ML Exclusions

The ML Exclusions service collection provides operations for managing machine learning exclusions. Retrieve, create, delete, update, and query ML exclusions. Also supports aggregation, reporting, and actions on exclusions with ancestor fields.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

This service collection has code examples posted to the repository.

Operation	Description
createMLExclusionsV1 `create_exclusions`	Create the ML exclusions
deleteMLExclusionsV1 `delete_exclusions`	Delete the ML exclusions by id
exclusions.aggregates.v2 `aggregate_exclusions`	Get exclusion aggregates as specified via json in request body.
exclusions.create.v2 `create_exclusions_v2`	Create the exclusions, with ancestor fields.
exclusions.delete.v2 `delete_exclusions_v2`	Delete the exclusions by id, with ancestor fields.
exclusions.get-all.v2 `get_all_exclusions`	Get all exclusions.
exclusions.get-reports.v2 `get_reports`	Create a report of ML exclusions scoped by the given filters
exclusions.get.v2 `get_exclusions_by_id`	Get the exclusions by id, with ancestor fields.
exclusions.perform-action.v2 `perform_actions`	Actions used to manipulate the content of exclusions, with ancestor fields.
exclusions.sdmf-query.v1 `exclusions_sdmf_query_v1`	Executes an SDMF data frame query against exclusion entities
exclusions.search.v2 `search_exclusions_v2`	Search for exclusions, with ancestor fields.
exclusions.update.v2 `update_exclusions_v2`	Update the exclusions by id, with ancestor fields.
getMLExclusionsV1 `get_exclusions`	Get a set of ML Exclusions by specifying their IDs
queryMLExclusionsV1 `query_exclusions`	Search for ML exclusions.
updateMLExclusionsV1 `update_exclusions`	Update the ML exclusions

createMLExclusionsV1

Create the ML exclusions

Method POST

Route /policy/entities/ml-exclusions/v1

Scope Machine Learning Exclusions: WRITE

PEP 8 create_exclusions

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

comment body · string

String comment describing why the exclusion is entered.

excluded_from body · array

Exclusion sources to apply.

groups body · array

Group IDs to exclude.

value body · string

Value to exclude.

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.create_exclusions(comment="string",
                                    excluded_from=id_list,
                                    groups=id_list,
                                    value="string")
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.createMLExclusionsV1(comment="string",
                                       excluded_from=id_list,
                                       groups=id_list,
                                       value="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "comment": "string",
    "excluded_from": ["string"],
    "groups": ["string"],
    "value": "string"
}

response = falcon.command("createMLExclusionsV1", body=body_payload)
print(response)

New-FalconMlExclusion -Value "string" `
  -ExcludedFrom @("ID1", "ID2") `
  -Comment "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  value := "string"

  response, err := client.MlExclusions.CreateMLExclusionsV1(
    &ml_exclusions.CreateMLExclusionsV1Params{
      Body: &models.ExclusionsCreateReqV1{
        Comment: &comment,
        ExcludedFrom: []string{"string"},
        Groups: []string{"string"},
        Value: &value,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.createMLExclusionsV1(
  {
    comment: "string",
    excludedFrom: [],
    groups: [],
    value: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::ml_exclusions_api::create_ml_exclusions_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ExclusionsCreateReqV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ExclusionsCreateReqV1 {
        ..Default::default()
    };

    let response = create_ml_exclusions_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::MlExclusions.new

body = Falcon::ExclusionsCreateReqV1.new(
  comment: 'string',
  excluded_from: [],
  groups: [],
  value: 'string'
)

response = api.create_ml_exclusions_v1(body)

puts response

Responses

[
  {
    "applied_globally": false,
    "created_by": "string",
    "created_on": "string",
    "excluded_from": [],
    "groups": [],
    "id": "string",
    "last_modified": "string",
    "modified_by": "string",
    "regexp_value": "string",
    "value": "string",
    "value_hash": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "applied_globally": false,
      "created_by": "string",
      "created_on": "string",
      "excluded_from": [],
      "groups": [],
      "id": "string",
      "last_modified": "string",
      "modified_by": "string",
      "regexp_value": "string",
      "value": "string",
      "value_hash": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "applied_globally": false,
      "created_by": "string",
      "created_on": "string",
      "excluded_from": [],
      "groups": [],
      "id": "string",
      "last_modified": "string",
      "modified_by": "string",
      "regexp_value": "string",
      "value": "string",
      "value_hash": "string"
    }
  ]
}

deleteMLExclusionsV1

Delete the ML exclusions by id

Method DELETE

Route /policy/entities/ml-exclusions/v1

Scope Machine Learning Exclusions: WRITE

PEP 8 delete_exclusions

Parameters

ids query · string or list of strings

The ids of the exclusions to delete

comment query · string

Explains why this exclusions was deleted

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_exclusions(comment="string", ids=id_list)
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteMLExclusionsV1(comment="string", ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deleteMLExclusionsV1",
                          ids=id_list,
                          comment="string")
print(response)

Remove-FalconMlExclusion -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"

  response, err := client.MlExclusions.DeleteMLExclusionsV1(
    &ml_exclusions.DeleteMLExclusionsV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Comment: &comment,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.deleteMLExclusionsV1(
  ["ID1", "ID2", "ID3"],  // ids
  "string"  // comment
);

console.log(response);

use rusty_falcon::apis::ml_exclusions_api::delete_ml_exclusions_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_ml_exclusions_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
        Some("string"),  // comment
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::MlExclusions.new

response = api.delete_ml_exclusions_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

exclusions.aggregates.v2

Get exclusion aggregates as specified via json in request body.

Method POST

Route /exclusions/aggregates/exclusions/GET/v2

Scope Machine Learning Exclusions: WRITE

PEP 8 aggregate_exclusions

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

date_ranges body · array

Date range timeframe.

exclude body · string

Fields to exclude from results.

extended_bounds body · object

Extended bounds for histogram aggregations.

field body · string

Field to aggregate on.

filter body · string

Filter criteria in the form of an FQL query.

filters_spec body · object

Additional filter specifications.

from body · integer

Starting index of overall result set.

include body · string

Fields to include in results.

interval body · string

Time interval for date histogram aggregations.

max_doc_count body · integer

Maximum number of documents per bucket.

min_doc_count body · integer

Minimum number of documents per bucket.

missing body · string

Value to use for documents missing the field.

name body · string

Name of the aggregation.

percents body · array

Percentile values to calculate. List of floats.

q body · string

Full text search query.

ranges body · array

Range boundaries for range aggregations.

size body · integer

Maximum number of records to return.

sort body · string

The field to sort on.

sub_aggregates body · array

Nested aggregation definitions.

time_zone body · string

Time zone for date histogram aggregations.

type body · string

Type of aggregation to perform.

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

extended_bounds = {
    "max": "string",
    "min": "string"
}

filters_spec = {
    "filters": {
        "additionalProp1": "string",
        "additionalProp2": "string",
        "additionalProp3": "string"
    },
    "other_bucket": True,
    "other_bucket_key": "string"
}

ranges = [
    {
        "From": 0,
        "To": 0
    }
]

sub_aggregates = [
    null
]

response = falcon.aggregate_exclusions(date_ranges=date_ranges,
                                       exclude="string",
                                       extended_bounds=extended_bounds,
                                       field="string",
                                       filter="string",
                                       filters_spec=filters_spec,
                                       from=integer,
                                       include="string",
                                       interval="string",
                                       max_doc_count=integer,
                                       min_doc_count=integer,
                                       missing="string",
                                       name="string",
                                       percents=["string"],
                                       q="string",
                                       ranges=ranges,
                                       size=integer,
                                       sort="string",
                                       sub_aggregates=sub_aggregates,
                                       time_zone="string",
                                       type="string")
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

extended_bounds = {
    "max": "string",
    "min": "string"
}

filters_spec = {
    "filters": {
        "additionalProp1": "string",
        "additionalProp2": "string",
        "additionalProp3": "string"
    },
    "other_bucket": True,
    "other_bucket_key": "string"
}

ranges = [
    {
        "From": 0,
        "To": 0
    }
]

sub_aggregates = [
    null
]

response = falcon.exclusions_aggregates_v2(date_ranges=date_ranges,
                                           exclude="string",
                                           extended_bounds=extended_bounds,
                                           field="string",
                                           filter="string",
                                           filters_spec=filters_spec,
                                           from=integer,
                                           include="string",
                                           interval="string",
                                           max_doc_count=integer,
                                           min_doc_count=integer,
                                           missing="string",
                                           name="string",
                                           percents=["string"],
                                           q="string",
                                           ranges=ranges,
                                           size=integer,
                                           sort="string",
                                           sub_aggregates=sub_aggregates,
                                           time_zone="string",
                                           type="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "date_ranges": [
        {
            "from": "string",
            "to": "string"
        }
    ],
    "exclude": "string",
    "extended_bounds": {
        "max": "string",
        "min": "string"
    },
    "field": "string",
    "filter": "string",
    "filters_spec": {
        "filters": {},
        "other_bucket": boolean,
        "other_bucket_key": "string"
    },
    "from": integer,
    "include": "string",
    "interval": "string",
    "max_doc_count": integer,
    "min_doc_count": integer,
    "missing": "string",
    "name": "string",
    "percents": ["string"],
    "q": "string",
    "ranges": [
        {
            "from": integer,
            "to": integer
        }
    ],
    "size": integer,
    "sort": "string",
    "sub_aggregates": [
        {
            "date_ranges": [
                {
                    "from": "string",
                    "to": "string"
                }
            ],
            "exclude": "string",
            "extended_bounds": {
                "max": "string",
                "min": "string"
            },
            "field": "string",
            "filter": "string",
            "filters_spec": {
                "filters": {},
                "other_bucket": boolean,
                "other_bucket_key": "string"
            },
            "from": integer,
            "include": "string",
            "interval": "string",
            "max_doc_count": integer,
            "min_doc_count": integer,
            "missing": "string",
            "name": "string",
            "percents": ["string"],
            "q": "string",
            "ranges": [
                {
                    "from": integer,
                    "to": integer
                }
            ],
            "size": integer,
            "sort": "string",
            "sub_aggregates": [
                {
                    "date_ranges": ["string"],
                    "exclude": "string",
                    "extended_bounds": {},
                    "field": "string",
                    "filter": "string",
                    "filters_spec": {},
                    "from": integer,
                    "include": "string",
                    "interval": "string",
                    "max_doc_count": integer,
                    "min_doc_count": integer,
                    "missing": "string",
                    "name": "string",
                    "percents": ["string"],
                    "q": "string",
                    "ranges": ["string"],
                    "size": integer,
                    "sort": "string",
                    "sub_aggregates": ["string"],
                    "time_zone": "string",
                    "type": "string"
                }
            ],
            "time_zone": "string",
            "type": "string"
        }
    ],
    "time_zone": "string",
    "type": "string"
}

response = falcon.command("exclusions_aggregates_v2", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  from := "string"
  to := "string"
  exclude := "string"
  field := "string"
  filter := "string"
  from := integer
  include := "string"
  interval := "string"
  max_doc_count := integer
  min_doc_count := integer
  missing := "string"
  name := "string"
  q := "string"
  From := integer
  To := integer
  size := integer
  sort := "string"
  time_zone := "string"
  typeVar := "string"

  response, err := client.MlExclusions.ExclusionsAggregatesV2(
    &ml_exclusions.ExclusionsAggregatesV2Params{
      Body: &models.MsaAggregateQueryRequest{
        DateRanges: []interface{}{
          {
          From: &from,
          To: &to,
          },
        },
        Exclude: &exclude,
        ExtendedBounds: &struct{}{},
        Field: &field,
        Filter: &filter,
        FiltersSpec: &struct{}{},
        From: &from,
        Include: &include,
        Interval: &interval,
        MaxDocCount: &max_doc_count,
        MinDocCount: &min_doc_count,
        Missing: &missing,
        Name: &name,
        Percents: []interface{}{},
        Q: &q,
        Ranges: []interface{}{
          {
          From: &From,
          To: &To,
          },
        },
        Size: &size,
        Sort: &sort,
        SubAggregates: []interface{}{
          {
          DateRanges: []interface{}{
            {
            From: &from,
            To: &to,
            },
          },
          Exclude: &exclude,
          ExtendedBounds: &struct{}{},
          Field: &field,
          Filter: &filter,
          FiltersSpec: &struct{}{},
          From: &from,
          Include: &include,
          Interval: &interval,
          MaxDocCount: &max_doc_count,
          MinDocCount: &min_doc_count,
          Missing: &missing,
          Name: &name,
          Percents: []interface{}{},
          Q: &q,
          Ranges: []interface{}{
            {
            From: &From,
            To: &To,
            },
          },
          Size: &size,
          Sort: &sort,
          SubAggregates: []interface{}{
            {
            DateRanges: []interface{}{},
            Exclude: &exclude,
            ExtendedBounds: &struct{}{},
            Field: &field,
            Filter: &filter,
            FiltersSpec: &struct{}{},
            From: &from,
            Include: &include,
            Interval: &interval,
            MaxDocCount: &max_doc_count,
            MinDocCount: &min_doc_count,
            Missing: &missing,
            Name: &name,
            Percents: []interface{}{},
            Q: &q,
            Ranges: []interface{}{},
            Size: &size,
            Sort: &sort,
            SubAggregates: []interface{}{},
            TimeZone: &time_zone,
            Type: &typeVar,
            },
          },
          TimeZone: &time_zone,
          Type: &typeVar,
          },
        },
        TimeZone: &time_zone,
        Type: &typeVar,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.exclusionsAggregatesV2(
  {
    dateRanges: [{
        from: "string",
        to: "string"
      }],
    exclude: "string",
    extendedBounds: {
      max: "string",
      min: "string"
    },
    field: "string",
    filter: "string",
    filtersSpec: {
      filters: {},
      otherBucket: boolean,
      otherBucketKey: "string"
    },
    from: integer,
    include: "string",
    interval: "string",
    maxDocCount: integer,
    minDocCount: integer,
    missing: "string",
    name: "string",
    percents: [],
    q: "string",
    ranges: [{
        From: integer,
        To: integer
      }],
    size: integer,
    sort: "string",
    subAggregates: [{
        dateRanges: [{
            from: "string",
            to: "string"
          }],
        exclude: "string",
        extendedBounds: {
          max: "string",
          min: "string"
        },
        field: "string",
        filter: "string",
        filtersSpec: {
          filters: {},
          otherBucket: boolean,
          otherBucketKey: "string"
        },
        from: integer,
        include: "string",
        interval: "string",
        maxDocCount: integer,
        minDocCount: integer,
        missing: "string",
        name: "string",
        percents: [],
        q: "string",
        ranges: [{
            From: integer,
            To: integer
          }],
        size: integer,
        sort: "string",
        subAggregates: [{
            dateRanges: [],
            exclude: "string",
            extendedBounds: {},
            field: "string",
            filter: "string",
            filtersSpec: {},
            from: integer,
            include: "string",
            interval: "string",
            maxDocCount: integer,
            minDocCount: integer,
            missing: "string",
            name: "string",
            percents: [],
            q: "string",
            ranges: [],
            size: integer,
            sort: "string",
            subAggregates: [],
            timeZone: "string",
            type: "string"
          }],
        timeZone: "string",
        type: "string"
      }],
    timeZone: "string",
    type: "string"
}  // body
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::MlExclusions.new

body = Falcon::MsaAggregateQueryRequest.new(
  date_ranges: [{
      from: 'string',
      to: 'string'
    }],
  exclude: 'string',
  extended_bounds: {
    max: 'string',
    min: 'string'
  },
  field: 'string',
  filter: 'string',
  filters_spec: {
    filters: {},
    other_bucket: boolean,
    other_bucket_key: 'string'
  },
  from: integer,
  include: 'string',
  interval: 'string',
  max_doc_count: integer,
  min_doc_count: integer,
  missing: 'string',
  name: 'string',
  percents: [],
  q: 'string',
  ranges: [{
      From: integer,
      To: integer
    }],
  size: integer,
  sort: 'string',
  sub_aggregates: [{
      date_ranges: [{
          from: 'string',
          to: 'string'
        }],
      exclude: 'string',
      extended_bounds: {
        max: 'string',
        min: 'string'
      },
      field: 'string',
      filter: 'string',
      filters_spec: {
        filters: {},
        other_bucket: boolean,
        other_bucket_key: 'string'
      },
      from: integer,
      include: 'string',
      interval: 'string',
      max_doc_count: integer,
      min_doc_count: integer,
      missing: 'string',
      name: 'string',
      percents: [],
      q: 'string',
      ranges: [{
          From: integer,
          To: integer
        }],
      size: integer,
      sort: 'string',
      sub_aggregates: [{
          date_ranges: [],
          exclude: 'string',
          extended_bounds: {},
          field: 'string',
          filter: 'string',
          filters_spec: {},
          from: integer,
          include: 'string',
          interval: 'string',
          max_doc_count: integer,
          min_doc_count: integer,
          missing: 'string',
          name: 'string',
          percents: [],
          q: 'string',
          ranges: [],
          size: integer,
          sort: 'string',
          sub_aggregates: [],
          time_zone: 'string',
          type: 'string'
        }],
      time_zone: 'string',
      type: 'string'
    }],
  time_zone: 'string',
  type: 'string'
)

response = api.exclusions_aggregates_v2(body)

puts response

Responses

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

exclusions.create.v2

Create the exclusions, with ancestor fields.

Method POST

Route /exclusions/entities/exclusions/v2

Scope Machine Learning Exclusions: WRITE

PEP 8 create_exclusions_v2

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

exclusions body · array

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

exclusions = [
    {
        "comment": "string",
        "excluded_from": [
            "string"
        ],
        "grandparent_value": "string",
        "groups": [
            "string"
        ],
        "parent_value": "string",
        "value": "string"
    }
]

response = falcon.create_exclusions_v2(exclusions=exclusions)
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

exclusions = [
    {
        "comment": "string",
        "excluded_from": [
            "string"
        ],
        "grandparent_value": "string",
        "groups": [
            "string"
        ],
        "parent_value": "string",
        "value": "string"
    }
]

response = falcon.exclusions_create_v2(exclusions=exclusions)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "exclusions": [
        {
            "comment": "string",
            "excluded_from": ["string"],
            "grandparent_value": "string",
            "groups": ["string"],
            "parent_value": "string",
            "value": "string"
        }
    ]
}

response = falcon.command("exclusions_create_v2", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  grandparent_value := "string"
  parent_value := "string"
  value := "string"

  response, err := client.MlExclusions.ExclusionsCreateV2(
    &ml_exclusions.ExclusionsCreateV2Params{
      Body: &models.DomainExclusionsCreateReqV2{
        Exclusions: []interface{}{
          {
          Comment: &comment,
          ExcludedFrom: []string{"string"},
          GrandparentValue: &grandparent_value,
          Groups: []string{"string"},
          ParentValue: &parent_value,
          Value: &value,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.exclusionsCreateV2(
  {
    exclusions: [{
        comment: "string",
        excludedFrom: [],
        grandparentValue: "string",
        groups: [],
        parentValue: "string",
        value: "string"
      }]
}  // body
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::MlExclusions.new

body = Falcon::DomainExclusionsCreateReqV2.new(
  exclusions: [{
      comment: 'string',
      excluded_from: [],
      grandparent_value: 'string',
      groups: [],
      parent_value: 'string',
      value: 'string'
    }]
)

response = api.exclusions_create_v2(body)

puts response

Responses

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

exclusions.delete.v2

Delete the exclusions by id, with ancestor fields.

Method DELETE

Route /exclusions/entities/exclusions/v2

Scope Machine Learning Exclusions: WRITE

PEP 8 delete_exclusions_v2

Parameters

ids query · string or list of strings

The ids of the exclusions to delete

comment query · string

The comment why these exclusions were deleted

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_exclusions_v2(ids=id_list, comment="string")
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.exclusions_delete_v2(ids=id_list, comment="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("exclusions_delete_v2",
                          ids=id_list,
                          comment="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"

  response, err := client.MlExclusions.ExclusionsDeleteV2(
    &ml_exclusions.ExclusionsDeleteV2Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Comment: &comment,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.exclusionsDeleteV2(
  ["ID1", "ID2", "ID3"],  // ids
  "string"  // comment
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::MlExclusions.new

response = api.exclusions_delete_v2(['ID1', 'ID2', 'ID3'])

puts response

Responses

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

exclusions.get-all.v2

Get all exclusions.

Method GET

Route /exclusions/entities/all-exclusions/v2

Scope Machine Learning Exclusions: READ

PEP 8 get_all_exclusions

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.get_all_exclusions()
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.exclusions_get_all_v2()
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("exclusions_get_all_v2")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.MlExclusions.ExclusionsGetAllV2(
    &ml_exclusions.ExclusionsGetAllV2Params{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.exclusionsGetAllV2();

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::MlExclusions.new

response = api.exclusions_get_all_v2

puts response

Responses

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

exclusions.get-reports.v2

Create a report of ML exclusions scoped by the given filters

Method POST

Route /exclusions/entities/exclusions/reports/v2

Scope Machine Learning Exclusions: WRITE

PEP 8 get_reports

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

report_format body · string

search body · object

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

search = {
    "filter": "string",
    "sort": "string"
}

response = falcon.get_reports(report_format="string", search=search)
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

search = {
    "filter": "string",
    "sort": "string"
}

response = falcon.exclusions_get_reports_v2(report_format="string",
                                            search=search)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "report_format": "string",
    "search": {
        "filter": "string",
        "sort": "string"
    }
}

response = falcon.command("exclusions_get_reports_v2", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  report_format := "string"

  response, err := client.MlExclusions.ExclusionsGetReportsV2(
    &ml_exclusions.ExclusionsGetReportsV2Params{
      Body: &models.DomainExclusionsReportRequest{
        ReportFormat: &report_format,
        Search: &struct{}{},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.exclusionsGetReportsV2(
  {
    reportFormat: "string",
    search: {
      filter: "string",
      sort: "string"
    }
}  // body
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::MlExclusions.new

body = Falcon::DomainExclusionsReportRequest.new(
  report_format: 'string',
  search: {
    filter: 'string',
    sort: 'string'
  }
)

response = api.exclusions_get_reports_v2(body)

puts response

Responses

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

exclusions.get.v2

Get the exclusions by id, with ancestor fields.

Method GET

Route /exclusions/entities/exclusions/v2

Scope Machine Learning Exclusions: READ

PEP 8 get_exclusions_by_id

Parameters

ids query · string or list of strings

The ids of the exclusions to retrieve

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_exclusions_by_id(ids=id_list)
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.exclusions_get_v2(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("exclusions_get_v2",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.MlExclusions.ExclusionsGetV2(
    &ml_exclusions.ExclusionsGetV2Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.exclusionsGetV2(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::MlExclusions.new

response = api.exclusions_get_v2(['ID1', 'ID2', 'ID3'])

puts response

Responses

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

exclusions.perform-action.v2

Actions used to manipulate the content of exclusions, with ancestor fields.

Method POST

Route /exclusions/entities/exclusion-actions/v2

Scope Machine Learning Exclusions: WRITE

PEP 8 perform_actions

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

action_parameters body · array

Action-specific parameters.

available body · boolean

Flag indicating if the action is available.

description body · string

Description of the exclusion action.

group body · string

Group associated with the action.

label body · string

Display label for the action.

name body · string

Name of the action.

action_name query · string

The action to perform.

Available values (3)

add_item remove_item validate_filepath

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

action_parameters = [
    {
        "name": "string",
        "value": "string"
    }
]

response = falcon.perform_actions(action_name="string",
                                  action_parameters=action_parameters,
                                  available=boolean,
                                  description="string",
                                  group="string",
                                  label="string",
                                  name="string")
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

action_parameters = [
    {
        "name": "string",
        "value": "string"
    }
]

response = falcon.exclusions_perform_action_v2(action_name="string",
                                               action_parameters=action_parameters,
                                               available=boolean,
                                               description="string",
                                               group="string",
                                               label="string",
                                               name="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "action_parameters": [
        {
            "name": "string",
            "value": "string"
        }
    ],
    "available": boolean,
    "description": "string",
    "group": "string",
    "label": "string",
    "name": "string"
}

response = falcon.command("exclusions_perform_action_v2",
                          action_name="string",
                          body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"
  value := "string"
  available := boolean
  description := "string"
  group := "string"
  label := "string"

  response, err := client.MlExclusions.ExclusionsPerformActionV2(
    &ml_exclusions.ExclusionsPerformActionV2Params{
      Body: &models.MsaspecAction{
        ActionParameters: []interface{}{
          {
          Name: &name,
          Value: &value,
          },
        },
        Available: &available,
        Description: &description,
        Group: &group,
        Label: &label,
        Name: &name,
      },
      ActionName: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.exclusionsPerformActionV2(
  "string",  // actionName
  {  // body
      actionParameters: [{
          name: "string",
          value: "string"
        }],
      available: boolean,
      description: "string",
      group: "string",
      label: "string",
      name: "string"
  }
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::MlExclusions.new

body = Falcon::MsaspecAction.new(
  action_parameters: [{
      name: 'string',
      value: 'string'
    }],
  available: boolean,
  description: 'string',
  group: 'string',
  label: 'string',
  name: 'string'
)

response = api.exclusions_perform_action_v2(body, 'string')

puts response

Responses

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

exclusions.sdmf-query.v1

Executes an SDMF data frame query against exclusion entities

Method POST

Route /exclusions/sdmf/query/v1

Scope Machine Learning Exclusions: WRITE

PEP 8 exclusions_sdmf_query_v1

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

control_info body · object

The control_info value.

id body · string

The id value.

nodes body · array

The nodes value.

res_id body · string

The res_id value.

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

control_info = {
    "deadline": "string",
    "duration": "string",
    "execution_context": {
        "catalog_version": "string",
        "execution_options": "string",
        "extensions": "string",
        "queried_cids": [
            "string"
        ]
    },
    "execution_details": {
        "driver_calls": "string"
    },
    "is_export_request": True,
    "pagination_info": {
        "limit": 0,
        "offset": "string"
    },
    "partial_results": True,
    "query_stats": {
        "execution_stats": {
            "visited_entities": 0,
            "visited_relationships": 0
        },
        "total_hits": {
            "relation": "string",
            "total": 0
        }
    },
    "store_headers": "string"
}

response = falcon.exclusions_sdmf_query_v1(control_info=control_info,
                                           id="string",
                                           nodes=["string"],
                                           res_id="string")
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

control_info = {
    "deadline": "string",
    "duration": "string",
    "execution_context": {
        "catalog_version": "string",
        "execution_options": "string",
        "extensions": "string",
        "queried_cids": [
            "string"
        ]
    },
    "execution_details": {
        "driver_calls": "string"
    },
    "is_export_request": True,
    "pagination_info": {
        "limit": 0,
        "offset": "string"
    },
    "partial_results": True,
    "query_stats": {
        "execution_stats": {
            "visited_entities": 0,
            "visited_relationships": 0
        },
        "total_hits": {
            "relation": "string",
            "total": 0
        }
    },
    "store_headers": "string"
}

response = falcon.exclusions_sdmf_query_v1(control_info=control_info,
                                           id="string",
                                           nodes=["string"],
                                           res_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "control_info": {
        "deadline": "string",
        "duration": "string",
        "execution_context": {
            "catalog_version": "string",
            "execution_options": {},
            "extensions": {},
            "queried_cids": ["string"]
        },
        "execution_details": {
            "driver_calls": {}
        },
        "is_export_request": boolean,
        "pagination_info": {
            "limit": integer,
            "offset": {}
        },
        "partial_results": boolean,
        "query_stats": {
            "execution_stats": {},
            "total_hits": {}
        },
        "store_headers": {}
    },
    "id": "string",
    "nodes": [
        {
            "alias": "string",
            "id": "string",
            "operator": {},
            "res_id": "string",
            "schema": {
                "base": ["string"],
                "facets": ["string"],
                "fields": ["string"],
                "res_id": "string"
            }
        }
    ],
    "res_id": "string"
}

response = falcon.command("exclusions_sdmf_query_v1", body=body_payload)
print(response)

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.exclusionsSdmfQueryV1(
  {
    controlInfo: {
      deadline: "string",
      duration: "string",
      executionContext: {
        catalogVersion: "string",
        executionOptions: {},
        extensions: {},
        queriedCids: []
      },
      executionDetails: {
        driverCalls: {}
      },
      isExportRequest: boolean,
      paginationInfo: {
        limit: integer,
        offset: {}
      },
      partialResults: boolean,
      queryStats: {
        executionStats: {},
        totalHits: {}
      },
      storeHeaders: {}
    },
    id: "string",
    nodes: [{
        alias: "string",
        id: "string",
        operator: {},
        resId: "string",
        schema: {
          base: [],
          facets: [],
          fields: [],
          resId: "string"
        }
      }],
    resId: "string"
}  // body
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::MlExclusions.new

body = Falcon::ApiSdmfQuery.new(
  control_info: {
    deadline: 'string',
    duration: 'string',
    execution_context: {
      catalog_version: 'string',
      execution_options: {},
      extensions: {},
      queried_cids: []
    },
    execution_details: {
      driver_calls: {}
    },
    is_export_request: boolean,
    pagination_info: {
      limit: integer,
      offset: {}
    },
    partial_results: boolean,
    query_stats: {
      execution_stats: {},
      total_hits: {}
    },
    store_headers: {}
  },
  id: 'string',
  nodes: [{
      alias: 'string',
      id: 'string',
      operator: {},
      res_id: 'string',
      schema: {
        base: [],
        facets: [],
        fields: [],
        res_id: 'string'
      }
    }],
  res_id: 'string'
)

response = api.exclusions_sdmf_query_v1(body)

puts response

Responses

[
  {}
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

exclusions.search.v2

Search for exclusions, with ancestor fields.

Method GET

Route /exclusions/queries/exclusions/v2

Scope Machine Learning Exclusions: READ

PEP 8 search_exclusions_v2

Parameters

filter query · string

The filter expression that should be used to limit the results. FQL syntax.

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return. [1-500]

sort query · string

The sort expression that should be used to sort the results. Available sort fields:

Available values (9)

`parent_value`	`value`	`grandparent_value`
`applied_globally`	`created_on`	`created_by`
`last_modified`	`modified_by`	`is_descendant_process`

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.search_exclusions_v2(filter="string",
                                       offset=integer,
                                       limit=integer,
                                       sort="string")
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.exclusions_search_v2(filter="string",
                                       offset=integer,
                                       limit=integer,
                                       sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("exclusions_search_v2",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.MlExclusions.ExclusionsSearchV2(
    &ml_exclusions.ExclusionsSearchV2Params{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.exclusionsSearchV2(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::MlExclusions.new

response = api.exclusions_search_v2(filter: 'string',
                                    offset: integer,
                                    limit: integer,
                                    sort: 'string')

puts response

Responses

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

exclusions.update.v2

Update the exclusions by id, with ancestor fields.

Method PATCH

Route /exclusions/entities/exclusions/v2

Scope Machine Learning Exclusions: WRITE

PEP 8 update_exclusions_v2

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

comment body · string

Comment describing why the exclusion is updated.

excluded_from body · array

Exclusion sources.

grandparent_value body · string

Grandparent process value for the exclusion.

groups body · array

Group IDs to associate with the exclusion.

id body · string

Identifier of the exclusion to update.

parent_value body · string

Parent process value for the exclusion.

value body · string

Value to exclude.

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_exclusions_v2(comment="string",
                                       excluded_from=id_list,
                                       grandparent_value="string",
                                       groups=id_list,
                                       id="string",
                                       parent_value="string",
                                       value="string")
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.exclusions_update_v2(comment="string",
                                       excluded_from=id_list,
                                       grandparent_value="string",
                                       groups=id_list,
                                       id="string",
                                       parent_value="string",
                                       value="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "comment": "string",
    "excluded_from": ["string"],
    "grandparent_value": "string",
    "groups": ["string"],
    "id": "string",
    "parent_value": "string",
    "value": "string"
}

response = falcon.command("exclusions_update_v2", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  grandparent_value := "string"
  id := "string"
  parent_value := "string"
  value := "string"

  response, err := client.MlExclusions.ExclusionsUpdateV2(
    &ml_exclusions.ExclusionsUpdateV2Params{
      Body: &models.DomainExclusionUpdateReqV2{
        Comment: &comment,
        ExcludedFrom: []string{"string"},
        GrandparentValue: &grandparent_value,
        Groups: []string{"string"},
        ID: &id,
        ParentValue: &parent_value,
        Value: &value,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.exclusionsUpdateV2(
  {
    comment: "string",
    excludedFrom: [],
    grandparentValue: "string",
    groups: [],
    id: "string",
    parentValue: "string",
    value: "string"
}  // body
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::MlExclusions.new

body = Falcon::DomainExclusionUpdateReqV2.new(
  comment: 'string',
  excluded_from: [],
  grandparent_value: 'string',
  groups: [],
  id: 'string',
  parent_value: 'string',
  value: 'string'
)

response = api.exclusions_update_v2(body)

puts response

Responses

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

getMLExclusionsV1

Get a set of ML Exclusions by specifying their IDs

Method GET

Route /policy/entities/ml-exclusions/v1

Scope Machine Learning Exclusions: READ

PEP 8 get_exclusions

Parameters

ids query · string or list of strings

The ids of the exclusions to retrieve

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_exclusions(ids=id_list)
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getMLExclusionsV1(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getMLExclusionsV1",
                          ids=id_list)
print(response)

Get-FalconMlExclusion -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.MlExclusions.GetMLExclusionsV1(
    &ml_exclusions.GetMLExclusionsV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.getMLExclusionsV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::ml_exclusions_api::get_ml_exclusions_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_ml_exclusions_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::MlExclusions.new

response = api.get_ml_exclusions_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "applied_globally": false,
    "created_by": "string",
    "created_on": "string",
    "excluded_from": [],
    "groups": [],
    "id": "string",
    "last_modified": "string",
    "modified_by": "string",
    "regexp_value": "string",
    "value": "string",
    "value_hash": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "applied_globally": false,
      "created_by": "string",
      "created_on": "string",
      "excluded_from": [],
      "groups": [],
      "id": "string",
      "last_modified": "string",
      "modified_by": "string",
      "regexp_value": "string",
      "value": "string",
      "value_hash": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "applied_globally": false,
      "created_by": "string",
      "created_on": "string",
      "excluded_from": [],
      "groups": [],
      "id": "string",
      "last_modified": "string",
      "modified_by": "string",
      "regexp_value": "string",
      "value": "string",
      "value_hash": "string"
    }
  ]
}

queryMLExclusionsV1

Search for ML exclusions.

Method GET

Route /policy/queries/ml-exclusions/v1

Scope Machine Learning Exclusions: READ

PEP 8 query_exclusions

Parameters

filter query · string

The filter expression that should be used to limit the results. FQL syntax. Available filters:

Available values (6)

`applied_globally`	`created_by`	`created_on`
`last_modified`	`modified_by`	`value`

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return. [1-500]

sort query · string

The property to sort by. FQL syntax. (e.g. last_behavior|asc) Available sort fields:

Available values (12)

`applied_globally.asc`	`applied_globally.desc`	`created_by.asc`
`created_by.desc`	`created_on.asc`	`created_on.desc`
`last_modified.asc`	`last_modified.desc`	`modified_by.asc`
`modified_by.desc`	`value.asc`	`value.desc`

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.query_exclusions(filter="string",
                                   limit=integer,
                                   offset=integer,
                                   sort="string")
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.queryMLExclusionsV1(filter="string",
                                      limit=integer,
                                      offset=integer,
                                      sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryMLExclusionsV1",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

Get-FalconMlExclusion -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.MlExclusions.QueryMLExclusionsV1(
    &ml_exclusions.QueryMLExclusionsV1Params{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.queryMLExclusionsV1(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::ml_exclusions_api::query_ml_exclusions_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_ml_exclusions_v1(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::MlExclusions.new

response = api.query_ml_exclusions_v1(filter: 'string',
                                      offset: integer,
                                      limit: integer,
                                      sort: 'string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

updateMLExclusionsV1

Update the ML exclusions

Method PATCH

Route /policy/entities/ml-exclusions/v1

Scope Machine Learning Exclusions: WRITE

PEP 8 update_exclusions

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

comment body · string

String comment describing why the exclusion is entered.

groups body · array

Group IDs to exclude.

id body · string

Exclusion ID to update.

is_descendant_process body · boolean

Flag indicating if this is a descendant process.

value body · string

Value to exclude.

Code Examples

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_exclusions(comment="string",
                                    groups=id_list,
                                    id="string",
                                    is_descendant_process=boolean,
                                    value="string")
print(response)

from falconpy import MLExclusions

falcon = MLExclusions(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.updateMLExclusionsV1(comment="string",
                                       groups=id_list,
                                       id="string",
                                       is_descendant_process=boolean,
                                       value="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "comment": "string",
    "groups": ["string"],
    "id": "string",
    "is_descendant_process": boolean,
    "value": "string"
}

response = falcon.command("updateMLExclusionsV1", body=body_payload)
print(response)

Edit-FalconMlExclusion -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ml_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  id := "string"
  is_descendant_process := boolean
  value := "string"

  response, err := client.MlExclusions.UpdateMLExclusionsV1(
    &ml_exclusions.UpdateMLExclusionsV1Params{
      Body: &models.SvExclusionsUpdateReqV1{
        Comment: &comment,
        Groups: []string{"string"},
        ID: &id,
        IsDescendantProcess: &is_descendant_process,
        Value: &value,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mlExclusions.updateMLExclusionsV1(
  {
    comment: "string",
    groups: [],
    id: "string",
    isDescendantProcess: boolean,
    value: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::ml_exclusions_api::update_ml_exclusions_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::SvExclusionsUpdateReqV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = SvExclusionsUpdateReqV1 {
        id: Some("string".to_string()),
        ..Default::default()
    };

    let response = update_ml_exclusions_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::MlExclusions.new

body = Falcon::SvExclusionsUpdateReqV1.new(
  comment: 'string',
  groups: [],
  id: 'string',
  is_descendant_process: boolean,
  value: 'string'
)

response = api.update_ml_exclusions_v1(body)

puts response

Responses

[
  {
    "applied_globally": false,
    "created_by": "string",
    "created_on": "string",
    "excluded_from": [],
    "groups": [],
    "id": "string",
    "last_modified": "string",
    "modified_by": "string",
    "regexp_value": "string",
    "value": "string",
    "value_hash": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "applied_globally": false,
      "created_by": "string",
      "created_on": "string",
      "excluded_from": [],
      "groups": [],
      "id": "string",
      "last_modified": "string",
      "modified_by": "string",
      "regexp_value": "string",
      "value": "string",
      "value_hash": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "applied_globally": false,
      "created_by": "string",
      "created_on": "string",
      "excluded_from": [],
      "groups": [],
      "id": "string",
      "last_modified": "string",
      "modified_by": "string",
      "regexp_value": "string",
      "value": "string",
      "value_hash": "string"
    }
  ]
}

ML Exclusions

Table of Contents

createMLExclusionsV1

Parameters

deleteMLExclusionsV1

Parameters

exclusions.aggregates.v2

Parameters

exclusions.create.v2

Parameters

exclusions.delete.v2

Parameters

exclusions.get-all.v2

exclusions.get-reports.v2

Parameters

exclusions.get.v2

Parameters

exclusions.perform-action.v2

Parameters

exclusions.sdmf-query.v1

Parameters

exclusions.search.v2

Parameters

exclusions.update.v2

Parameters

getMLExclusionsV1

Parameters

queryMLExclusionsV1

Parameters

updateMLExclusionsV1

Parameters