Skip to content
CrowdStrike Developer Center

Message Center

The Message Center service collection provides operations for managing support cases and their associated activities and attachments. Retrieve aggregate case analytics, query and manage case activities, upload and download attachments, create new cases, and search for cases by filter criteria.

LanguageLast Update
Pythonv1.6.5
PowerShellv2.2.9
Gov0.22.0
TypeScriptv0.6.0
Rustv0.7.1
Rubyv1.4.0

Table of Contents

Section titled “Table of Contents”
OperationDescription
AggregateCases
aggregate_cases		Retrieve aggregate case values based on the matched filter
CaseAddActivity
add_case_activity		Add an activity to case.
CaseAddAttachment
add_case_attachment		Upload an attachment for the case.
CaseDownloadAttachment
download_case_attachment		retrieves an attachment for the case, given the attachment id
CreateCaseV2
create_case_v2		create a new case
GetCaseActivityByIds
get_case_activity		Retrieve activities for given id’s
GetCaseEntitiesByIDs
get_cases		Retrieve message center cases
QueryActivityByCaseID
query_activities		Retrieve activities id’s for a case
QueryCasesIdsByFilter
query_cases		Retrieve case id’s that match the provided filter criteria
UpdateCaseupdate an existing case

AggregateCases

Section titled “AggregateCases”

Retrieve aggregate case values based on the matched filter

Method POST
Route /message-center/aggregates/cases/GET/v1
Scope Message Center: READ
PEP 8 aggregate_cases

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
exclude body · string
extended_bounds body · object
field body · string
filter body · string
FQL syntax.
filters_spec body · object
from body · integer
include body · string
interval body · string
Available values (6)
yearmonthweek
dayhourminute
max_doc_count body · integer
min_doc_count body · integer
Minimum number of documents required to match.
missing body · string
name body · string
Scan name.
percents body · array
q body · string
FQL syntax.
ranges body · array
size body · integer
sort body · string
FQL syntax.
Available values (2)
_count
sort by document count
_term
sort by the string value alphabetically
sub_aggregates body · array
time_zone body · string
type body · string
String. This method does not support body payload validation.
Available values (10)
date_histogram
Aggregates counts on a specified time interval. Requires use of “interval” field.
date_range
Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
terms
Buckets detections by the value of a specified field. For example, if field used is scenario, then detections will be bucketed by the various detection scenario names.
range
Buckets detections by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the detects will be counted by the specified ranges of severity.
cardinality
Returns the count of distinct values in a specified field.
max
Returns the maximum value of a specified field.
min
Returns the minimum value of a specified field.
avg
Returns the average value of the specified field.
sum
Returns the total sum of all values for the specified field.
percentiles
Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.
Code Examples
from falconpy import MessageCenter


falcon = MessageCenter(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )


date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]


ranges = [
    {
        "From": 0,
        "To": 0
    }
]


response = falcon.aggregate_cases(date_ranges=date_ranges,
                                  field="string",
                                  filter="string",
                                  interval="string",
                                  min_doc_count=integer,
                                  missing="string",
                                  name="string",
                                  q="string",
                                  ranges=ranges,
                                  size=integer,
                                  sort="string",
                                  sub_aggregates=["string"],
                                  time_zone="string",
                                  type="string")
print(response)
Responses
[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

CaseAddActivity

Section titled “CaseAddActivity”

Add an activity to case.

Method POST
Route /message-center/entities/case-activity/v1
Scope Message Center: WRITE
PEP 8 add_case_activity

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
body body · string
case_id body · string
Case ID.
type body · string
Activity type. Only activities of type comment can be added via the API. The keyword activity_type can also be used to specify this value.
user_uuid body · string
UUID of the user related to the activity.
content body · string
Comment content. Used for the body field within the body payload.
Code Examples
from falconpy import MessageCenter


falcon = MessageCenter(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )


response = falcon.add_case_activity(content="string",
                                    case_id="string",
                                    type="string",
                                    user_uuid="string")
print(response)
Responses
{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

CaseAddAttachment

Section titled “CaseAddAttachment”

Upload an attachment for the case.

Method POST
Route /message-center/entities/case-attachment/v1
Scope Message Center: WRITE
PEP 8 add_case_attachment

Parameters

Section titled “Parameters”
case_id body · string
Case ID
user_uuid body · string
User UUID
file body · file
File Body
file_data body · string
Content of the attachment in binary format. Max file size is 15 MB. ‘sample’ and ‘upfile’ are also accepted as this parameter. Filename must start with [a-zA-Z0-9_-] and has a maximum of 255 characters. Allowed characters in file name are [a-zA-Z0-9-_.]. Accepted attachment formats: Images: .png, .bmp, .jpg, .jpeg, .gif Adobe PDF: .pdf Office documents: .doc, .docx, .xls, .xlsx, .pptx Text: .txt, .csv
file_name body · string
File name for the attached file.
Code Examples
from falconpy import MessageCenter


falcon = MessageCenter(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )


response = falcon.add_case_attachment(case_id="string",
                                      file_data="string",
                                      file_name="string",
                                      user_uuid="string")
print(response)
Responses
[
  {
    "created_by": "string",
    "created_time": "string",
    "id": "string",
    "mime_type": "string",
    "name": "string",
    "size": 0
  }
]

CaseDownloadAttachment

Section titled “CaseDownloadAttachment”

retrieves an attachment for the case, given the attachment id

Method GET
Route /message-center/entities/case-attachment/v1
Scope Message Center: READ
PEP 8 download_case_attachment

Parameters

Section titled “Parameters”
id query · string
attachment ID
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
ids body · string
Attachment ID to retrieve.
Code Examples
from falconpy import MessageCenter


falcon = MessageCenter(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.download_case_attachment(ids=id_list)
print(response)
Responses
{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

CreateCaseV2

Section titled “CreateCaseV2”

create a new case

Method POST
Route /message-center/entities/case/v2
Scope Message Center: WRITE
PEP 8 create_case_v2

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
body body · string
detections body · array
List of detections to attach to the case.
incidents body · array
List of incidents to attach to the case.
malware_submission_id body · string
recon_rule_type body · string
title body · string
Case title.
type body · string
Case type. The keyword case_type can also be used to specify this value.
user_uuid body · string
UUID of the user related to the case.
content body · string
Case content. Used for the body field within the body payload.
Code Examples
from falconpy import MessageCenter


falcon = MessageCenter(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )


detections = [
    {
        "id": "string",
        "product": "string",
        "url": "string"
    }
]


incidents = [
    {
        "id": "string",
        "url": "string"
    }
]


response = falcon.create_case_v2(content="string",
                                 detections=detections,
                                 incidents=incidents,
                                 title="string",
                                 type="string",
                                 user_uuid="string")
print(response)
Responses
[
  {
    "id": "string",
    "path": "string"
  }
]

GetCaseActivityByIds

Section titled “GetCaseActivityByIds”

Retrieve activities for given id’s

Method POST
Route /message-center/entities/case-activities/GET/v1
Scope Message Center: READ
PEP 8 get_case_activity

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
ids body · array
One or more case IDs.
Code Examples
from falconpy import MessageCenter


falcon = MessageCenter(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_case_activity(ids=id_list)
print(response)
Responses
[
  {
    "body": "string",
    "case_id": "string",
    "cid": "string",
    "created_by": {},
    "created_time": "string",
    "id": "string",
    "last_modified_time": "string",
    "modified_by": "string",
    "type": "string"
  }
]

GetCaseEntitiesByIDs

Section titled “GetCaseEntitiesByIDs”

Retrieve message center cases

Method POST
Route /message-center/entities/cases/GET/v1
Scope Message Center: READ
PEP 8 get_cases

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
ids body · array
One or more case IDs.
Code Examples
from falconpy import MessageCenter


falcon = MessageCenter(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_cases(ids=id_list)
print(response)
Responses
[
  {
    "aids": [],
    "assigner": {},
    "attachments": [],
    "body": "string",
    "case_type": "string",
    "cid": "string",
    "created_time": "string",
    "detections": [],
    "hosts": [],
    "id": "string",
    "incidents": [],
    "ip_addresses": [],
    "key": "string",
    "last_modified_time": "string",
    "malware_submission_id": "string",
    "malware_submission_url": "string",
    "recon_rule_type": "string",
    "rfi_id": "string",
    "status": "string",
    "title": "string",
    "type": "string"
  }
]

QueryActivityByCaseID

Section titled “QueryActivityByCaseID”

Retrieve activities id’s for a case

Method GET
Route /message-center/queries/case-activities/v1
Scope Message Center: READ
PEP 8 query_activities

Parameters

Section titled “Parameters”
limit query · integer
The maximum records to return. [1-500]
sort query · string
The property to sort by. (Ex: case.created_time.desc) Available sort fields
Available values (4)
activity.type.ascactivity.type.descactivity.created_time.asc
activity.created_time.desc
filter query · string
The filter expression that should be used to limit the results. FQL Syntax.
offset query · integer
Starting index of overall result set from which to return ids.
case_id query · string
Case ID
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import MessageCenter


falcon = MessageCenter(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )


response = falcon.query_activities(case_id="string",
                                   filter="string",
                                   limit=integer,
                                   offset=integer,
                                   sort="string")
print(response)
Responses
[
  "string"
]

QueryCasesIdsByFilter

Section titled “QueryCasesIdsByFilter”

Retrieve case id’s that match the provided filter criteria

Method GET
Route /message-center/queries/cases/v1
Scope Message Center: READ
PEP 8 query_cases

Parameters

Section titled “Parameters”
limit query · integer
The maximum records to return. [1-500]
sort query · string
The property to sort by. (Ex: case.created_time.desc) Available sort fields
Available values (10)
case.created_time.asccase.created_time.desccase.last_modified_time.asc
case.last_modified_time.desccase.status.asccase.status.desc
case.type.asccase.type.desccase.id.asc
case.id.desc
filter query · string
The filter expression that should be used to limit the results. FQL Syntax.
offset query · integer
Starting index of overall result set from which to return ids.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import MessageCenter


falcon = MessageCenter(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )


response = falcon.query_cases(filter="string",
                              limit=integer,
                              offset=integer,
                              sort="string")
print(response)
Responses
[
  "string"
]

UpdateCase

Section titled “UpdateCase”

update an existing case

Method PATCH
Route /message-center/entities/case/v1
Code Examples

Examples coming soon.
© 2026 CrowdStrike, Inc. All rights reserved. Privacy Notice Cookie Notice Terms of Use