ML Exclusions

The ML Exclusions service collection provides operations for managing machine learning exclusions. Retrieve, create, delete, update, and query ML exclusions. Also supports aggregation, reporting, and actions on exclusions with ancestor fields.

Language	Last Update
Python	v1.4.6
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

Operation	Description
getMLExclusionsV1 `get_exclusions`	Get a set of ML Exclusions by specifying their IDs.
createMLExclusionsV1 `create_exclusions`	Create the ML exclusions.
deleteMLExclusionsV1 `delete_exclusions`	Delete the ML exclusions by ID.
updateMLExclusionsV1 `update_exclusions`	Update the ML exclusions.
queryMLExclusionsV1 `query_exclusions`	Search for ML exclusions.
exclusions_aggregates_v2 `get_exclusion_aggregates`	Get exclusion aggregates as specified via json in request body.
exclusions_get_all_v2 `get_all_exclusions`	Get all exclusions.
exclusions_perform_action_v2 `perform_exclusion_action`	Actions used to manipulate the content of exclusions, with ancestor fields.
exclusions_get_reports_v2 `get_exclusion_reports`	Create a report of ML exclusions scoped by the given filters.
exclusions_get_v2 `get_exclusions_v2`	Get the exclusions by id, with ancestor fields.
exclusions_create_v2 `create_exclusions_v2`	Create the exclusions, with ancestor fields.
exclusions_update_v2 `update_exclusions_v2`	Update the exclusions by id, with ancestor fields.
exclusions_delete_v2 `delete_exclusions_v2`	Delete the exclusions by id, with ancestor fields.
exclusions_search_v2 `search_exclusions`	Search for exclusions, with ancestor fields.

getMLExclusionsV1

Get a set of ML Exclusions by specifying their IDs

GET /policy/entities/ml-exclusions/v1

Scope ML Exclusions: READ Consumes · Produces application/json

PEP 8 get_exclusions

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The IDs of the exclusions to retrieve.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_exclusions(ids=id_list)
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getMLExclusionsV1(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getMLExclusionsV1",
                          ids=id_list)
print(response)

Get-FalconMlExclusion -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.MlExclusions.GetMLExclusionsV1(
    &ml_exclusions.GetMLExclusionsV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.getMLExclusionsV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::ml_exclusions_api::get_ml_exclusions_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_ml_exclusions_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::MlExclusions.new

response = api.get_ml_exclusions_v1(['ID1', 'ID2', 'ID3'])

puts response

createMLExclusionsV1

Create the ML exclusions

POST /policy/entities/ml-exclusions/v1

Scope ML Exclusions: WRITE Consumes · Produces application/json

PEP 8 create_exclusions

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
comment	body	string	String comment describing why the exclusions was created.
excluded_from	body	list of strings	Group ID(s) explicitly excluded from the exclusion.
groups	body	list of strings	Group ID(s) impacted by the exclusion. Defaults to [“all”] when not specified while using a Service Class. This default must be provided by the developer when using the Uber Class.
value	body	string	Value to match for the exclusion.

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.create_exclusions(comment="string",
                                    excluded_from=id_list,
                                    groups=["string"],
                                    value="string")
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.createMLExclusionsV1(comment="string",
                                       excluded_from=id_list,
                                       groups=["string"],
                                       value="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "comment": "string",
    "excluded_from": ["string"],
    "groups": ["string"],
    "value": "string"
}

response = falcon.command("createMLExclusionsV1", body=body_payload)
print(response)

New-FalconMlExclusion -Value "string" `
  -ExcludedFrom @("ID1", "ID2") `
  -Comment "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  value := "string"

  response, err := client.MlExclusions.CreateMLExclusionsV1(
    &ml_exclusions.CreateMLExclusionsV1Params{
      Body: &models.ExclusionsCreateReqV1{
        Comment: &comment,
        ExcludedFrom: []string{"string"},
        Groups: []string{"string"},
        Value: &value,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.createMLExclusionsV1(
  {
    comment: "string",
    excludedFrom: [],
    groups: [],
    value: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::ml_exclusions_api::create_ml_exclusions_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ExclusionsCreateReqV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ExclusionsCreateReqV1 {
        ..Default::default()
    };

    let response = create_ml_exclusions_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::MlExclusions.new

body = Falcon::ExclusionsCreateReqV1.new(
  comment: 'string',
  excluded_from: [],
  groups: [],
  value: 'string'
)

response = api.create_ml_exclusions_v1(body)

puts response

deleteMLExclusionsV1

Delete the ML exclusions by id

DELETE /policy/entities/ml-exclusions/v1

Scope ML Exclusions: WRITE Consumes · Produces application/json

PEP 8 delete_exclusions

Parameters

Name	Type	Data type	Description
comment	query	string	Explains why this exclusion was deleted.
ids	query	string or list of strings	The IDs of the exclusions to retrieve.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_exclusions(comment="string", ids=id_list)
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteMLExclusionsV1(comment="string", ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deleteMLExclusionsV1",
                          ids=id_list,
                          comment="string")
print(response)

Remove-FalconMlExclusion -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"

  response, err := client.MlExclusions.DeleteMLExclusionsV1(
    &ml_exclusions.DeleteMLExclusionsV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Comment: &comment,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.deleteMLExclusionsV1(
  ["ID1", "ID2", "ID3"],  // ids
  "string"  // comment
);

console.log(response);

use rusty_falcon::apis::ml_exclusions_api::delete_ml_exclusions_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_ml_exclusions_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
        Some("string"),  // comment
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::MlExclusions.new

response = api.delete_ml_exclusions_v1(['ID1', 'ID2', 'ID3'])

puts response

updateMLExclusionsV1

Update the ML exclusions

PATCH /policy/entities/ml-exclusions/v1

Scope ML Exclusions: WRITE Consumes · Produces application/json

PEP 8 update_exclusions

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
comment	body	string	String comment describing why the exclusions was created.
groups	body	list of strings	Group ID(s) impacted by the exclusion.
id	body	string	The ID of the exclusion to update.
value	body	string	Value to match for the exclusion.

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.update_exclusions(comment="string",
                                    groups=["string"],
                                    id="string",
                                    is_descendant_process=boolean,
                                    value="string")
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.updateMLExclusionsV1(comment="string",
                                       groups=["string"],
                                       id="string",
                                       is_descendant_process=boolean,
                                       value="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "comment": "string",
    "groups": ["string"],
    "id": "string",
    "is_descendant_process": boolean,
    "value": "string"
}

response = falcon.command("updateMLExclusionsV1", body=body_payload)
print(response)

Edit-FalconMlExclusion -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  id := "string"
  is_descendant_process := boolean
  value := "string"

  response, err := client.MlExclusions.UpdateMLExclusionsV1(
    &ml_exclusions.UpdateMLExclusionsV1Params{
      Body: &models.SvExclusionsUpdateReqV1{
        Comment: &comment,
        Groups: []string{"string"},
        ID: &id,
        IsDescendantProcess: &is_descendant_process,
        Value: &value,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.updateMLExclusionsV1(
  {
    comment: "string",
    groups: [],
    id: "string",
    isDescendantProcess: boolean,
    value: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::ml_exclusions_api::update_ml_exclusions_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::SvExclusionsUpdateReqV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = SvExclusionsUpdateReqV1 {
        id: Some("string".to_string()),
        ..Default::default()
    };

    let response = update_ml_exclusions_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::MlExclusions.new

body = Falcon::SvExclusionsUpdateReqV1.new(
  comment: 'string',
  groups: [],
  id: 'string',
  is_descendant_process: boolean,
  value: 'string'
)

response = api.update_ml_exclusions_v1(body)

puts response

queryMLExclusionsV1

Search for ML exclusions.

GET /policy/queries/ml-exclusions/v1

Scope ML Exclusions: READ Consumes · Produces application/json

PEP 8 query_exclusions

Parameters

Name	Type	Data type	Description
filter	query	string	The filter expression that should be used to limit the results. FQL syntax. Available filters: `applied_globally`, `created_by`, `created_on`, `last_modified`, `modified_by`, `value`
limit	query	integer	The maximum number of records to return. [1-500]
offset	query	integer	The offset to start retrieving records from.
parameters	query	dictionary	Full query string parameters payload in JSON format.
sort	query	string	The property to sort by. FQL syntax. (e.g. last_behavior\|asc) Available sort fields: `applied_globally`, `created_by`, `created_on`, `last_modified`, `modified_by`, `value`

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.query_exclusions(filter="string",
                                   limit="string",
                                   offset="string",
                                   sort="string")
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.queryMLExclusionsV1(filter="string",
                                      limit="string",
                                      offset="string",
                                      sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryMLExclusionsV1",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

Get-FalconMlExclusion -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.MlExclusions.QueryMLExclusionsV1(
    &ml_exclusions.QueryMLExclusionsV1Params{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.queryMLExclusionsV1(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::ml_exclusions_api::query_ml_exclusions_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_ml_exclusions_v1(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::MlExclusions.new

response = api.query_ml_exclusions_v1(filter: 'string',
                                      offset: integer,
                                      limit: integer,
                                      sort: 'string')

puts response

exclusions_aggregates_v2

Get exclusion aggregates as specified via json in request body.

POST /exclusions/aggregates/exclusions/GET/v2

Scope ML Exclusions: READ Consumes · Produces application/json

PEP 8 get_exclusion_aggregates

Parameters

Name	Type	Data type	Description
body	body	list of dictionaries	Full body payload as a JSON formatted list.
date_ranges	body	list of dictionaries	List of date ranges for the aggregate.
exclude	body	string	Exclusion string for the aggregate query.
extended_bounds	body	dictionary	Extended bounds for the aggregate.
field	body	string	The field to aggregate on.
filter	body	string	FQL filter to limit aggregation results.
filters_spec	body	dictionary	Specification for additional filters.
from	body	integer	Starting position for pagination.
include	body	string	Inclusion string for the aggregate query.
interval	body	string	Time interval for date histogram aggregates.
max_doc_count	body	integer	Maximum number of documents per bucket.
min_doc_count	body	integer	Minimum number of documents per bucket.
missing	body	string	Value for documents missing the field.
name	body	string	The name of the aggregate query.
parameters	query	dictionary	Full query string parameters payload in JSON format.
percents	body	list of numbers	List of percentiles to calculate.
q	body	string	Full text query string.
ranges	body	list of dictionaries	List of range specifications.
size	body	integer	Maximum number of results to return per aggregate.
sort	body	string	The field to sort results on.
sub_aggregates	body	list of dictionaries	Nested sub-aggregation definitions.
time_zone	body	string	The time zone for date operations.
type	body	string	The type of aggregate query to perform.

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

extended_bounds = {
    "max": "string",
    "min": "string"
}

filters_spec = {
    "filters": {
        "additionalProp1": "string",
        "additionalProp2": "string",
        "additionalProp3": "string"
    },
    "other_bucket": true,
    "other_bucket_key": "string"
}

ranges = [
    {
        "From": 0,
        "To": 0
    }
]

sub_aggregates = [
    null
]

response = falcon.aggregate_exclusions(date_ranges=date_ranges,
                                       exclude="string",
                                       extended_bounds=extended_bounds,
                                       field="string",
                                       filter="string",
                                       filters_spec=filters_spec,
                                       from=integer,
                                       include="string",
                                       interval="string",
                                       max_doc_count=integer,
                                       min_doc_count=integer,
                                       missing="string",
                                       name="string",
                                       percents=["string"],
                                       q="string",
                                       ranges=ranges,
                                       size=integer,
                                       sort="string",
                                       sub_aggregates=sub_aggregates,
                                       time_zone="string",
                                       type="string")
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

extended_bounds = {
    "max": "string",
    "min": "string"
}

filters_spec = {
    "filters": {
        "additionalProp1": "string",
        "additionalProp2": "string",
        "additionalProp3": "string"
    },
    "other_bucket": true,
    "other_bucket_key": "string"
}

ranges = [
    {
        "From": 0,
        "To": 0
    }
]

sub_aggregates = [
    null
]

response = falcon.exclusions_aggregates_v2(date_ranges=date_ranges,
                                           exclude="string",
                                           extended_bounds=extended_bounds,
                                           field="string",
                                           filter="string",
                                           filters_spec=filters_spec,
                                           from=integer,
                                           include="string",
                                           interval="string",
                                           max_doc_count=integer,
                                           min_doc_count=integer,
                                           missing="string",
                                           name="string",
                                           percents=["string"],
                                           q="string",
                                           ranges=ranges,
                                           size=integer,
                                           sort="string",
                                           sub_aggregates=sub_aggregates,
                                           time_zone="string",
                                           type="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "date_ranges": [
        {
            "from": "string",
            "to": "string"
        }
    ],
    "exclude": "string",
    "extended_bounds": {
        "max": "string",
        "min": "string"
    },
    "field": "string",
    "filter": "string",
    "filters_spec": {
        "filters": {},
        "other_bucket": boolean,
        "other_bucket_key": "string"
    },
    "from": integer,
    "include": "string",
    "interval": "string",
    "max_doc_count": integer,
    "min_doc_count": integer,
    "missing": "string",
    "name": "string",
    "percents": ["string"],
    "q": "string",
    "ranges": [
        {
            "from": integer,
            "to": integer
        }
    ],
    "size": integer,
    "sort": "string",
    "sub_aggregates": [
        {
            "date_ranges": [
                {
                    "from": "string",
                    "to": "string"
                }
            ],
            "exclude": "string",
            "extended_bounds": {
                "max": "string",
                "min": "string"
            },
            "field": "string",
            "filter": "string",
            "filters_spec": {
                "filters": {},
                "other_bucket": boolean,
                "other_bucket_key": "string"
            },
            "from": integer,
            "include": "string",
            "interval": "string",
            "max_doc_count": integer,
            "min_doc_count": integer,
            "missing": "string",
            "name": "string",
            "percents": ["string"],
            "q": "string",
            "ranges": [
                {
                    "from": integer,
                    "to": integer
                }
            ],
            "size": integer,
            "sort": "string",
            "sub_aggregates": [
                {
                    "date_ranges": ["string"],
                    "exclude": "string",
                    "extended_bounds": {},
                    "field": "string",
                    "filter": "string",
                    "filters_spec": {},
                    "from": integer,
                    "include": "string",
                    "interval": "string",
                    "max_doc_count": integer,
                    "min_doc_count": integer,
                    "missing": "string",
                    "name": "string",
                    "percents": ["string"],
                    "q": "string",
                    "ranges": ["string"],
                    "size": integer,
                    "sort": "string",
                    "sub_aggregates": ["string"],
                    "time_zone": "string",
                    "type": "string"
                }
            ],
            "time_zone": "string",
            "type": "string"
        }
    ],
    "time_zone": "string",
    "type": "string"
}

response = falcon.command("exclusions_aggregates_v2", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  from := "string"
  to := "string"
  exclude := "string"
  field := "string"
  filter := "string"
  from := integer
  include := "string"
  interval := "string"
  max_doc_count := integer
  min_doc_count := integer
  missing := "string"
  name := "string"
  q := "string"
  From := integer
  To := integer
  size := integer
  sort := "string"
  time_zone := "string"
  type := "string"

  response, err := client.MlExclusions.ExclusionsAggregatesV2(
    &ml_exclusions.ExclusionsAggregatesV2Params{
      Body: &models.MsaAggregateQueryRequest{
        DateRanges: []interface{}{
          {
          From: &from,
          To: &to,
          },
        },
        Exclude: &exclude,
        ExtendedBounds: &struct{}{},
        Field: &field,
        Filter: &filter,
        FiltersSpec: &struct{}{},
        From: &from,
        Include: &include,
        Interval: &interval,
        MaxDocCount: &max_doc_count,
        MinDocCount: &min_doc_count,
        Missing: &missing,
        Name: &name,
        Percents: []interface{}{},
        Q: &q,
        Ranges: []interface{}{
          {
          From: &From,
          To: &To,
          },
        },
        Size: &size,
        Sort: &sort,
        SubAggregates: []interface{}{
          {
          DateRanges: []interface{}{
            {
            From: &from,
            To: &to,
            },
          },
          Exclude: &exclude,
          ExtendedBounds: &struct{}{},
          Field: &field,
          Filter: &filter,
          FiltersSpec: &struct{}{},
          From: &from,
          Include: &include,
          Interval: &interval,
          MaxDocCount: &max_doc_count,
          MinDocCount: &min_doc_count,
          Missing: &missing,
          Name: &name,
          Percents: []interface{}{},
          Q: &q,
          Ranges: []interface{}{
            {
            From: &From,
            To: &To,
            },
          },
          Size: &size,
          Sort: &sort,
          SubAggregates: []interface{}{
            {
            DateRanges: []interface{}{},
            Exclude: &exclude,
            ExtendedBounds: &struct{}{},
            Field: &field,
            Filter: &filter,
            FiltersSpec: &struct{}{},
            From: &from,
            Include: &include,
            Interval: &interval,
            MaxDocCount: &max_doc_count,
            MinDocCount: &min_doc_count,
            Missing: &missing,
            Name: &name,
            Percents: []interface{}{},
            Q: &q,
            Ranges: []interface{}{},
            Size: &size,
            Sort: &sort,
            SubAggregates: []interface{}{},
            TimeZone: &time_zone,
            Type: &type,
            },
          },
          TimeZone: &time_zone,
          Type: &type,
          },
        },
        TimeZone: &time_zone,
        Type: &type,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.exclusionsAggregatesV2(
  {
    dateRanges: [{
        from: "string",
        to: "string"
      }],
    exclude: "string",
    extendedBounds: {
      max: "string",
      min: "string"
    },
    field: "string",
    filter: "string",
    filtersSpec: {
      filters: {},
      otherBucket: boolean,
      otherBucketKey: "string"
    },
    from: integer,
    include: "string",
    interval: "string",
    maxDocCount: integer,
    minDocCount: integer,
    missing: "string",
    name: "string",
    percents: [],
    q: "string",
    ranges: [{
        From: integer,
        To: integer
      }],
    size: integer,
    sort: "string",
    subAggregates: [{
        dateRanges: [{
            from: "string",
            to: "string"
          }],
        exclude: "string",
        extendedBounds: {
          max: "string",
          min: "string"
        },
        field: "string",
        filter: "string",
        filtersSpec: {
          filters: {},
          otherBucket: boolean,
          otherBucketKey: "string"
        },
        from: integer,
        include: "string",
        interval: "string",
        maxDocCount: integer,
        minDocCount: integer,
        missing: "string",
        name: "string",
        percents: [],
        q: "string",
        ranges: [{
            From: integer,
            To: integer
          }],
        size: integer,
        sort: "string",
        subAggregates: [{
            dateRanges: [],
            exclude: "string",
            extendedBounds: {},
            field: "string",
            filter: "string",
            filtersSpec: {},
            from: integer,
            include: "string",
            interval: "string",
            maxDocCount: integer,
            minDocCount: integer,
            missing: "string",
            name: "string",
            percents: [],
            q: "string",
            ranges: [],
            size: integer,
            sort: "string",
            subAggregates: [],
            timeZone: "string",
            type: "string"
          }],
        timeZone: "string",
        type: "string"
      }],
    timeZone: "string",
    type: "string"
}  // body
);

console.log(response);

exclusions_get_all_v2

Get all exclusions.

GET /exclusions/entities/all-exclusions/v2

Scope ML Exclusions: READ Consumes · Produces application/json

PEP 8 get_all_exclusions

Parameters

Name	Type	Data type	Description
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.get_all_exclusions()
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.exclusions_get_all_v2()
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("exclusions_get_all_v2")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.MlExclusions.ExclusionsGetAllV2(
    &ml_exclusions.ExclusionsGetAllV2Params{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.exclusionsGetAllV2();

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::MlExclusions.new

response = api.exclusions_get_all_v2

puts response

exclusions_perform_action_v2

Actions used to manipulate the content of exclusions, with ancestor fields.

POST /exclusions/entities/exclusion-actions/v2

Scope ML Exclusions: WRITE Consumes · Produces application/json

PEP 8 perform_exclusion_action

Parameters

Name	Type	Data type	Description
action_name	query	string	The action to perform. Available values: `add_item`, `remove_item`, `validate_filepath`.
action_parameters	body	list of dictionaries	List of action parameter name/value pairs.
available	body	boolean	Flag indicating if the action is available.
body	body	dictionary	Full body payload in JSON format.
description	body	string	Description of the action to perform.
group	body	string	The group associated with this action.
label	body	string	The label associated with this action.
name	body	string	The name associated with this action.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

action_parameters = [
    {
        "name": "string",
        "value": "string"
    }
]

response = falcon.perform_actions(action_name="string",
                                  action_parameters=action_parameters,
                                  available=boolean,
                                  description="string",
                                  group="string",
                                  label="string",
                                  name="string")
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

action_parameters = [
    {
        "name": "string",
        "value": "string"
    }
]

response = falcon.exclusions_perform_action_v2(action_name="string",
                                               action_parameters=action_parameters,
                                               available=boolean,
                                               description="string",
                                               group="string",
                                               label="string",
                                               name="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "action_parameters": [
        {
            "name": "string",
            "value": "string"
        }
    ],
    "available": boolean,
    "description": "string",
    "group": "string",
    "label": "string",
    "name": "string"
}

response = falcon.command("exclusions_perform_action_v2",
                          action_name="string",
                          body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"
  value := "string"
  available := boolean
  description := "string"
  group := "string"
  label := "string"

  response, err := client.MlExclusions.ExclusionsPerformActionV2(
    &ml_exclusions.ExclusionsPerformActionV2Params{
      Body: &models.MsaspecAction{
        ActionParameters: []interface{}{
          {
          Name: &name,
          Value: &value,
          },
        },
        Available: &available,
        Description: &description,
        Group: &group,
        Label: &label,
        Name: &name,
      },
      ActionName: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.exclusionsPerformActionV2(
  "string",  // actionName
  {  // body
      actionParameters: [{
          name: "string",
          value: "string"
        }],
      available: boolean,
      description: "string",
      group: "string",
      label: "string",
      name: "string"
  }
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::MlExclusions.new

body = Falcon::MsaspecAction.new(
  action_parameters: [{
      name: 'string',
      value: 'string'
    }],
  available: boolean,
  description: 'string',
  group: 'string',
  label: 'string',
  name: 'string'
)

response = api.exclusions_perform_action_v2(body, 'string')

puts response

exclusions_get_reports_v2

Create a report of ML exclusions scoped by the given filters.

POST /exclusions/entities/exclusions/reports/v2

Scope ML Exclusions: WRITE Consumes · Produces application/json

PEP 8 get_exclusion_reports

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
filter	body	string	FQL filter to limit the report results.
report_format	body	string	The format for the report output.
search	body	dictionary	Search criteria for the report.
sort	body	string	The field to sort report results on.

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

search = {
    "filter": "string",
    "sort": "string"
}

response = falcon.get_reports(report_format="string", search=search)
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

search = {
    "filter": "string",
    "sort": "string"
}

response = falcon.exclusions_get_reports_v2(report_format="string",
                                            search=search)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "report_format": "string",
    "search": {
        "filter": "string",
        "sort": "string"
    }
}

response = falcon.command("exclusions_get_reports_v2", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  report_format := "string"

  response, err := client.MlExclusions.ExclusionsGetReportsV2(
    &ml_exclusions.ExclusionsGetReportsV2Params{
      Body: &models.DomainExclusionsReportRequest{
        ReportFormat: &report_format,
        Search: &struct{}{},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.exclusionsGetReportsV2(
  {
    reportFormat: "string",
    search: {
      filter: "string",
      sort: "string"
    }
}  // body
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::MlExclusions.new

body = Falcon::DomainExclusionsReportRequest.new(
  report_format: 'string',
  search: {
    filter: 'string',
    sort: 'string'
  }
)

response = api.exclusions_get_reports_v2(body)

puts response

exclusions_get_v2

Get the exclusions by id, with ancestor fields.

GET /exclusions/entities/exclusions/v2

Scope ML Exclusions: READ Consumes · Produces application/json

PEP 8 get_exclusions_v2

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The IDs of the exclusions to retrieve.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_exclusions_by_id(ids=id_list)
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.exclusions_get_v2(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("exclusions_get_v2",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.MlExclusions.ExclusionsGetV2(
    &ml_exclusions.ExclusionsGetV2Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.exclusionsGetV2(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

exclusions_create_v2

Create the exclusions, with ancestor fields.

POST /exclusions/entities/exclusions/v2

Scope ML Exclusions: WRITE Consumes · Produces application/json

PEP 8 create_exclusions_v2

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
comment	body	string	Descriptive comment for the exclusion.
excluded_from	body	string or list of strings	Sources to exclude from.
exclusions	body	list of dictionaries	List of exclusion definition dictionaries.
grandparent_value	body	string	The grandparent value for the exclusion.
groups	body	string or list of strings	Group IDs to apply this exclusion to.
parent_value	body	string	The parent value for the exclusion.
value	body	string	The value to exclude.

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

exclusions = [
    {
        "comment": "string",
        "excluded_from": [
            "string"
        ],
        "grandparent_value": "string",
        "groups": [
            "string"
        ],
        "parent_value": "string",
        "value": "string"
    }
]

response = falcon.create_exclusions_v2(exclusions=exclusions)
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

exclusions = [
    {
        "comment": "string",
        "excluded_from": [
            "string"
        ],
        "grandparent_value": "string",
        "groups": [
            "string"
        ],
        "parent_value": "string",
        "value": "string"
    }
]

response = falcon.exclusions_create_v2(exclusions=exclusions)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "exclusions": [
        {
            "comment": "string",
            "excluded_from": ["string"],
            "grandparent_value": "string",
            "groups": ["string"],
            "parent_value": "string",
            "value": "string"
        }
    ]
}

response = falcon.command("exclusions_create_v2", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  grandparent_value := "string"
  parent_value := "string"
  value := "string"

  response, err := client.MlExclusions.ExclusionsCreateV2(
    &ml_exclusions.ExclusionsCreateV2Params{
      Body: &models.DomainExclusionsCreateReqV2{
        Exclusions: []interface{}{
          {
          Comment: &comment,
          ExcludedFrom: []string{"string"},
          GrandparentValue: &grandparent_value,
          Groups: []string{"string"},
          ParentValue: &parent_value,
          Value: &value,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.exclusionsCreateV2(
  {
    exclusions: [{
        comment: "string",
        excludedFrom: [],
        grandparentValue: "string",
        groups: [],
        parentValue: "string",
        value: "string"
      }]
}  // body
);

console.log(response);

exclusions_update_v2

Update the exclusions by id, with ancestor fields.

PATCH /exclusions/entities/exclusions/v2

Scope ML Exclusions: WRITE Consumes · Produces application/json

PEP 8 update_exclusions_v2

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
comment	body	string	Descriptive comment for the exclusion update.
excluded_from	body	string or list of strings	Sources to exclude from.
grandparent_value	body	string	The grandparent value for the exclusion.
groups	body	string or list of strings	Group IDs to apply this exclusion to.
id	body	string	The ID of the exclusion to update.
parent_value	body	string	The parent value for the exclusion.
value	body	string	The value to exclude.

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_exclusions_v2(comment="string",
                                       excluded_from=id_list,
                                       grandparent_value="string",
                                       groups=id_list,
                                       id="string",
                                       parent_value="string",
                                       value="string")
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.exclusions_update_v2(comment="string",
                                       excluded_from=id_list,
                                       grandparent_value="string",
                                       groups=id_list,
                                       id="string",
                                       parent_value="string",
                                       value="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "comment": "string",
    "excluded_from": ["string"],
    "grandparent_value": "string",
    "groups": ["string"],
    "id": "string",
    "parent_value": "string",
    "value": "string"
}

response = falcon.command("exclusions_update_v2", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  grandparent_value := "string"
  id := "string"
  parent_value := "string"
  value := "string"

  response, err := client.MlExclusions.ExclusionsUpdateV2(
    &ml_exclusions.ExclusionsUpdateV2Params{
      Body: &models.DomainExclusionUpdateReqV2{
        Comment: &comment,
        ExcludedFrom: []string{"string"},
        GrandparentValue: &grandparent_value,
        Groups: []string{"string"},
        ID: &id,
        ParentValue: &parent_value,
        Value: &value,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.exclusionsUpdateV2(
  {
    comment: "string",
    excludedFrom: [],
    grandparentValue: "string",
    groups: [],
    id: "string",
    parentValue: "string",
    value: "string"
}  // body
);

console.log(response);

exclusions_delete_v2

Delete the exclusions by id, with ancestor fields.

DELETE /exclusions/entities/exclusions/v2

Scope ML Exclusions: WRITE Consumes · Produces application/json

PEP 8 delete_exclusions_v2

Parameters

Name	Type	Data type	Description
comment	query	string	The comment why these exclusions were deleted.
ids	query	string or list of strings	The IDs of the exclusions to delete.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_exclusions_v2(ids=id_list, comment="string")
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.exclusions_delete_v2(ids=id_list, comment="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("exclusions_delete_v2",
                          ids=id_list,
                          comment="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"

  response, err := client.MlExclusions.ExclusionsDeleteV2(
    &ml_exclusions.ExclusionsDeleteV2Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Comment: &comment,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.exclusionsDeleteV2(
  ["ID1", "ID2", "ID3"],  // ids
  "string"  // comment
);

console.log(response);

exclusions_search_v2

Search for exclusions, with ancestor fields.

GET /exclusions/queries/exclusions/v2

Scope ML Exclusions: READ Consumes · Produces application/json

PEP 8 search_exclusions

Parameters

Name	Type	Data type	Description
filter	query	string	The filter expression that should be used to limit the results. FQL syntax.
limit	query	integer	The maximum records to return. [1-500]
offset	query	integer	The offset to start retrieving records from.
parameters	query	dictionary	Full query string parameters payload in JSON format.
sort	query	string	The sort expression that should be used to sort the results. Available sort fields: `applied_globally`, `created_by`, `created_on`, `grandparent_value`, `is_descendant_process`, `last_modified`, `modified_by`, `parent_value`, `value`

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.search_exclusions_v2(filter="string",
                                       offset=integer,
                                       limit=integer,
                                       sort="string")
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.exclusions_search_v2(filter="string",
                                       offset=integer,
                                       limit=integer,
                                       sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("exclusions_search_v2",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.MlExclusions.ExclusionsSearchV2(
    &ml_exclusions.ExclusionsSearchV2Params{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.exclusionsSearchV2(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

ML Exclusions

Table of Contents

getMLExclusionsV1

Parameters

Code Examples

createMLExclusionsV1

Parameters

Code Examples

deleteMLExclusionsV1

Parameters

Code Examples

updateMLExclusionsV1

Parameters

Code Examples

queryMLExclusionsV1

Parameters

Code Examples

exclusions_aggregates_v2

Parameters

Code Examples

exclusions_get_all_v2

Parameters

Code Examples

exclusions_perform_action_v2

Parameters

Code Examples

exclusions_get_reports_v2

Parameters

Code Examples

exclusions_get_v2

Parameters

Code Examples

exclusions_create_v2

Parameters

Code Examples

exclusions_update_v2

Parameters

Code Examples

exclusions_delete_v2

Parameters

Code Examples

exclusions_search_v2

Parameters

Code Examples