_runtime_version
GroupContainersByManaged `group_managed_containers`	Group the containers by Managed
ReadContainerImageDetectionsCountByDate `read_detections_count_by_date`	Retrieve count of image assessment detections on running containers over a period of time
ReadContainerImagesByState `read_images_by_state`	Retrieve count of image states running on containers
ReadContainersSensorCoverage `read_sensor_coverage`	Bucket containers by agent type and calculate sensor coverage
ReadContainerVulnerabilitiesBySeverityCount `read_vulnerability_counts_by_severity`	Retrieve container vulnerabilities by severity counts
ReadDeploymentsByDateRangeCount `read_deployment_counts_by_date_range`	Retrieve deployments by date range counts
ReadDeploymentCount `read_deployment_count`	Retrieve deployment counts
ReadClusterEnrichment `read_cluster_enrichment`	Retrieve cluster enrichment data
ReadContainerEnrichment `read_container_enrichment`	Retrieve container enrichment data
ReadDeploymentEnrichment `read_deployment_enrichment`	Retrieve deployment enrichment data
ReadNodeEnrichment `read_node_enrichment`	Retrieve node enrichment data
ReadPodEnrichment `read_pod_enrichment`	Retrieve pod enrichment data
ReadDistinctContainerImageCount `read_distinct_image_count`	Retrieve count of distinct images running on containers
ReadContainerImagesByMostUsed `read_images_by_most_used`	Bucket container by image-digest
ReadKubernetesIomByDateRange `read_iom_count_by_date_range`	Returns the count of Kubernetes IOMs by the date. by default it’s for 7 days.
ReadNamespacesByDateRangeCount `read_namespaces_by_date_range_count`	Retrieve namespaces by date range counts
ReadNamespaceCount `read_namespace_count`	Retrieve namespace counts
ReadKubernetesIomCount `read_iom_count`	Returns the total count of Kubernetes IOMs over the past seven days
ReadNodesByCloudCount `read_node_counts_by_cloud`	Bucket nodes by cloud providers
ReadNodesByContainerEngineVersionCount `read_nodes_by_container_engine_version`	Bucket nodes by their container engine version
ReadNodesByDateRangeCount `read_node_counts_by_date_range`	Retrieve nodes by date range counts
ReadNodeCount `read_node_count`	Retrieve node counts
ReadPodsByDateRangeCount `read_pod_counts_by_date_range`	Retrieve pods by date range counts
ReadPodCount `read_pod_counts`	Retrieve pod counts
ReadClusterCombined `read_clusters_combined`	Retrieve kubernetes clusters identified by the provided filter criteria
ReadClusterCombinedV2 `read_clusters_combined_v2`	Retrieve kubernetes clusters identified by the provided filter criteria
ReadRunningContainerImages `read_running_images`	Retrieve images on running containers
ReadContainerCombined `read_containers_combined`	Retrieve containers identified by the provided filter criteria
ReadDeploymentCombined `read_deployments_combined`	Retrieve kubernetes deployments identified by the provided filter criteria
SearchAndReadKubernetesIomEntities `search_and_read_ioms`	Search Kubernetes IOM by the provided search criteria
ReadNodeCombined `read_nodes_combined`	Retrieve kubernetes nodes identified by the provided filter criteria
ReadPodCombined `read_pods_combined`	Retrieve kubernetes pods identified by the provided filter criteria
ReadKubernetesIomEntities `read_iom_entities`	Retrieve Kubernetes IOM entities identified by the provided IDs
SearchKubernetesIoms `search_ioms`	Search Kubernetes IOMs by the provided search criteria. this endpoint returns a list of Kubernetes IOM UUIDs matching the query
GetAWSAccounts `get_aws_accounts`	Provides a list of AWS accounts.
CreateAWSAccount `create_aws_account`	Creates a new AWS account in our system for a customer and generates the installation script
DeleteAWSAccountsMixin0 `delete_aws_accounts`	Delete AWS accounts.
UpdateAWSAccount `update_aws_account`	Updates the AWS account per the query parameters provided
ListAzureAccounts `list_azure_accounts`	Provides the azure subscriptions registered to Kubernetes Protection.
CreateAzureSubscription `create_azure_subscription`	Creates a new Azure Subscription in our system
DeleteAzureSubscription `delete_azure_subscription`	Delete an Azure Subscription from the system.
GetLocations `get_locations`	Provides the cloud locations acknowledged by the Kubernetes Protection service
GetCombinedCloudClusters `get_cloud_clusters`	Returns a combined list of provisioned cloud accounts and known kubernetes clusters.
GetAzureTenantConfig `get_azure_tenant_config`	Returns the Azure tenant config.
GetStaticScripts `get_static_scripts`	Get static bash scripts that are used during registration.
GetAzureTenantIDs `get_azure_tenant_ids`	Provides all the azure subscriptions and tenants IDs.
GetAzureInstallScript `get_azure_install_script`	Provide the script to run for a given tenant id and subscription IDs.
GetHelmValuesYaml `get_helm_values_yaml`	Provides a sample Helm values.yaml file for a customer to install alongside the agent Helm chart
RegenerateAPIKey `regenerate`	Regenerate API key for docker registry integrations.
GetClusters `get_clusters`	Provides the clusters acknowledged by the Kubernetes Protection service
TriggerScan `trigger_scan`	Triggers a dry run or a full scan of a customer’s kubernetes footprint.
PostSearchKubernetesIOMEntities `search_kubernetes_ioms`	Search Kubernetes IOM entities by filter criteria
PatchAzureServicePrincipal `update_azure_service_principal`	Adds the client ID for the given tenant ID to our system.

ReadClustersByDateRangeCount

Retrieve clusters by date range counts

GET /container-security/aggregates/clusters/count-by-date/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_clusters_by_date_range

No keywords or arguments accepted.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_clusters_by_date_range()
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadClustersByDateRangeCount()
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadClustersByDateRangeCount")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesProtection.ClustersByDateRangeCount(
    &kubernetes_protection.ClustersByDateRangeCountParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.clustersByDateRangeCount();

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_clusters_by_date_range_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_clusters_by_date_range_count(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_clusters_by_date_range_count

puts response

ReadClustersByKubernetesVersionCount

Bucket clusters by kubernetes version

GET /container-security/aggregates/clusters/count-by-kubernetes-version/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_clusters_by_version

Parameters

Name	Type	Data type	Description
filter	query	string	Retrieve count of Kubernetes clusters that match a query in Falcon Query Language (FQL). Supported filters: access,agent_status,cid,cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,cluster_status,container_count,iar_version,kubernetes_version,last_seen,management_status,namespace,node_count,pod_count,pod_name,tags
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_clusters_by_version(filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadClustersByKubernetesVersionCount(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadClustersByKubernetesVersionCount",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.ClustersByKubernetesVersionCount(
    &kubernetes_protection.ClustersByKubernetesVersionCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.clustersByKubernetesVersionCount("string");  // filter

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_clusters_by_kubernetes_version_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_clusters_by_kubernetes_version_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_clusters_by_kubernetes_version_count(filter: 'string')

puts response

ReadClustersByStatusCount

Bucket clusters by status

GET /container-security/aggregates/clusters/count-by-status/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_clusters_by_status

Parameters

Name	Type	Data type	Description
filter	query	string	Retrieve count of Kubernetes clusters that match a query in Falcon Query Language (FQL). Supported filters: access,agent_status,cid,cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,cluster_status,container_count,iar_version,kubernetes_version,last_seen,management_status,namespace,node_count,pod_count,pod_name,tags
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_clusters_by_status(filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadClustersByStatusCount(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadClustersByStatusCount",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.ClustersByStatusCount(
    &kubernetes_protection.ClustersByStatusCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.clustersByStatusCount("string");  // filter

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_clusters_by_status_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_clusters_by_status_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_clusters_by_status_count(filter: 'string')

puts response

ReadClusterCount

Retrieve cluster counts

GET /container-security/aggregates/clusters/count/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_cluster_count

Parameters

Name	Type	Data type	Description
filter	query	string	Retrieve count of Kubernetes clusters that match a query in Falcon Query Language (FQL). Supported filters: access,agent_status,cid,cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,cluster_status,container_count,iar_version,kubernetes_version,last_seen,management_status,namespace,node_count,pod_count,pod_name,tags
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_cluster_count(filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadClusterCount(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadClusterCount",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.ClusterCount(
    &kubernetes_protection.ClusterCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.clusterCount("string");  // filter

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_cluster_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_cluster_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_cluster_count(filter: 'string')

puts response

ReadContainersByDateRangeCount

Retrieve containers by date range counts

GET /container-security/aggregates/containers/count-by-date/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_containers_by_date_range

Parameters

Name	Type	Data type	Description
filter	query	string	Get container counts using a query in Falcon Query Language (FQL). Supported filters: ai_related,agent_id,agent_type,allow_privilege_escalation,cid,cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,container_id,container_name,cve_id,detection_name,first_seen,image_detection_count,image_digest,image_has_been_assessed,image_id,image_registry,image_repository,image_tag,image_vulnerability_count,insecure_mount_source,insecure_mount_type,insecure_propagation_mode,interactive_mode,ipv4,ipv6,labels,last_seen,namespace,node_name,node_uid,package_name_version,pod_id,pod_name,port,privileged,root_write_access,run_as_root_group,run_as_root_user,running_status
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_containers_by_date_range(filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadContainersByDateRangeCount(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadContainersByDateRangeCount",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.ContainersByDateRangeCount(
    &kubernetes_protection.ContainersByDateRangeCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.containersByDateRangeCount("string");  // filter

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_containers_by_date_range_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_containers_by_date_range_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_containers_by_date_range_count(filter: 'string')

puts response

ReadContainerCountByRegistry

Retrieve top container image registries

GET /container-security/aggregates/containers/count-by-registry/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_containers_by_registry

Parameters

Name	Type	Data type	Description
filter	query	string	Retrieve count of Kubernetes clusters that match a query in Falcon Query Language (FQL). Supported filters: agent_id, image_repository, agent_type, image_tag, ai_related, image_vulnerability_count, allow_privilege_escalation, insecure_mount_source, app_name, insecure_mount_type, cid, insecure_propagation_mode, cloud_account_id, interactive_mode, cloud_instance_id, ipv4, cloud_name, ipv6, cloud_region, kac_agent_id, cloud_service, labels, cluster_id, last_seen, cluster_name, namespace, container_id, node_name, container_image_id, node_uid, container_name, package_name_version, cve_id, pod_id, detection_name, pod_name, first_seen, port, image_detection_count, privileged, image_digest, root_write_access, image_has_been_assessed, run_as_root_group, image_id, run_as_root_user, image_registry, running_status
under_assessment	query	boolean	(true/false) whether to return registries under assessment or not under assessment. If not provided all registries are considered
limit	query	integer	The upper-bound on the number of records to retrieve.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_containers_by_registry(filter="string",
                                              under_assessment="string",
                                              limit=integer)
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadContainerCountByRegistry(filter="string",
                                               under_assessment="string",
                                               limit=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadContainerCountByRegistry",
                          under_assessment=boolean,
                          limit=integer,
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  underAssessment := boolean
  limit := int64(0)
  filter := "string"

  response, err := client.KubernetesProtection.ContainerCountByRegistry(
    &kubernetes_protection.ContainerCountByRegistryParams{
      UnderAssessment: &underAssessment,
      Limit: &limit,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.containerCountByRegistry(
  boolean,  // underAssessment
  integer,  // limit
  "string"  // filter
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_container_count_by_registry;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_container_count_by_registry(
        &falcon.cfg,  // configuration
        Some(boolean),  // under_assessment
        Some(integer),  // limit
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_container_count_by_registry(under_assessment: boolean,
                                                limit: integer,
                                                filter: 'string')

puts response

FindContainersCountAffectedByZeroDayVulnerabilities

Retrieve containers count affected by zero day vulnerabilities

GET /container-security/aggregates/containers/count-by-zero-day/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_zero_day_affected_counts

No keywords or arguments accepted.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_zero_day_affected_counts()
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.FindContainersCountAffectedByZeroDayVulnerabilities()
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("FindContainersCountAffectedByZeroDayVulnerabilities")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesProtection.FindContainersCountAffectedByZeroDayVulnerabilities(
    &kubernetes_protection.FindContainersCountAffectedByZeroDayVulnerabilitiesParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.findContainersCountAffectedByZeroDayVulnerabilities();

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::find_containers_count_affected_by_zero_day_vulnerabilities;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = find_containers_count_affected_by_zero_day_vulnerabilities(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.find_containers_count_affected_by_zero_day_vulnerabilities

puts response

ReadVulnerableContainerImageCount

Retrieve count of vulnerable images running on containers

GET /container-security/aggregates/containers/count-vulnerable-images/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_vulnerable_container_count

Parameters

Name	Type	Data type	Description
filter	query	string	Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). Supported filters: ai_related,agent_id,agent_type,allow_privilege_escalation,cid,cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,container_id,container_name,cve_id,detection_name,first_seen,image_detection_count,image_digest,image_has_been_assessed,image_id,image_registry,image_repository,image_tag,image_vulnerability_count,insecure_mount_source,insecure_mount_type,insecure_propagation_mode,interactive_mode,ipv4,ipv6,labels,last_seen,namespace,node_name,node_uid,package_name_version,pod_id,pod_name,port,privileged,root_write_access,run_as_root_group,run_as_root_user,running_status
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_vulnerable_container_count(filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadVulnerableContainerImageCount(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadVulnerableContainerImageCount",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.VulnerableContainerImageCount(
    &kubernetes_protection.VulnerableContainerImageCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.vulnerableContainerImageCount("string");  // filter

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_vulnerable_container_image_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_vulnerable_container_image_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_vulnerable_container_image_count(filter: 'string')

puts response

ReadContainerCount

Retrieve container counts

GET /container-security/aggregates/containers/count/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_container_counts

Parameters

Name	Type	Data type	Description
filter	query	string	Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). Supported filters: ai_related,agent_id,agent_type,allow_privilege_escalation,cid,cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,container_id,container_name,cve_id,detection_name,first_seen,image_detection_count,image_digest,image_has_been_assessed,image_id,image_registry,image_repository,image_tag,image_vulnerability_count,insecure_mount_source,insecure_mount_type,insecure_propagation_mode,interactive_mode,ipv4,ipv6,labels,last_seen,namespace,node_name,node_uid,package_name_version,pod_id,pod_name,port,privileged,root_write_access,run_as_root_group,run_as_root_user,running_status
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_container_counts(filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadContainerCount(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadContainerCount",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.ContainerCount(
    &kubernetes_protection.ContainerCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.containerCount("string");  // filter

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_container_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_container_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_container_count(filter: 'string')

puts response

FindContainersByContainerRunTimeVersion

Retrieve containers by container_runtime_version

GET /container-security/aggregates/containers/find-by-runtimeversion/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 find_containers_by_runtime_version

Parameters

Name	Type	Data type	Description
limit	query	integer	The upper-bound on the number of container records to retrieve.
offset	query	integer	It is used to get the offset
sort	query	string	Field to sort results by
filter	query	string	Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). Supported filters: ai_related,agent_id,agent_type,allow_privilege_escalation,cid,cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,container_id,container_name,cve_id,detection_name,first_seen,image_detection_count,image_digest,image_has_been_assessed,image_id,image_registry,image_repository,image_tag,image_vulnerability_count,insecure_mount_source,insecure_mount_type,insecure_propagation_mode,interactive_mode,ipv4,ipv6,labels,last_seen,namespace,node_name,node_uid,package_name_version,pod_id,pod_name,port,privileged,root_write_access,run_as_root_group,run_as_root_user,running_status
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.find_containers_by_runtime_version(limit="string",
                                                     offset="string",
                                                     sort="string",
                                                     filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.FindContainersByContainerRunTimeVersion(limit="string",
                                                          offset="string",
                                                          sort="string",
                                                          filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("FindContainersByContainerRunTimeVersion",
                          limit=integer,
                          offset=integer,
                          sort="string",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.KubernetesProtection.FindContainersByContainerRunTimeVersion(
    &kubernetes_protection.FindContainersByContainerRunTimeVersionParams{
      Limit: &limit,
      Offset: &offset,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.findContainersByContainerRunTimeVersion(
  integer,  // limit
  integer,  // offset
  "string",  // sort
  "string"  // filter
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::find_containers_by_container_run_time_version;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = find_containers_by_container_run_time_version(
        &falcon.cfg,  // configuration
        Some(integer),  // limit
        Some(integer),  // offset
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.find_containers_by_container_run_time_version(limit: integer,
                                                             offset: integer,
                                                             sort: 'string',
                                                             filter: 'string')

puts response

GroupContainersByManaged

Group the containers by Managed

GET /container-security/aggregates/containers/group-by-managed/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 group_managed_containers

Parameters

Name	Type	Data type	Description
filter	query	string	Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). Supported filters: ai_related,agent_id,allow_privilege_escalation,cid,cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,container_id,container_name,cve_id,detection_name,first_seen,image_detection_count,image_digest,image_has_been_assessed,image_id,image_registry,image_repository,image_tag,image_vulnerability_count,insecure_mount_source,insecure_mount_type,insecure_propagation_mode,interactive_mode,ipv4,ipv6,labels,last_seen,namespace,node_name,node_uid,pod_id,pod_name,port,privileged,root_write_access,run_as_root_group,run_as_root_user,running_status
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.group_managed_containers(filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.GroupContainersByManaged(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GroupContainersByManaged",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.GroupContainersByManaged(
    &kubernetes_protection.GroupContainersByManagedParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.groupContainersByManaged("string");  // filter

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::group_containers_by_managed;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = group_containers_by_managed(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.group_containers_by_managed(filter: 'string')

puts response

ReadContainerImageDetectionsCountByDate

Retrieve count of image assessment detections on running containers over a period of time

GET /container-security/aggregates/containers/image-detections-count-by-date/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_detections_count_by_date

Parameters

Name	Type	Data type	Description
filter	query	string	Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). Supported filters: ai_related,agent_id,agent_type,allow_privilege_escalation,cid,cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,container_id,container_name,cve_id,detection_name,first_seen,image_detection_count,image_digest,image_has_been_assessed,image_id,image_registry,image_repository,image_tag,image_vulnerability_count,insecure_mount_source,insecure_mount_type,insecure_propagation_mode,interactive_mode,ipv4,ipv6,labels,last_seen,namespace,node_name,node_uid,package_name_version,pod_id,pod_name,port,privileged,root_write_access,run_as_root_group,run_as_root_user,running_status
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_detections_count_by_date(filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadContainerImageDetectionsCountByDate(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadContainerImageDetectionsCountByDate",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.ContainerImageDetectionsCountByDate(
    &kubernetes_protection.ContainerImageDetectionsCountByDateParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.containerImageDetectionsCountByDate("string");  // filter

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_container_image_detections_count_by_date;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_container_image_detections_count_by_date(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_container_image_detections_count_by_date(filter: 'string')

puts response

ReadContainerImagesByState

Retrieve count of image states running on containers

GET /container-security/aggregates/containers/images-by-state/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_images_by_state

Parameters

Name	Type	Data type	Description
filter	query	string	Filter using a query in Falcon Query Language (FQL). Supported filters: cid
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_images_by_state(filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadContainerImagesByState(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadContainerImagesByState",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.ContainerImagesByState(
    &kubernetes_protection.ContainerImagesByStateParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.containerImagesByState("string");  // filter

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_container_images_by_state;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_container_images_by_state(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_container_images_by_state(filter: 'string')

puts response

ReadContainersSensorCoverage

Bucket containers by agent type and calculate sensor coverage

GET /container-security/aggregates/containers/sensor-coverage/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_sensor_coverage

Parameters

Name	Type	Data type	Description
filter	query	string	Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). Supported filters: ai_related,agent_id,agent_type,allow_privilege_escalation,cid,cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,container_id,container_name,cve_id,detection_name,first_seen,image_detection_count,image_digest,image_has_been_assessed,image_id,image_registry,image_repository,image_tag,image_vulnerability_count,insecure_mount_source,insecure_mount_type,insecure_propagation_mode,interactive_mode,ipv4,ipv6,labels,last_seen,namespace,node_name,node_uid,package_name_version,pod_id,pod_name,port,privileged,root_write_access,run_as_root_group,run_as_root_user,running_status
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_sensor_coverage(filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadContainersSensorCoverage(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadContainersSensorCoverage",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.ContainersSensorCoverage(
    &kubernetes_protection.ContainersSensorCoverageParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.containersSensorCoverage("string");  // filter

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_containers_sensor_coverage;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_containers_sensor_coverage(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_containers_sensor_coverage(filter: 'string')

puts response

ReadContainerVulnerabilitiesBySeverityCount

Retrieve container vulnerabilities by severity counts

GET /container-security/aggregates/containers/vulnerability-count-by-severity/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_vulnerability_counts_by_severity

Parameters

Name	Type	Data type	Description
filter	query	string	Get vulnerabilities count by severity for container using a query in Falcon Query Language (FQL). Supported filters: ai_related,agent_id,agent_type,allow_privilege_escalation,cid,cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,container_id,container_name,cve_id,detection_name,first_seen,image_detection_count,image_digest,image_has_been_assessed,image_id,image_registry,image_repository,image_tag,image_vulnerability_count,insecure_mount_source,insecure_mount_type,insecure_propagation_mode,interactive_mode,ipv4,ipv6,labels,last_seen,namespace,node_name,node_uid,package_name_version,pod_id,pod_name,port,privileged,root_write_access,run_as_root_group,run_as_root_user,running_status
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_vulnerability_counts_by_severity(filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadContainerVulnerabilitiesBySeverityCount(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadContainerVulnerabilitiesBySeverityCount",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.ContainerVulnerabilitiesBySeverityCount(
    &kubernetes_protection.ContainerVulnerabilitiesBySeverityCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.containerVulnerabilitiesBySeverityCount("string");  // filter

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_container_vulnerabilities_by_severity_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_container_vulnerabilities_by_severity_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_container_vulnerabilities_by_severity_count(filter: 'string')

puts response

ReadDeploymentsByDateRangeCount

Retrieve deployments by date range counts

GET /container-security/aggregates/deployments/count-by-date/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_deployment_counts_by_date_range

No keywords or arguments accepted.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_deployment_counts_by_date_range()
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadDeploymentsByDateRangeCount()
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadDeploymentsByDateRangeCount")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesProtection.DeploymentsByDateRangeCount(
    &kubernetes_protection.DeploymentsByDateRangeCountParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.deploymentsByDateRangeCount();

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_deployments_by_date_range_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_deployments_by_date_range_count(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_deployments_by_date_range_count

puts response

ReadDeploymentCount

Retrieve deployment counts

GET /container-security/aggregates/deployments/count/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_deployment_count

Parameters

Name	Type	Data type	Description
filter	query	string	Retrieve count of Kubernetes deployments that match a query in Falcon Query Language (FQL). Supported filters: annotations_list,cid,cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,deployment_id,deployment_name,first_seen,last_seen,namespace,pod_count
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_deployment_count(filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadDeploymentCount(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadDeploymentCount",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.DeploymentCount(
    &kubernetes_protection.DeploymentCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.deploymentCount("string");  // filter

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_deployment_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_deployment_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_deployment_count(filter: 'string')

puts response

ReadClusterEnrichment

Retrieve cluster enrichment data

GET /container-security/aggregates/enrichment/clusters/entities/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_cluster_enrichment

Parameters

Name	Type	Data type	Description
cluster_id	query	string or list of strings	One or more cluster ids for which to retrieve enrichment info
filter	query	string	Supported filters: cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,last_seen,namespace
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.read_cluster_enrichment(cluster_id=id_list, filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ReadClusterEnrichment(cluster_id=id_list, filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ReadClusterEnrichment",
                          cluster_id=id_list,
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.ClusterEnrichment(
    &kubernetes_protection.ClusterEnrichmentParams{
      ClusterID: []string{"ID1", "ID2", "ID3"},
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.clusterEnrichment(
  ["ID1", "ID2", "ID3"],  // clusterId
  "string"  // filter
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_cluster_enrichment;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_cluster_enrichment(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // cluster_id
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_cluster_enrichment(['ID1', 'ID2', 'ID3'])

puts response

ReadContainerEnrichment

Retrieve container enrichment data

GET /container-security/aggregates/enrichment/containers/entities/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_container_enrichment

Parameters

Name	Type	Data type	Description
container_id	query	string or list of strings	One or more container ids for which to retrieve enrichment info
filter	query	string	Supported filters: cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,last_seen,namespace
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.read_container_enrichment(container_id=id_list,
                                            filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ReadContainerEnrichment(container_id=id_list, filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ReadContainerEnrichment",
                          container_id=id_list,
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.ContainerEnrichment(
    &kubernetes_protection.ContainerEnrichmentParams{
      ContainerID: []string{"ID1", "ID2", "ID3"},
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.containerEnrichment(
  ["ID1", "ID2", "ID3"],  // containerId
  "string"  // filter
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_container_enrichment;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_container_enrichment(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // container_id
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_container_enrichment(['ID1', 'ID2', 'ID3'])

puts response

ReadDeploymentEnrichment

Retrieve deployment enrichment data

GET /container-security/aggregates/enrichment/deployments/entities/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_deployment_enrichment

Parameters

Name	Type	Data type	Description
deployment_id	query	string or list of strings	One or more deployment ids for which to retrieve enrichment info
filter	query	string	Supported filters: cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,last_seen,namespace
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.read_deployment_enrichment(deployment_id=id_list,
                                             filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ReadDeploymentEnrichment(deployment_id=id_list,
                                           filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ReadDeploymentEnrichment",
                          deployment_id=id_list,
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.DeploymentEnrichment(
    &kubernetes_protection.DeploymentEnrichmentParams{
      DeploymentID: []string{"ID1", "ID2", "ID3"},
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.deploymentEnrichment(
  ["ID1", "ID2", "ID3"],  // deploymentId
  "string"  // filter
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_deployment_enrichment;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_deployment_enrichment(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // deployment_id
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_deployment_enrichment(['ID1', 'ID2', 'ID3'])

puts response

ReadNodeEnrichment

Retrieve node enrichment data

GET /container-security/aggregates/enrichment/nodes/entities/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_node_enrichment

Parameters

Name	Type	Data type	Description
node_name	query	string or list of strings	One or more node names for which to retrieve enrichment info
filter	query	string	Supported filters: cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,last_seen,namespace
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_node_enrichment(node_name="string", filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadNodeEnrichment(node_name="string", filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadNodeEnrichment",
                          node_name=id_list,
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.NodeEnrichment(
    &kubernetes_protection.NodeEnrichmentParams{
      NodeName: []string{"ID1", "ID2", "ID3"},
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.nodeEnrichment(
  ["ID1", "ID2", "ID3"],  // nodeName
  "string"  // filter
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_node_enrichment;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_node_enrichment(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // node_name
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_node_enrichment(['ID1', 'ID2', 'ID3'])

puts response

ReadPodEnrichment

Retrieve pod enrichment data

GET /container-security/aggregates/enrichment/pods/entities/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_pod_enrichment

Parameters

Name	Type	Data type	Description
pod_id	query	string or list of strings	One or more pod ids for which to retrieve enrichment info
filter	query	string	Supported filters: cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,last_seen,namespace
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.read_pod_enrichment(pod_id=id_list, filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ReadPodEnrichment(pod_id=id_list, filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ReadPodEnrichment",
                          pod_id=id_list,
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.PodEnrichment(
    &kubernetes_protection.PodEnrichmentParams{
      PodID: []string{"ID1", "ID2", "ID3"},
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.podEnrichment(
  ["ID1", "ID2", "ID3"],  // podId
  "string"  // filter
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_pod_enrichment;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_pod_enrichment(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // pod_id
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_pod_enrichment(['ID1', 'ID2', 'ID3'])

puts response

ReadDistinctContainerImageCount

Retrieve count of distinct images running on containers

GET /container-security/aggregates/images/count-by-distinct/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_distinct_image_count

Parameters

Name	Type	Data type	Description
filter	query	string	Search Kubernetes containers using a query in Falcon Query Language (FQL). Supported filters: agent_id,ai_related,agent_type,allow_privilege_escalation,cid,cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,container_id,container_name,cve_id,detection_name,first_seen,image_detection_count,image_digest,image_has_been_assessed,image_id,image_registry,image_repository,image_tag,image_vulnerability_count,insecure_mount_source,insecure_mount_type,insecure_propagation_mode,interactive_mode,ipv4,ipv6,labels,last_seen,namespace,node_name,node_uid,package_name_version,pod_id,pod_name,port,privileged,root_write_access,run_as_root_group,run_as_root_user,running_status
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_distinct_image_count(filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadDistinctContainerImageCount(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadDistinctContainerImageCount",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.DistinctContainerImageCount(
    &kubernetes_protection.DistinctContainerImageCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.distinctContainerImageCount("string");  // filter

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_distinct_container_image_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_distinct_container_image_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_distinct_container_image_count(filter: 'string')

puts response

ReadContainerImagesByMostUsed

Bucket container by image-digest

GET /container-security/aggregates/images/most-used/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_images_by_most_used

Parameters

Name	Type	Data type	Description
filter	query	string	Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). Supported filters: ai_related,agent_id,agent_type,allow_privilege_escalation,cid,cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,container_id,container_name,cve_id,detection_name,first_seen,image_detection_count,image_digest,image_has_been_assessed,image_id,image_registry,image_repository,image_tag,image_vulnerability_count,insecure_mount_source,insecure_mount_type,insecure_propagation_mode,interactive_mode,ipv4,ipv6,labels,last_seen,namespace,node_name,node_uid,package_name_version,pod_id,pod_name,port,privileged,root_write_access,run_as_root_group,run_as_root_user,running_status
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_images_by_most_used(filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadContainerImagesByMostUsed(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadContainerImagesByMostUsed",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.ContainerImagesByMostUsed(
    &kubernetes_protection.ContainerImagesByMostUsedParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.containerImagesByMostUsed("string");  // filter

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_container_images_by_most_used;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_container_images_by_most_used(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_container_images_by_most_used(filter: 'string')

puts response

ReadKubernetesIomByDateRange

Returns the count of Kubernetes IOMs by the date. by default it’s for 7 days.

GET /container-security/aggregates/kubernetes-ioms/count-by-date/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_iom_count_by_date_range

Parameters

Name	Type	Data type	Description
filter	query	string	Filter images using a query in Falcon Query Language (FQL). Supported filters: cid,created_timestamp,detect_timestamp,prevented,severity
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_iom_count_by_date_range(filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadKubernetesIomByDateRange(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadKubernetesIomByDateRange",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.KubernetesIomByDateRange(
    &kubernetes_protection.KubernetesIomByDateRangeParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.kubernetesIomByDateRange("string");  // filter

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_kubernetes_iom_by_date_range;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_kubernetes_iom_by_date_range(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_kubernetes_iom_by_date_range(filter: 'string')

puts response

ReadNamespacesByDateRangeCount

Retrieve namespaces by date range counts

GET /container-security/aggregates/namespaces/count-by-date/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_namespaces_by_date_range_count

No keywords or arguments accepted.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_namespaces_by_date_range_count()
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadNamespacesByDateRangeCount()
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadNamespacesByDateRangeCount")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesProtection.ReadNamespacesByDateRangeCount(
    &kubernetes_protection.ReadNamespacesByDateRangeCountParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.readNamespacesByDateRangeCount();

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_namespaces_by_date_range_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_namespaces_by_date_range_count(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_namespaces_by_date_range_count

puts response

ReadNamespaceCount

Retrieve namespace counts

GET /container-security/aggregates/namespaces/count/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_namespace_count

Parameters

Name	Type	Data type	Description
filter	query	string	Retrieve count of Kubernetes clusters that match a query in Falcon Query Language (FQL). Supported filters: agent_id,agent_type,annotations_list,cid,cloud_account_id,cloud_name,cloud_region,cloud_service,cluster_id,cluster_name,first_seen,kac_agent_id,last_seen,namespace_id,namespace_name,resource_status
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_namespace_count(filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadNamespaceCount(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadNamespaceCount",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.ReadNamespaceCount(
    &kubernetes_protection.ReadNamespaceCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.readNamespaceCount("string");  // filter

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_namespace_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_namespace_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_namespace_count(filter: 'string')

puts response

ReadKubernetesIomCount

Returns the total count of Kubernetes IOMs over the past seven days

GET /container-security/aggregates/kubernetes-ioms/count/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_iom_count

Parameters

Name	Type	Data type	Description
filter	query	string	Filter images using a query in Falcon Query Language (FQL). Supported filters: cid,created_timestamp,detect_timestamp,prevented,severity
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_iom_count(filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadKubernetesIomCount(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadKubernetesIomCount",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.KubernetesIomCount(
    &kubernetes_protection.KubernetesIomCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.kubernetesIomCount("string");  // filter

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_kubernetes_iom_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_kubernetes_iom_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_kubernetes_iom_count(filter: 'string')

puts response

ReadNodesByCloudCount

Bucket nodes by cloud providers

GET /container-security/aggregates/nodes/count-by-cloud/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_node_counts_by_cloud

Parameters

Name	Type	Data type	Description
filter	query	string	Search Kubernetes nodes using a query in Falcon Query Language (FQL). Supported filters: aid,annotations_list,cid,cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,container_count,container_runtime_version,first_seen,image_digest,ipv4,last_seen,node_name,node_uid,pod_count
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_node_counts_by_cloud(filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadNodesByCloudCount(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadNodesByCloudCount",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.NodesByCloudCount(
    &kubernetes_protection.NodesByCloudCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.nodesByCloudCount("string");  // filter

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_nodes_by_cloud_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_nodes_by_cloud_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_nodes_by_cloud_count(filter: 'string')

puts response

ReadNodesByContainerEngineVersionCount

Bucket nodes by their container engine version

GET /container-security/aggregates/nodes/count-by-container-engine-version/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_nodes_by_container_engine_version

Parameters

Name	Type	Data type	Description
filter	query	string	Search Kubernetes nodes using a query in Falcon Query Language (FQL). Supported filters: aid,annotations_list,cid,cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,container_count,container_runtime_version,first_seen,image_digest,ipv4,last_seen,node_name,node_uid,pod_count
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_nodes_by_container_engine_version(filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadNodesByContainerEngineVersionCount(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadNodesByContainerEngineVersionCount",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.NodesByContainerEngineVersionCount(
    &kubernetes_protection.NodesByContainerEngineVersionCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.nodesByContainerEngineVersionCount("string");  // filter

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_nodes_by_container_engine_version_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_nodes_by_container_engine_version_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_nodes_by_container_engine_version_count(filter: 'string')

puts response

ReadNodesByDateRangeCount

Retrieve nodes by date range counts

GET /container-security/aggregates/nodes/count-by-date/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_node_counts_by_date_range

Parameters

Name	Type	Data type	Description
filter	query	string	Search Kubernetes nodes using a query in Falcon Query Language (FQL). Supported filters: aid,annotations_list,cid,cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,container_count,container_runtime_version,first_seen,image_digest,ipv4,last_seen,node_name,node_uid,pod_count
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_node_counts_by_date_range(filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadNodesByDateRangeCount(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadNodesByDateRangeCount",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.NodesByDateRangeCount(
    &kubernetes_protection.NodesByDateRangeCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.nodesByDateRangeCount("string");  // filter

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_nodes_by_date_range_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_nodes_by_date_range_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_nodes_by_date_range_count(filter: 'string')

puts response

ReadNodeCount

Retrieve node counts

GET /container-security/aggregates/nodes/count/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_node_count

Parameters

Name	Type	Data type	Description
filter	query	string	Retrieve count of Kubernetes nodes that match a query in Falcon Query Language (FQL). Supported filters: aid,annotations_list,cid,cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,container_count,container_runtime_version,first_seen,image_digest,ipv4,last_seen,node_name,node_uid,pod_count
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_node_count(filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadNodeCount(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadNodeCount",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.NodeCount(
    &kubernetes_protection.NodeCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.nodeCount("string");  // filter

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_node_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_node_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_node_count(filter: 'string')

puts response

ReadPodsByDateRangeCount

Retrieve pods by date range counts

GET /container-security/aggregates/pods/count-by-date/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_pod_counts_by_date_range

No keywords or arguments accepted.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_pod_counts_by_date_range()
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadPodsByDateRangeCount()
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadPodsByDateRangeCount")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesProtection.PodsByDateRangeCount(
    &kubernetes_protection.PodsByDateRangeCountParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.podsByDateRangeCount();

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_pods_by_date_range_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_pods_by_date_range_count(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_pods_by_date_range_count

puts response

ReadPodCount

Retrieve pod counts

GET /container-security/aggregates/pods/count/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_pod_counts

Parameters

Name	Type	Data type	Description
filter	query	string	Retrieve count of Kubernetes pods that match a query in Falcon Query Language (FQL). Supported filters: agent_id,agent_type,allow_privilege_escalation,annotations_list,cid,cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,container_count,ipv4,ipv6,labels,last_seen,namespace,node_name,node_uid,owner_id,owner_type,pod_id,pod_name,port,privileged,root_write_access,run_as_root_group,run_as_root_user
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_pod_counts(filter="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadPodCount(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadPodCount",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesProtection.PodCount(
    &kubernetes_protection.PodCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.podCount("string");  // filter

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_pod_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_pod_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_pod_count(filter: 'string')

puts response

ReadClusterCombined

Retrieve kubernetes clusters identified by the provided filter criteria

GET /container-security/combined/clusters/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_clusters_combined

Parameters

Name	Type	Data type	Description
filter	query	string	Search Kubernetes clusters using a query in Falcon Query Language (FQL). Supported filters: access,agent_id,agent_status,agent_type,cid,cloud_account_id,cloud_name,cloud_region,cloud_service,cluster_id,cluster_name,cluster_status,container_count,iar_version,kubernetes_version,last_seen,management_status,node_count,pod_count,tags, namespace, pod_name
limit	query	integer	The upper-bound on the number of records to retrieve.
offset	query	integer	The offset from where to begin.
sort	query	string	Field to sort results by
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_clusters_combined(filter="string",
                                         limit=integer,
                                         offset=integer,
                                         sort="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadClusterCombined(filter="string",
                                      limit=integer,
                                      offset=integer,
                                      sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadClusterCombined",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

Get-FalconContainerCluster -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.ClusterCombined(
    &kubernetes_protection.ClusterCombinedParams{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.clusterCombined(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_cluster_combined;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_cluster_combined(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_cluster_combined(filter: 'string',
                                     sort: 'string',
                                     limit: integer,
                                     offset: integer)

puts response

ReadClusterCombinedV2

Retrieve kubernetes clusters identified by the provided filter criteria

GET /container-security/combined/clusters/v2

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_clusters_combined_v2

Parameters

Name	Type	Data type	Description
filter	query	string	Search Kubernetes clusters using a query in Falcon Query Language (FQL). Supported filter fields: `access`, `agent_id`, `agent_status`, `agent_type`, `cid`, `cloud_account_id`, `cloud_name`, `cloud_region`, `cloud_service`, `cluster_id`, `cluster_name`, `cluster_status`, `container_count`, `iar_coverage`, `kac_agent_id`, `kubernetes_version`, `last_seen`, `management_status`, `node_count`, `pod_count`, `namespace`, `pod_name` and `tags`
sort	query	string	The fields to sort the records on.
include_counts	query	boolean	Flag to include node, pod and container counts in the response
limit	query	integer	The upper-bound on the number of records to retrieve.
offset	query	integer	The offset from where to begin.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_clusters_combined_v2(filter="string",
                                            include_counts=boolean,
                                            limit=integer,
                                            offset=integer,
                                            sort="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadClusterCombinedV2(filter="string",
                                        include_counts=boolean,
                                        limit=integer,
                                        offset=integer,
                                        sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadClusterCombinedV2",
                          filter="string",
                          sort="string",
                          include_counts=boolean,
                          limit=integer,
                          offset=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  includeCounts := boolean
  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.ReadClusterCombinedV2(
    &kubernetes_protection.ReadClusterCombinedV2Params{
      Filter: &filter,
      Sort: &sort,
      IncludeCounts: &includeCounts,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.readClusterCombinedV2(
  "string",  // filter
  "string",  // sort
  boolean,  // includeCounts
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_cluster_combined_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_cluster_combined_v2(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(boolean),  // include_counts
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_cluster_combined_v2(filter: 'string',
                                        sort: 'string',
                                        include_counts: boolean,
                                        limit: integer,
                                        offset: integer)

puts response

ReadRunningContainerImages

Retrieve images on running containers

GET /container-security/combined/container-images/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_running_images

Parameters

Name	Type	Data type	Description
filter	query	string	Retrieve list of images on running containers using a query in Falcon Query Language (FQL). Supported filters: cid,cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,hosts,image_digest,image_has_been_assessed,image_id,image_name,image_registry,image_repository,image_tag,last_seen,namespace,running_status
limit	query	integer	The upper-bound on the number of records to retrieve.
offset	query	integer	The offset from where to begin.
sort	query	string	Field to sort results by
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_running_images(filter=["string"],
                                      limit=integer,
                                      offset=integer,
                                      sort="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadRunningContainerImages(filter=["string"],
                                             limit=integer,
                                             offset=integer,
                                             sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadRunningContainerImages",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

Get-FalconContainerImage -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.RunningContainerImages(
    &kubernetes_protection.RunningContainerImagesParams{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.runningContainerImages(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_running_container_images;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_running_container_images(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_running_container_images(filter: 'string',
                                             sort: 'string',
                                             limit: integer,
                                             offset: integer)

puts response

ReadContainerCombined

Retrieve containers identified by the provided filter criteria

GET /container-security/combined/containers/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_containers_combined

Parameters

Name	Type	Data type	Description
filter	query	string	Search Kubernetes containers using a query in Falcon Query Language (FQL). Supported filters: agent_id,ai_related,agent_type,allow_privilege_escalation,cid,cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,container_id,container_name,cve_id,detection_name,first_seen,image_detection_count,image_digest,image_has_been_assessed,image_id,image_registry,image_repository,image_tag,image_vulnerability_count,insecure_mount_source,insecure_mount_type,insecure_propagation_mode,interactive_mode,ipv4,ipv6,labels,last_seen,namespace,node_name,node_uid,package_name_version,pod_id,pod_name,port,privileged,root_write_access,run_as_root_group,run_as_root_user,running_status
limit	query	integer	The upper-bound on the number of records to retrieve.
offset	query	integer	The offset from where to begin.
sort	query	string	Field to sort results by
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_containers_combined(filter="string",
                                           limit=integer,
                                           offset=integer,
                                           sort="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadContainerCombined(filter="string",
                                        limit=integer,
                                        offset=integer,
                                        sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadContainerCombined",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

Get-FalconContainer -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.ContainerCombined(
    &kubernetes_protection.ContainerCombinedParams{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.containerCombined(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_container_combined;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_container_combined(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_container_combined(filter: 'string',
                                       sort: 'string',
                                       limit: integer,
                                       offset: integer)

puts response

ReadDeploymentCombined

Retrieve kubernetes deployments identified by the provided filter criteria

GET /container-security/combined/deployments/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_deployments_combined

Parameters

Name	Type	Data type	Description
filter	query	string	Search Kubernetes deployments using a query in Falcon Query Language (FQL). Supported filters: annotations_list,cid,cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,deployment_id,deployment_name,first_seen,last_seen,namespace,pod_count
limit	query	integer	The upper-bound on the number of records to retrieve.
offset	query	integer	The offset from where to begin.
sort	query	string	Field to sort results by
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_deployments_combined(filter="string",
                                            limit=integer,
                                            offset=integer,
                                            sort="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadDeploymentCombined(filter="string",
                                         limit=integer,
                                         offset=integer,
                                         sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadDeploymentCombined",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

Get-FalconContainerDeployment -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.DeploymentCombined(
    &kubernetes_protection.DeploymentCombinedParams{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.deploymentCombined(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_deployment_combined;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_deployment_combined(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_deployment_combined(filter: 'string',
                                        sort: 'string',
                                        limit: integer,
                                        offset: integer)

puts response

SearchAndReadKubernetesIomEntities

Search Kubernetes IOM by the provided search criteria

GET /container-security/combined/kubernetes-ioms/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 search_and_read_ioms

Parameters

Name	Type	Data type	Description
filter	query	string	Search Kubernetes IOMs using a query in Falcon Query Language (FQL). Supported filters: cid,cis_id,cluster_id,cluster_name,containers_impacted_ai_related,containers_impacted_count,containers_impacted_ids,detection_type,name,namespace,resource_id,resource_name,resource_type,prevented,severity
limit	query	integer	The upper-bound on the number of records to retrieve.
offset	query	integer	The offset from where to begin.
sort	query	string	The fields to sort the records on.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.search_and_read_ioms(filter="string",
                                       limit=integer,
                                       offset=integer,
                                       sort="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.SearchAndReadKubernetesIomEntities(filter="string",
                                                     limit=integer,
                                                     offset=integer,
                                                     sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("SearchAndReadKubernetesIomEntities",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

Get-FalconContainerIom -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.KubernetesIomEntitiesCombined(
    &kubernetes_protection.KubernetesIomEntitiesCombinedParams{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.kubernetesIomEntitiesCombined(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::search_and_read_kubernetes_iom_entities;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = search_and_read_kubernetes_iom_entities(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.search_and_read_kubernetes_iom_entities(filter: 'string',
                                                       sort: 'string',
                                                       limit: integer,
                                                       offset: integer)

puts response

ReadNodeCombined

Retrieve kubernetes nodes identified by the provided filter criteria

GET /container-security/combined/nodes/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_nodes_combined

Parameters

Name	Type	Data type	Description
filter	query	string	Search Kubernetes nodes using a query in Falcon Query Language (FQL). Supported filters: aid,annotations_list,cid,cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,container_count,container_runtime_version,first_seen,image_digest,ipv4,last_seen,node_name,node_uid,pod_count
limit	query	integer	The upper-bound on the number of records to retrieve.
offset	query	integer	The offset from where to begin.
sort	query	string	Field to sort results by
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_nodes_combined(filter="string",
                                      limit=integer,
                                      offset=integer,
                                      sort="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadNodeCombined(filter="string",
                                   limit=integer,
                                   offset=integer,
                                   sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadNodeCombined",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

Get-FalconContainerNode -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.NodeCombined(
    &kubernetes_protection.NodeCombinedParams{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.nodeCombined(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_node_combined;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_node_combined(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_node_combined(filter: 'string',
                                  sort: 'string',
                                  limit: integer,
                                  offset: integer)

puts response

ReadPodCombined

Retrieve kubernetes pods identified by the provided filter criteria

GET /container-security/combined/pods/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_pods_combined

Parameters

Name	Type	Data type	Description
filter	query	string	Search Kubernetes pods using a query in Falcon Query Language (FQL). Supported filters: agent_id,agent_type,allow_privilege_escalation,annotations_list,cid,cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,container_count,ipv4,ipv6,labels,last_seen,namespace,node_name,node_uid,owner_id,owner_type,pod_id,pod_name,port,privileged,root_write_access,run_as_root_group,run_as_root_user
limit	query	integer	The upper-bound on the number of records to retrieve.
offset	query	integer	The offset from where to begin.
sort	query	string	Field to sort results by
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.read_pods_combined(filter="string",
                                     limit=integer,
                                     offset=integer,
                                     sort="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.ReadPodCombined(filter="string",
                                  limit=integer,
                                  offset=integer,
                                  sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadPodCombined",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

Get-FalconContainerPod -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.PodCombined(
    &kubernetes_protection.PodCombinedParams{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.podCombined(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_pod_combined;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_pod_combined(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_pod_combined(filter: 'string',
                                 sort: 'string',
                                 limit: integer,
                                 offset: integer)

puts response

ReadKubernetesIomEntities

Retrieve Kubernetes IOM entities identified by the provided IDs

GET /container-security/entities/kubernetes-ioms/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 read_iom_entities

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	Search Kubernetes IOMs by ids - The maximum amount is 100 IDs
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.read_iom_entities(ids=id_list)
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ReadKubernetesIomEntities(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ReadKubernetesIomEntities",
                          ids=id_list)
print(response)

Get-FalconContainerIom -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesProtection.KubernetesIomEntities(
    &kubernetes_protection.KubernetesIomEntitiesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.kubernetesIomEntities(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::read_kubernetes_iom_entities;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_kubernetes_iom_entities(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.read_kubernetes_iom_entities(ids: ['ID1', 'ID2', 'ID3'])

puts response

SearchKubernetesIoms

Search Kubernetes IOMs by the provided search criteria. this endpoint returns a list of Kubernetes IOM UUIDs matching the query

GET /container-security/queries/kubernetes-ioms/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 search_ioms

Parameters

Name	Type	Data type	Description
filter	query	string	Search Kubernetes IOMs using a query in Falcon Query Language (FQL). Supported filters: cid,cis_id,cluster_id,cluster_name,containers_impacted_count,containers_impacted_ai_related,containers_impacted_ids,detection_type,name,namespace,resource_id,resource_name,resource_type,prevented,severity
limit	query	integer	The upper-bound on the number of records to retrieve.
offset	query	integer	The offset from where to begin.
sort	query	string	The fields to sort the records on.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.search_ioms(filter="string",
                              limit=integer,
                              offset=integer,
                              sort="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.SearchKubernetesIoms(filter="string",
                                       limit=integer,
                                       offset=integer,
                                       sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("SearchKubernetesIoms",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

Get-FalconContainerIom -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.QueryKubernetesIoms(
    &kubernetes_protection.QueryKubernetesIomsParams{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.queryKubernetesIoms(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::search_kubernetes_ioms;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = search_kubernetes_ioms(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.search_kubernetes_ioms(filter: 'string',
                                      sort: 'string',
                                      limit: integer,
                                      offset: integer)

puts response

GetAWSAccounts

Provides a list of AWS accounts.

GET /kubernetes-protection/entities/accounts/aws/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 get_aws_accounts

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	AWS Account ID(s).
is_horizon_acct	query	string	Filter by whether an account originates from Horizon or not. Allowed values: False or True
limit	query	integer	Maximum number of records to return.
offset	query	integer	Starting index of overall result set from which to return ids.
parameters	query	dictionary	Full query string parameters payload in JSON format.
status	query	string	Filter by account status.

Code Examples

from falconpy import CloudConnectAWS

falcon = CloudConnectAWS(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_aws_accounts(ids=id_list)
print(response)

from falconpy import CloudConnectAWS

falcon = CloudConnectAWS(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetAWSAccounts(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetAWSAccounts",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesProtection.GetAWSAccounts(
    &kubernetes_protection.GetAWSAccountsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.cloudConnectAws.getAWSAccounts(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::cloud_connect_aws_api::get_aws_accounts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_aws_accounts(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.get_aws_accounts(ids: ['ID1', 'ID2', 'ID3'])

puts response

CreateAWSAccount

Creates a new AWS account in our system for a customer and generates the installation script

POST /kubernetes-protection/entities/accounts/aws/v1

Scope Kubernetes Protection: WRITE Consumes · Produces application/json

PEP 8 create_aws_account

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
account_id	body	string	Account ID.
region	body	string	Cloud region.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.create_aws_account(account_id="string", region="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.CreateAWSAccount(account_id="string", region="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "account_id": "string",
            "region": "string"
        }
    ]
}

response = falcon.command("CreateAWSAccount", body=body_payload)
print(response)

New-FalconContainerAwsAccount -Region "string" -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  account_id := "string"
  region := "string"

  response, err := client.KubernetesProtection.CreateAWSAccount(
    &kubernetes_protection.CreateAWSAccountParams{
      Body: &models.K8sregCreateAWSAccReq{
        Resources: []interface{}{
          {
          AccountID: &account_id,
          Region: &region,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.createAWSAccount(
  {
    resources: [{
        accountId: "string",
        region: "string"
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::create_aws_account;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::K8sregCreateAwsAccReq;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = K8sregCreateAwsAccReq {
        resources: vec![resources {
            account_id: Some("string".to_string()),
            region: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = create_aws_account(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

body = Falcon::K8sregCreateAWSAccReq.new(
  resources: [{
      account_id: 'string',
      region: 'string'
    }]
)

response = api.create_aws_account(body)

puts response

DeleteAWSAccountsMixin0

Delete AWS accounts.

DELETE /kubernetes-protection/entities/accounts/aws/v1

Scope Kubernetes Protection: WRITE Consumes · Produces application/json

PEP 8 delete_aws_accounts

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	AWS Account ID(s) to delete.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_aws_accounts(ids=id_list)
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteAWSAccountsMixin0(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteAWSAccountsMixin0",
                          ids=id_list)
print(response)

Remove-FalconContainerAwsAccount -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesProtection.DeleteAWSAccounts(
    &kubernetes_protection.DeleteAWSAccountsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.deleteAWSAccountsMixin0(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::delete_aws_accounts_mixin0;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_aws_accounts_mixin0(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

UpdateAWSAccount

Updates the AWS account per the query parameters provided

PATCH /kubernetes-protection/entities/accounts/aws/v1

Scope Kubernetes Protection: WRITE Consumes · Produces application/json

PEP 8 update_aws_account

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	AWS Account ID(s) to update.
parameters	query	dictionary	Full query string parameters payload in JSON format.
region	query	string	Default region for account automation.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_aws_account(ids=id_list, region="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.UpdateAWSAccount(ids=id_list, region="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("UpdateAWSAccount",
                          ids=id_list,
                          region="string")
print(response)

Edit-FalconContainerAwsAccount -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  region := "string"

  response, err := client.KubernetesProtection.UpdateAWSAccount(
    &kubernetes_protection.UpdateAWSAccountParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Region: &region,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.updateAWSAccount(
  ["ID1", "ID2", "ID3"],  // ids
  "string"  // region
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::update_aws_account;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = update_aws_account(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
        Some("string"),  // region
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.update_aws_account(['ID1', 'ID2', 'ID3'])

puts response

ListAzureAccounts

Provides the azure subscriptions registered to Kubernetes Protection.

GET /kubernetes-protection/entities/accounts/azure/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 list_azure_accounts

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	Azure Tenant ID(s).
subscription_id	query	string or list of strings	Azure Subscription ID(s).
is_horizon_acct	query	boolean	Flag indicating if we should filter by accounts originating from Horizon.
limit	query	integer	Maximum number of records to return.
offset	query	integer	Starting index of overall result set from which to return ids.
parameters	query	dictionary	Full query string parameters payload in JSON format.
status	query	string	Filter by account status (`operational` or `provisioned`).

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.list_azure_accounts(ids=id_list,
                                      is_horizon_acct=boolean,
                                      subscription_id=id_list,
                                      limit=integer,
                                      offset=integer,
                                      status="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ListAzureAccounts(ids=id_list,
                                    is_horizon_acct=boolean,
                                    subscription_id=id_list,
                                    limit=integer,
                                    offset=integer,
                                    status="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ListAzureAccounts",
                          ids=id_list,
                          subscription_id=id_list,
                          status="string",
                          is_horizon_acct="string",
                          limit=integer,
                          offset=integer)
print(response)

Get-FalconContainerAzureAccount

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  status := "string"
  isHorizonAcct := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.ListAzureAccounts(
    &kubernetes_protection.ListAzureAccountsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      SubscriptionID: []string{"ID1", "ID2", "ID3"},
      Status: &status,
      IsHorizonAcct: &isHorizonAcct,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.listAzureAccounts(
  ["ID1", "ID2", "ID3"],  // ids
  ["ID1", "ID2", "ID3"],  // subscriptionId
  "string",  // status
  "string",  // isHorizonAcct
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::list_azure_accounts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = list_azure_accounts(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
        Some(vec!["string".to_string()]),  // subscription_id
        Some("string"),  // status
        Some("string"),  // is_horizon_acct
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.list_azure_accounts(ids: ['ID1', 'ID2', 'ID3'],
                                   subscription_id: ['ID1', 'ID2', 'ID3'],
                                   status: 'string',
                                   is_horizon_acct: 'string',
                                   limit: integer,
                                   offset: integer)

puts response

CreateAzureSubscription

Creates a new Azure Subscription in our system

POST /kubernetes-protection/entities/accounts/azure/v1

Scope Kubernetes Protection: WRITE Consumes · Produces application/json

PEP 8 create_azure_subscription

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
subscription_id	body	string	Azure Subscription ID.
tenant_id	body	string	Azure Tenant ID.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.create_azure_subscription(subscription_id="string",
                                            tenant_id="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.CreateAzureSubscription(subscription_id="string",
                                          tenant_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "subscription_id": "string",
            "tenant_id": "string"
        }
    ]
}

response = falcon.command("CreateAzureSubscription", body=body_payload)
print(response)

New-FalconContainerAzureAccount

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  subscription_id := "string"
  tenant_id := "string"

  response, err := client.KubernetesProtection.CreateAzureSubscription(
    &kubernetes_protection.CreateAzureSubscriptionParams{
      Body: &models.K8sregCreateAzureSubReq{
        Resources: []interface{}{
          {
          SubscriptionID: &subscription_id,
          TenantID: &tenant_id,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.createAzureSubscription(
  {
    resources: [{
        subscriptionId: "string",
        tenantId: "string"
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::create_azure_subscription;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::K8sregCreateAzureSubReq;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = K8sregCreateAzureSubReq {
        resources: vec![AzureSubEntity {
            subscription_id: Some("string".to_string()),
            tenant_id: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = create_azure_subscription(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

body = Falcon::K8sregCreateAzureSubReq.new(
  resources: [{
      subscription_id: 'string',
      tenant_id: 'string'
    }]
)

response = api.create_azure_subscription(body)

puts response

DeleteAzureSubscription

Delete an Azure Subscription from the system.

DELETE /kubernetes-protection/entities/accounts/azure/v1

Scope Kubernetes Protection: WRITE Consumes · Produces application/json

PEP 8 delete_azure_subscription

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	Azure Subscription ID(s) to delete.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_azure_subscription(ids=id_list)
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteAzureSubscription(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteAzureSubscription",
                          ids=id_list)
print(response)

Remove-FalconContainerAzureAccount -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesProtection.DeleteAzureSubscription(
    &kubernetes_protection.DeleteAzureSubscriptionParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.deleteAzureSubscription(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::delete_azure_subscription;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_azure_subscription(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.delete_azure_subscription(ids: ['ID1', 'ID2', 'ID3'])

puts response

GetLocations

Provides the cloud locations acknowledged by the Kubernetes Protection service

GET /kubernetes-protection/entities/cloud-locations/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 get_locations

Parameters

Name	Type	Data type	Description
clouds	query	string or list of strings	Cloud provider.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_locations(clouds=id_list)
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetLocations(clouds=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetLocations",
                          clouds=id_list)
print(response)

Get-FalconContainerCloud

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesProtection.GetLocations(
    &kubernetes_protection.GetLocationsParams{
      Clouds: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.getLocations(["ID1", "ID2", "ID3"]);  // clouds

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::get_locations;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_locations(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // clouds
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.get_locations(clouds: ['ID1', 'ID2', 'ID3'])

puts response

GetCombinedCloudClusters

Returns a combined list of provisioned cloud accounts and known kubernetes clusters.

GET /kubernetes-protection/entities/cloud_cluster/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 get_cloud_clusters

Parameters

Name	Type	Data type	Description
cluster_service	query	string or list of strings	Cluster Service.
cluster_status	query	string or list of strings	Cluster Status.
ids	query	string or list of strings	Cloud Account IDs.
locations	query	string or list of strings	Cloud location.
limit	query	integer	Limit returned results.
offset	query	integer	Pagination offset.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_cloud_clusters(cluser_service=id_list,
                                     cluster_status=id_list,
                                     ids=id_list,
                                     locations=id_list,
                                     limit=integer,
                                     offset=integer)
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetCombinedCloudClusters(cluser_service=id_list,
                                           cluster_status=id_list,
                                           ids=id_list,
                                           locations=id_list,
                                           limit=integer,
                                           offset=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetCombinedCloudClusters",
                          locations=id_list,
                          ids=id_list,
                          cluster_service=id_list,
                          cluster_status=id_list,
                          limit=integer,
                          offset=integer)
print(response)

Get-FalconContainerAccount

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.GetCombinedCloudClusters(
    &kubernetes_protection.GetCombinedCloudClustersParams{
      Locations: []string{"ID1", "ID2", "ID3"},
      Ids: []string{"ID1", "ID2", "ID3"},
      ClusterService: []string{"ID1", "ID2", "ID3"},
      ClusterStatus: []string{"ID1", "ID2", "ID3"},
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.getCombinedCloudClusters(
  ["ID1", "ID2", "ID3"],  // locations
  ["ID1", "ID2", "ID3"],  // ids
  ["ID1", "ID2", "ID3"],  // clusterService
  ["ID1", "ID2", "ID3"],  // clusterStatus
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::get_combined_cloud_clusters;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_combined_cloud_clusters(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // locations
        Some(vec!["string".to_string()]),  // ids
        Some(vec!["string".to_string()]),  // cluster_service
        Some(vec!["string".to_string()]),  // cluster_status
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.get_combined_cloud_clusters(locations: ['ID1', 'ID2', 'ID3'],
                                           ids: ['ID1', 'ID2', 'ID3'],
                                           cluster_service: ['ID1', 'ID2', 'ID3'],
                                           cluster_status: ['ID1', 'ID2', 'ID3'],
                                           limit: integer,
                                           offset: integer)

puts response

GetAzureTenantConfig

Returns the Azure tenant config.

GET /kubernetes-protection/entities/config/azure/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 get_azure_tenant_config

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	Cloud Account IDs.
limit	query	integer	Limit returned results.
offset	query	integer	Pagination offset.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_azure_tenant_config(ids=id_list,
                                          limit=integer,
                                          offset=integer)
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetAzureTenantConfig(ids=id_list,
                                       limit=integer,
                                       offset=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetAzureTenantConfig",
                          ids=id_list,
                          limit=integer,
                          offset=integer)
print(response)

Get-FalconContainerAzureConfig

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.GetAzureTenantConfig(
    &kubernetes_protection.GetAzureTenantConfigParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.getAzureTenantConfig(
  ["ID1", "ID2", "ID3"],  // ids
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::get_azure_tenant_config;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_azure_tenant_config(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.get_azure_tenant_config(ids: ['ID1', 'ID2', 'ID3'],
                                       limit: integer,
                                       offset: integer)

puts response

GetStaticScripts

Get static bash scripts that are used during registration.

GET /kubernetes-protection/entities/gen/scripts/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json application/octet-stream

PEP 8 get_static_scripts

No keywords or arguments accepted.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.get_static_scripts()
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.GetStaticScripts()
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetStaticScripts")
print(response)

Get-FalconContainerScript

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesProtection.GetStaticScripts(
    &kubernetes_protection.GetStaticScriptsParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.getStaticScripts();

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::get_static_scripts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_static_scripts(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.get_static_scripts

puts response

GetAzureTenantIDs

Provides all the azure subscriptions and tenants IDs.

GET /kubernetes-protection/entities/tenants/azure/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 get_azure_tenant_ids

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	Cloud Account IDs.
status	query	string	Cluster status. (`Not Installed`, `Running`, `Stopped`)
limit	query	integer	Limit returned results.
offset	query	integer	Pagination offset.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_azure_tenant_ids(ids=id_list,
                                       status="string",
                                       limit=integer,
                                       offset=integer)
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetAzureTenantIDs(ids=id_list,
                                    status="string",
                                    limit=integer,
                                    offset=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetAzureTenantIDs",
                          ids=id_list,
                          status="string",
                          limit=integer,
                          offset=integer)
print(response)

Get-FalconContainerAzureTenant

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  status := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.GetAzureTenantIDs(
    &kubernetes_protection.GetAzureTenantIDsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Status: &status,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.getAzureTenantIDs(
  ["ID1", "ID2", "ID3"],  // ids
  "string",  // status
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::get_azure_tenant_ids;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_azure_tenant_ids(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
        Some("string"),  // status
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.get_azure_tenant_ids(ids: ['ID1', 'ID2', 'ID3'],
                                    status: 'string',
                                    limit: integer,
                                    offset: integer)

puts response

GetAzureInstallScript

Provide the script to run for a given tenant id and subscription IDs.

GET /kubernetes-protection/entities/user-script/azure/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json application/octet-stream

PEP 8 get_azure_install_script

Parameters

Name	Type	Data type	Description
id	query	string	Azure Tenant ID.
subscription_id	query	string or list of strings	Azure Subscription IDs.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_azure_install_script(id="string", subscription_id=id_list)
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetAzureInstallScript(id="string", subscription_id=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetAzureInstallScript",
                          id="string",
                          subscription_id=id_list)
print(response)

Get-FalconContainerAzureScript -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  iD := "string"

  response, err := client.KubernetesProtection.GetAzureInstallScript(
    &kubernetes_protection.GetAzureInstallScriptParams{
      ID: &iD,
      SubscriptionID: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.getAzureInstallScript(
  "string",  // id
  ["ID1", "ID2", "ID3"]  // subscriptionId
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::get_azure_install_script;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_azure_install_script(
        &falcon.cfg,  // configuration
        Some("string"),  // id
        Some(vec!["string".to_string()]),  // subscription_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.get_azure_install_script(id: 'string',
                                        subscription_id: ['ID1', 'ID2', 'ID3'])

puts response

GetHelmValuesYaml

Provides a sample Helm values.yaml file for a customer to install alongside the agent Helm chart

GET /kubernetes-protection/entities/integration/agent/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json application/yaml

PEP 8 get_helm_values_yaml

Parameters

Name	Type	Data type	Description
cluster_name	query	string	Cluster name. For EKS this will be the cluster ARN.
is_self_managed_cluster	query	boolean	Set to `True` if the cluster is not managed by a cloud provider, and `False` if it is.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.get_helm_values_yaml(cluster_name="string",
                                       is_self_managed_cluster="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.GetHelmValuesYaml(cluster_name="string",
                                    is_self_managed_cluster="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetHelmValuesYaml",
                          cluster_name="string",
                          is_self_managed_cluster=boolean)
print(response)

Receive-FalconContainerYaml -ClusterName "string" -Path "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  isSelfManagedCluster := boolean

  response, err := client.KubernetesProtection.GetHelmValuesYaml(
    &kubernetes_protection.GetHelmValuesYamlParams{
      ClusterName: "string",
      IsSelfManagedCluster: &isSelfManagedCluster,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.getHelmValuesYaml(
  "string",  // clusterName
  boolean  // isSelfManagedCluster
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::get_helm_values_yaml;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_helm_values_yaml(
        &falcon.cfg,  // configuration
        "string",  // cluster_name
        Some(boolean),  // is_self_managed_cluster
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.get_helm_values_yaml('string')

puts response

RegenerateAPIKey

Regenerate API key for docker registry integrations.

POST /kubernetes-protection/entities/integration/api-key/v1

Scope Kubernetes Protection: WRITE Consumes · Produces application/json

PEP 8 regenerate

No keywords or arguments accepted.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.regenerate()
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.RegenerateAPIKey()
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RegenerateAPIKey")
print(response)

New-FalconContainerKey

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesProtection.RegenerateAPIKey(
    &kubernetes_protection.RegenerateAPIKeyParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.regenerateAPIKey();

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::regenerate_api_key;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = regenerate_api_key(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.regenerate_api_key

puts response

GetClusters

Provides the clusters acknowledged by the Kubernetes Protection service

GET /kubernetes-protection/entities/kubernetes/clusters/v1

Scope Kubernetes Protection: READ Consumes · Produces application/json

PEP 8 get_clusters

Parameters

Name	Type	Data type	Description
cluster_names	query	string or list of strings	Cluster name. For EKS this will be the cluster ARN.
account_ids	query	string or list of strings	Cluster account ID. For EKS this will be the AWS account ID.
locations	query	string or list of strings	Cloud location.
cluster_service	query	string	Cluster service.
limit	query	integer	Maximum number of results to return.
offset	query	integer	Starting offset to begin returning results.
status	query	string or list of strings	Cluster status.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_clusters(account_ids=id_list,
                               cluster_names=id_list,
                               cluster_service="string",
                               limit=integer,
                               locations=id_list,
                               status="string",
                               offset="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetClusters(account_ids=id_list,
                              cluster_names=id_list,
                              cluster_service="string",
                              limit=integer,
                              locations=id_list,
                              status="string",
                              offset="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetClusters",
                          cluster_names=id_list,
                          status=id_list,
                          account_ids=id_list,
                          locations=id_list,
                          cluster_service="string",
                          limit=integer,
                          offset=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  clusterService := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.KubernetesProtection.GetClusters(
    &kubernetes_protection.GetClustersParams{
      ClusterNames: []string{"ID1", "ID2", "ID3"},
      Status: []string{"ID1", "ID2", "ID3"},
      AccountIds: []string{"ID1", "ID2", "ID3"},
      Locations: []string{"ID1", "ID2", "ID3"},
      ClusterService: &clusterService,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.getClusters(
  ["ID1", "ID2", "ID3"],  // clusterNames
  ["ID1", "ID2", "ID3"],  // status
  ["ID1", "ID2", "ID3"],  // accountIds
  ["ID1", "ID2", "ID3"],  // locations
  "string",  // clusterService
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::get_clusters;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_clusters(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // cluster_names
        Some(vec!["string".to_string()]),  // status
        Some(vec!["string".to_string()]),  // account_ids
        Some(vec!["string".to_string()]),  // locations
        Some("string"),  // cluster_service
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.get_clusters(cluster_names: ['ID1', 'ID2', 'ID3'],
                            status: ['ID1', 'ID2', 'ID3'],
                            account_ids: ['ID1', 'ID2', 'ID3'],
                            locations: ['ID1', 'ID2', 'ID3'],
                            cluster_service: 'string',
                            limit: integer,
                            offset: integer)

puts response

TriggerScan

Triggers a dry run or a full scan of a customer’s kubernetes footprint.

POST /kubernetes-protection/entities/scan/trigger/v1

Scope Kubernetes Protection: WRITE Consumes · Produces application/json

PEP 8 trigger_scan

Parameters

Name	Type	Data type	Description
scan_type	query	string	Type of scan to perform, `cluster-refresh`, `dry-run` or `full`. Defaults to `dry-run`.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.trigger_scan(scan_type="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.TriggerScan(scan_type="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("TriggerScan",
                          scan_type="string")
print(response)

Invoke-FalconContainerScan -ScanType "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesProtection.TriggerScan(
    &kubernetes_protection.TriggerScanParams{
      ScanType: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.triggerScan("string");  // scanType

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::trigger_scan;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = trigger_scan(
        &falcon.cfg,  // configuration
        "string",  // scan_type
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.trigger_scan('string')

puts response

PostSearchKubernetesIOMEntities

Search Kubernetes IOM entities by filter criteria

POST /container-security/combined/kubernetes-ioms/search/v1

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 search_kubernetes_ioms

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format
filter	query	string	FQL filter to search Kubernetes IOM entities
limit	query	integer	Maximum number of entities to return
sort	query	string	Sort specification for results
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.search_kubernetes_ioms(filter="string",
                                         sort="string",
                                         limit=integer)
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.PostSearchKubernetesIOMEntities(filter="string",
                                                  sort="string",
                                                  limit=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "pit": "string",
    "search_after": ["string"]
}

response = falcon.command("PostSearchKubernetesIOMEntities",
                          filter="string",
                          sort="string",
                          limit=integer,
                          body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  pit := "string"
  filter := "string"
  sort := "string"
  limit := int64(0)

  response, err := client.KubernetesProtection.PostSearchKubernetesIOMEntities(
    &kubernetes_protection.PostSearchKubernetesIOMEntitiesParams{
      Body: &models.K8siomsSearchRequest{
        Pit: &pit,
        SearchAfter: []interface{}{},
      },
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.postSearchKubernetesIOMEntities(
  {  // body
      pit: "string",
      searchAfter: []
  },
  "string",  // filter
  "string",  // sort
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::post_search_kubernetes_iom_entities;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::K8siomsSearchRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = K8siomsSearchRequest {
        pit: Some("string".to_string()),
        search_after: vec![],
        ..Default::default()
    };

    let response = post_search_kubernetes_iom_entities(
        &falcon.cfg,  // configuration
        body,  // body
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

body = {
  pit: 'string',
  search_after: []
}

response = api.post_search_kubernetes_iom_entities(body)

puts response

PatchAzureServicePrincipal

Adds the client ID for the given tenant ID to our system.

PATCH /kubernetes-protection/entities/service-principal/azure/v1

Scope Kubernetes Protection: WRITE Consumes · Produces application/json

PEP 8 update_azure_service_principal

Parameters

Name	Type	Data type	Description
id	query	string	Azure Tenant ID.
client_id	query	string	Azure Client ID.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.update_azure_service_principal(id="string",
                                                 client_id="string")
print(response)

from falconpy import KubernetesProtection

falcon = KubernetesProtection(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.PatchAzureServicePrincipal(id="string", client_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("PatchAzureServicePrincipal",
                          id="string",
                          client_id="string")
print(response)

Edit-FalconContainerAzureAccount -ClientId "string" -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_protection"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesProtection.PatchAzureServicePrincipal(
    &kubernetes_protection.PatchAzureServicePrincipalParams{
      ID: "string",
      ClientID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesProtection.patchAzureServicePrincipal(
  "string",  // id
  "string"  // clientId
);

console.log(response);

use rusty_falcon::apis::kubernetes_protection_api::patch_azure_service_principal;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = patch_azure_service_principal(
        &falcon.cfg,  // configuration
        "string",  // id
        "string",  // client_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesProtection.new

response = api.patch_azure_service_principal('string', 'string')

puts response

Kubernetes Protection

Table of Contents

ReadClustersByDateRangeCount

Code Examples

ReadClustersByKubernetesVersionCount

Parameters

Code Examples

ReadClustersByStatusCount

Parameters

Code Examples

ReadClusterCount

Parameters

Code Examples

ReadContainersByDateRangeCount

Parameters

Code Examples

ReadContainerCountByRegistry

Parameters

Code Examples

FindContainersCountAffectedByZeroDayVulnerabilities

Code Examples

ReadVulnerableContainerImageCount

Parameters

Code Examples

ReadContainerCount

Parameters

Code Examples

FindContainersByContainerRunTimeVersion

Parameters

Code Examples

GroupContainersByManaged

Parameters

Code Examples

ReadContainerImageDetectionsCountByDate

Parameters

Code Examples

ReadContainerImagesByState

Parameters

Code Examples

ReadContainersSensorCoverage

Parameters

Code Examples

ReadContainerVulnerabilitiesBySeverityCount

Parameters

Code Examples

ReadDeploymentsByDateRangeCount

Code Examples

ReadDeploymentCount

Parameters

Code Examples

ReadClusterEnrichment

Parameters

Code Examples

ReadContainerEnrichment

Parameters

Code Examples

ReadDeploymentEnrichment

Parameters

Code Examples

ReadNodeEnrichment

Parameters

Code Examples

ReadPodEnrichment

Parameters

Code Examples

ReadDistinctContainerImageCount

Parameters

Code Examples

ReadContainerImagesByMostUsed

Parameters

Code Examples

ReadKubernetesIomByDateRange

Parameters

Code Examples

ReadNamespacesByDateRangeCount

Code Examples

ReadNamespaceCount

Parameters

Code Examples

ReadKubernetesIomCount