MSSP (Flight Control)

The MSSP (Flight Control) service collection provides operations for managing multi-tenant CrowdStrike environments. Manage child customer relationships, CID groups, user groups, role assignments, and query across your fleet.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

This service collection has code examples posted to the repository.

For examples on how to authenticate to a child tenant as a MSSP, please review the MSSP authentication examples.

Operation	Description
addCIDGroupMembers `add_cid_group_members`	Add new CID group member.
addRole `add_role`	Create a link between user group and CID group, with zero or more additional roles.
addUserGroupMembers `add_user_group_members`	Add new user group member.
createCIDGroups `create_cid_groups`	Create new CID groups.
createUserGroups `create_user_groups`	Create new user groups.
deleteCIDGroupMembersV1 `delete_cid_group_members_v1`	Deprecated : Please use DELETE /entities/cid-group-members/v2. deprecated
deleteCIDGroupMembersV2 `delete_cid_group_members`	Delete CID group members.
deleteCIDGroups `delete_cid_groups`	Delete CID groups by ID.
deletedRoles `delete_roles`	Delete links or additional roles between user groups and CID groups.
deleteUserGroupMembers `delete_user_group_members`	Delete user group members entry.
deleteUserGroups `delete_user_groups`	Delete user groups by ID.
getChildren `get_children`	Get link to child customer by child CID(s)
getChildrenV2 `get_children_v2`	Get link to child customer by child CID(s)
getCIDGroupByIdV1 `get_cid_group_by_id_v1`	Deprecated : Please use GET /mssp/entities/cid-groups/v2. deprecated
getCIDGroupByIdV2 `get_cid_group_by_id`	Get CID Groups by ID.
getCIDGroupMembersByV1 `get_cid_group_members_by_v1`	Deprecated : Please use GET /mssp/entities/cid-group-members/v2. deprecated
getCIDGroupMembersByV2 `get_cid_group_members_by`	Get CID group members by CID Group ID.
getRolesByID `get_roles_by_id`	Get link between user group and CID group by ID.
getUserGroupMembersByIDV1 `get_user_group_members_by_id_v1`	Deprecated : Please use GET /mssp/entities/user-group-members/v2. deprecated
getUserGroupMembersByIDV2 `get_user_group_members_by_id`	Get user group members by user group ID.
getUserGroupsByIDV1 `get_user_groups_by_id_v1`	Deprecated : Please use GET /entities/user-groups/v2. deprecated
getUserGroupsByIDV2 `get_user_groups_by_id`	Get user groups by ID.
queryChildren `query_children`	Query for customers linked as children
queryCIDGroupMembers `query_cid_group_members`	Query a CID groups members by associated CID.
queryCIDGroups `query_cid_groups`	Query CID groups.
queryRoles `query_roles`	Query links between user groups and CID groups.
queryUserGroupMembers `query_user_group_members`	Query user group member by user UUID.
queryUserGroups `query_user_groups`	Query user groups.
updateCIDGroups `update_cid_groups`	Update existing CID groups.
updateUserGroups `update_user_groups`	Update existing user group(s).

addCIDGroupMembers

Add new CID group member.

Method POST

Route /mssp/entities/cid-group-members/v1

Scope Flight Control: WRITE

PEP 8 add_cid_group_members

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

cid_group_id body · string

ID of the CID group to update.

cids body · string or list of strings

CIDs to add to the group.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.add_cid_group_members(cid_group_id="string", cids=id_list)
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.addCIDGroupMembers(cid_group_id="string", cids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "resources": [
        {
            "cid_group_id": "string",
            "cids": ["string"]
        }
    ]
}

response = falcon.command("addCIDGroupMembers", body=body_payload)
print(response)

Add-FalconCidGroupMember -Id "string" -Cid @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cid_group_id := "string"

  response, err := client.Mssp.AddCIDGroupMembers(
    &mssp.AddCIDGroupMembersParams{
      Body: &models.DomainCIDGroupMembersRequestV1{
        Resources: []interface{}{
          {
          CIDGroupID: &cid_group_id,
          Cids: []string{"string"},
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.addCIDGroupMembers(
  {
    resources: [{
        cidGroupId: "string",
        cids: []
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::mssp_api::add_cid_group_members;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainCidGroupMembersRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainCidGroupMembersRequestV1 {
        resources: vec![CIDGroupMembers {
            cid_group_id: Some("string".to_string()),
            cids: vec!["string".to_string()],
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = add_cid_group_members(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

body = Falcon::DomainCIDGroupMembersRequestV1.new(
  resources: [{
      cid_group_id: 'string',
      cids: []
    }]
)

response = api.add_cid_group_members(body)

puts response

Responses

[
  {
    "cid_group_id": "string",
    "cids": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid_group_id": "string",
      "cids": []
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

addRole

Create a link between user group and CID group, with zero or more additional roles.

Method POST

Route /mssp/entities/mssp-roles/v1

Scope Flight Control: WRITE

PEP 8 add_role

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

cid_group_id body · string

CID Group ID.

id body · string

Role Assignment ID.

role_ids body · string or list of strings

Role IDs to be assigned.

user_group_ids body · string

User Group ID.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.add_role(cid_group_id="string",
                           id="string",
                           role_ids=id_list,
                           user_group_ids="string")
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.addRole(cid_group_id="string",
                          id="string",
                          role_ids=id_list,
                          user_group_ids="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "resources": [
        {
            "cid_group_id": "string",
            "id": "string",
            "role_ids": ["string"],
            "user_group_id": "string"
        }
    ]
}

response = falcon.command("addRole", body=body_payload)
print(response)

Add-FalconGroupRole -CidGroupId "string" `
  -UserGroupId "string" `
  -RoleId @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cid_group_id := "string"
  id := "string"
  user_group_id := "string"

  response, err := client.Mssp.AddRole(
    &mssp.AddRoleParams{
      Body: &models.DomainMSSPRoleRequestV1{
        Resources: []interface{}{
          {
          CIDGroupID: &cid_group_id,
          ID: &id,
          RoleIds: []string{"string"},
          UserGroupID: &user_group_id,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.addRole(
  {
    resources: [{
        cidGroupId: "string",
        id: "string",
        roleIds: [],
        userGroupId: "string"
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::mssp_api::add_role;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainMsspRoleRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainMsspRoleRequestV1 {
        resources: vec![MSSPRoles {
            cid_group_id: Some("string".to_string()),
            id: Some("string".to_string()),
            role_ids: vec!["string".to_string()],
            user_group_id: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = add_role(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

body = Falcon::DomainMSSPRoleRequestV1.new(
  resources: [{
      cid_group_id: 'string',
      id: 'string',
      role_ids: [],
      user_group_id: 'string'
    }]
)

response = api.add_role(body)

puts response

Responses

[
  {
    "cid_group_id": "string",
    "id": "string",
    "role_ids": [],
    "user_group_id": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid_group_id": "string",
      "id": "string",
      "role_ids": [],
      "user_group_id": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

addUserGroupMembers

Add new user group member.

Method POST

Route /mssp/entities/user-group-members/v1

Scope Flight Control: WRITE

PEP 8 add_user_group_members

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

user_group_ids body · string

User Group ID.

user_uuids body · string or list of strings

User UUIDs to assign to group.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.add_user_group_members(user_group_ids="string",
                                         user_uuids=id_list)
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.addUserGroupMembers(user_group_ids="string",
                                      user_uuids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "resources": [
        {
            "user_group_id": "string",
            "user_uuids": ["string"]
        }
    ]
}

response = falcon.command("addUserGroupMembers", body=body_payload)
print(response)

Add-FalconUserGroupMember -Id "string" -UserId @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  user_group_id := "string"

  response, err := client.Mssp.AddUserGroupMembers(
    &mssp.AddUserGroupMembersParams{
      Body: &models.DomainUserGroupMembersRequestV1{
        Resources: []interface{}{
          {
          UserGroupID: &user_group_id,
          UserUuids: []string{"string"},
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.addUserGroupMembers(
  {
    resources: [{
        userGroupId: "string",
        userUuids: []
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::mssp_api::add_user_group_members;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainUserGroupMembersRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainUserGroupMembersRequestV1 {
        resources: vec![UserGroupMembers {
            user_group_id: Some("string".to_string()),
            user_uuids: vec!["string".to_string()],
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = add_user_group_members(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

body = Falcon::DomainUserGroupMembersRequestV1.new(
  resources: [{
      user_group_id: 'string',
      user_uuids: []
    }]
)

response = api.add_user_group_members(body)

puts response

Responses

[
  {
    "user_group_id": "string",
    "user_uuids": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "user_group_id": "string",
      "user_uuids": []
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

createCIDGroups

Create new CID groups.

Method POST

Route /mssp/entities/cid-groups/v1

Scope Flight Control: WRITE

PEP 8 create_cid_groups

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

cid body · string

CID to initially add to the group.

cid_group_id body · string

CID Group ID.

description body · string

Description for the CID group.

name body · string

Name of the CID group.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.create_cid_groups(cid="string",
                                    cid_group_id="string",
                                    description="string",
                                    name="string")
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.createCIDGroups(cid="string",
                                  cid_group_id="string",
                                  description="string",
                                  name="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "cid": "string",
            "cid_group_id": "string",
            "description": "string",
            "is_default": boolean,
            "name": "string"
        }
    ]
}

response = falcon.command("createCIDGroups", body=body_payload)
print(response)

New-FalconCidGroup -Name "string" -Description "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cid := "string"
  cid_group_id := "string"
  description := "string"
  is_default := boolean
  name := "string"

  response, err := client.Mssp.CreateCIDGroups(
    &mssp.CreateCIDGroupsParams{
      Body: &models.DomainCIDGroupsRequestV1{
        Resources: []interface{}{
          {
          CID: &cid,
          CIDGroupID: &cid_group_id,
          Description: &description,
          IsDefault: &is_default,
          Name: &name,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.createCIDGroups(
  {
    resources: [{
        cid: "string",
        cidGroupId: "string",
        description: "string",
        isDefault: boolean,
        name: "string"
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::mssp_api::create_cid_groups;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainCidGroupsRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainCidGroupsRequestV1 {
        resources: vec![CIDGroup {
            cid_group_id: Some("string".to_string()),
            name: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = create_cid_groups(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

body = Falcon::DomainCIDGroupsRequestV1.new(
  resources: [{
      cid: 'string',
      cid_group_id: 'string',
      description: 'string',
      is_default: boolean,
      name: 'string'
    }]
)

response = api.create_cid_groups(body)

puts response

Responses

[
  {
    "cid": "string",
    "cid_group_id": "string",
    "description": "string",
    "is_default": false,
    "name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "cid_group_id": "string",
      "description": "string",
      "is_default": false,
      "name": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

createUserGroups

Create new user groups.

Method POST

Route /mssp/entities/user-groups/v1

Scope Flight Control: WRITE

PEP 8 create_user_groups

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

cid body · string

CID to initially add to the group.

description body · string

Description for the CID group.

name body · string

Name of the CID group.

user_group_id body · string

User Group ID.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.create_user_groups(cid="string",
                                     description="string",
                                     name="string",
                                     user_group_id="string")
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.createUserGroups(cid="string",
                                   description="string",
                                   name="string",
                                   user_group_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "cid": "string",
            "description": "string",
            "name": "string",
            "user_group_id": "string"
        }
    ]
}

response = falcon.command("createUserGroups", body=body_payload)
print(response)

New-FalconUserGroup -Name "string" -Description "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cid := "string"
  description := "string"
  name := "string"
  user_group_id := "string"

  response, err := client.Mssp.CreateUserGroups(
    &mssp.CreateUserGroupsParams{
      Body: &models.DomainUserGroupsRequestV1{
        Resources: []interface{}{
          {
          CID: &cid,
          Description: &description,
          Name: &name,
          UserGroupID: &user_group_id,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.createUserGroups(
  {
    resources: [{
        cid: "string",
        description: "string",
        name: "string",
        userGroupId: "string"
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::mssp_api::create_user_groups;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainUserGroupsRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainUserGroupsRequestV1 {
        resources: vec![UserGroup {
            description: Some("string".to_string()),
            name: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = create_user_groups(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

body = Falcon::DomainUserGroupsRequestV1.new(
  resources: [{
      cid: 'string',
      description: 'string',
      name: 'string',
      user_group_id: 'string'
    }]
)

response = api.create_user_groups(body)

puts response

Responses

[
  {
    "cid": "string",
    "description": "string",
    "name": "string",
    "user_group_id": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "description": "string",
      "name": "string",
      "user_group_id": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

deleteCIDGroupMembersV1

Deprecated : Please use DELETE /entities/cid-group-members/v2.

Method DELETE

Route /mssp/entities/cid-group-members/v1

Scope Flight Control: WRITE

PEP 8 delete_cid_group_members_v1

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

cid_group_id body · string

ID of the CID group to update.

cids body · string or list of strings

CIDs to remove from the group.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_cid_group_members_v1(cid_group_id="string",
                                              cids=id_list)
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteCIDGroupMembersV1(cid_group_id="string", cids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "resources": [
        {
            "cid_group_id": "string",
            "cids": ["string"]
        }
    ]
}

response = falcon.command("deleteCIDGroupMembersV1", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cid_group_id := "string"

  response, err := client.Mssp.DeleteCIDGroupMembers(
    &mssp.DeleteCIDGroupMembersParams{
      Body: &models.DomainCIDGroupMembersRequestV1{
        Resources: []interface{}{
          {
          CIDGroupID: &cid_group_id,
          Cids: []string{"string"},
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.deleteCIDGroupMembers(
  {
    resources: [{
        cidGroupId: "string",
        cids: []
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::mssp_api::delete_cid_group_members;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainCidGroupMembersRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainCidGroupMembersRequestV1 {
        resources: vec![CIDGroupMembers {
            cid_group_id: Some("string".to_string()),
            cids: vec!["string".to_string()],
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = delete_cid_group_members(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

body = Falcon::DomainCIDGroupMembersRequestV1.new(
  resources: [{
      cid_group_id: 'string',
      cids: []
    }]
)

response = api.delete_cid_group_members(body)

puts response

Responses

[
  {
    "cid_group_id": "string",
    "cids": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid_group_id": "string",
      "cids": []
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

deleteCIDGroupMembersV2

Delete CID group members.

Method DELETE

Route /mssp/entities/cid-group-members/v2

Scope Flight Control: WRITE

PEP 8 delete_cid_group_members

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

cid_group_id body · string

ID of the CID group to update.

cids body · string or list of strings

CIDs to remove from the group.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_cid_group_members(cid_group_id="string", cids=id_list)
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteCIDGroupMembersV2(cid_group_id="string", cids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "resources": [
        {
            "cid_group_id": "string",
            "cids": ["string"]
        }
    ]
}

response = falcon.command("deleteCIDGroupMembersV2", body=body_payload)
print(response)

Remove-FalconCidGroupMember -Id "string" -Cid @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cid_group_id := "string"

  response, err := client.Mssp.DeleteCIDGroupMembersV2(
    &mssp.DeleteCIDGroupMembersV2Params{
      Body: &models.DomainCIDGroupMembersRequestV1{
        Resources: []interface{}{
          {
          CIDGroupID: &cid_group_id,
          Cids: []string{"string"},
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.deleteCIDGroupMembersV2(
  {
    resources: [{
        cidGroupId: "string",
        cids: []
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::mssp_api::delete_cid_group_members_v2;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainCidGroupMembersRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainCidGroupMembersRequestV1 {
        resources: vec![CIDGroupMembers {
            cid_group_id: Some("string".to_string()),
            cids: vec!["string".to_string()],
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = delete_cid_group_members_v2(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

body = Falcon::DomainCIDGroupMembersRequestV1.new(
  resources: [{
      cid_group_id: 'string',
      cids: []
    }]
)

response = api.delete_cid_group_members_v2(body)

puts response

Responses

[
  {
    "cid_group_id": "string",
    "cids": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid_group_id": "string",
      "cids": []
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

deleteCIDGroups

Delete CID groups by ID.

Method DELETE

Route /mssp/entities/cid-groups/v1

Scope Flight Control: WRITE

PEP 8 delete_cid_groups

Parameters

cid_group_ids query · string or list of strings

CID group ids to delete

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_cid_groups(cid_group_ids=id_list)
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteCIDGroups(cid_group_ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deleteCIDGroups",
                          cid_group_ids=id_list)
print(response)

Remove-FalconCidGroup -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Mssp.DeleteCIDGroups(
    &mssp.DeleteCIDGroupsParams{
      CidGroupIds: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.deleteCIDGroups(["ID1", "ID2", "ID3"]);  // cidGroupIds

console.log(response);

use rusty_falcon::apis::mssp_api::delete_cid_groups;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_cid_groups(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // cid_group_ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

response = api.delete_cid_groups(['ID1', 'ID2', 'ID3'])

puts response

Responses

{}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

deletedRoles

Delete links or additional roles between user groups and CID groups.

Method DELETE

Route /mssp/entities/mssp-roles/v1

Scope Flight Control: WRITE

PEP 8 delete_roles

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

cid_group_id body · string

CID Group ID.

id body · string

Role Assignment ID.

role_ids body · string or list of strings

Role IDs to be assigned.

user_group_ids body · string

User Group ID.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_roles(cid_group_id="string",
                               id="string",
                               role_ids=id_list,
                               user_group_ids="string")
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deletedRoles(cid_group_id="string",
                               id="string",
                               role_ids=id_list,
                               user_group_ids="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "resources": [
        {
            "cid_group_id": "string",
            "id": "string",
            "role_ids": ["string"],
            "user_group_id": "string"
        }
    ]
}

response = falcon.command("deletedRoles", body=body_payload)
print(response)

Remove-FalconGroupRole -CidGroupId "string" -UserGroupId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cid_group_id := "string"
  id := "string"
  user_group_id := "string"

  response, err := client.Mssp.DeletedRoles(
    &mssp.DeletedRolesParams{
      Body: &models.DomainMSSPRoleRequestV1{
        Resources: []interface{}{
          {
          CIDGroupID: &cid_group_id,
          ID: &id,
          RoleIds: []string{"string"},
          UserGroupID: &user_group_id,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.deletedRoles(
  {
    resources: [{
        cidGroupId: "string",
        id: "string",
        roleIds: [],
        userGroupId: "string"
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::mssp_api::deleted_roles;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainMsspRoleRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainMsspRoleRequestV1 {
        resources: vec![MSSPRoles {
            cid_group_id: Some("string".to_string()),
            id: Some("string".to_string()),
            role_ids: vec!["string".to_string()],
            user_group_id: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = deleted_roles(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

body = Falcon::DomainMSSPRoleRequestV1.new(
  resources: [{
      cid_group_id: 'string',
      id: 'string',
      role_ids: [],
      user_group_id: 'string'
    }]
)

response = api.deleted_roles(body)

puts response

Responses

[
  {
    "cid_group_id": "string",
    "id": "string",
    "role_ids": [],
    "user_group_id": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid_group_id": "string",
      "id": "string",
      "role_ids": [],
      "user_group_id": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

deleteUserGroupMembers

Delete user group members entry.

Method DELETE

Route /mssp/entities/user-group-members/v1

Scope Flight Control: WRITE

PEP 8 delete_user_group_members

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

user_group_ids body · string

User Group ID.

user_uuids body · string or list of strings

User UUIDs to remove from group.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_user_group_members(user_group_ids="string",
                                            user_uuids=id_list)
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteUserGroupMembers(user_group_ids="string",
                                         user_uuids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "resources": [
        {
            "user_group_id": "string",
            "user_uuids": ["string"]
        }
    ]
}

response = falcon.command("deleteUserGroupMembers", body=body_payload)
print(response)

Remove-FalconUserGroupMember -Id "string" -UserId @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  user_group_id := "string"

  response, err := client.Mssp.DeleteUserGroupMembers(
    &mssp.DeleteUserGroupMembersParams{
      Body: &models.DomainUserGroupMembersRequestV1{
        Resources: []interface{}{
          {
          UserGroupID: &user_group_id,
          UserUuids: []string{"string"},
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.deleteUserGroupMembers(
  {
    resources: [{
        userGroupId: "string",
        userUuids: []
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::mssp_api::delete_user_group_members;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainUserGroupMembersRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainUserGroupMembersRequestV1 {
        resources: vec![UserGroupMembers {
            user_group_id: Some("string".to_string()),
            user_uuids: vec!["string".to_string()],
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = delete_user_group_members(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

body = Falcon::DomainUserGroupMembersRequestV1.new(
  resources: [{
      user_group_id: 'string',
      user_uuids: []
    }]
)

response = api.delete_user_group_members(body)

puts response

Responses

[
  {
    "user_group_id": "string",
    "user_uuids": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "user_group_id": "string",
      "user_uuids": []
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

deleteUserGroups

Delete user groups by ID.

Method DELETE

Route /mssp/entities/user-groups/v1

Scope Flight Control: WRITE

PEP 8 delete_user_groups

Parameters

user_group_ids query · string or list of strings

User group IDs to delete

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_user_groups(user_group_ids=id_list)
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteUserGroups(user_group_ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deleteUserGroups",
                          user_group_ids=id_list)
print(response)

Remove-FalconUserGroup -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Mssp.DeleteUserGroups(
    &mssp.DeleteUserGroupsParams{
      UserGroupIds: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.deleteUserGroups(["ID1", "ID2", "ID3"]);  // userGroupIds

console.log(response);

use rusty_falcon::apis::mssp_api::delete_user_groups;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_user_groups(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // user_group_ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

response = api.delete_user_groups(['ID1', 'ID2', 'ID3'])

puts response

Responses

{}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

getChildren

Get link to child customer by child CID(s)

Method GET

Route /mssp/entities/children/v1

Scope Flight Control: READ

PEP 8 get_children

Parameters

ids query · string or list of strings

CID of a child customer

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_children(ids=id_list)
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getChildren(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getChildren",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Mssp.GetChildren(
    &mssp.GetChildrenParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.getChildren(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::mssp_api::get_children;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_children(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

response = api.get_children(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "checksum": "string",
    "child_cid": "string",
    "child_gcid": "string",
    "child_of": "string",
    "domains": [],
    "name": "string",
    "status": "string"
  }
]

{
  "MsaReplyMetaOnly": {
    "errors": [],
    "meta": {
      "pagination": {},
      "powered_by": "string",
      "query_time": 0.0,
      "trace_id": "string",
      "writes": {}
    }
  },
  "resources": [
    {
      "checksum": "string",
      "child_cid": "string",
      "child_gcid": "string",
      "child_of": "string",
      "domains": [],
      "name": "string",
      "status": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

getChildrenV2

Get link to child customer by child CID(s)

Method POST

Route /mssp/entities/children/GET/v2

Scope Flight Control: READ

PEP 8 get_children_v2

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

ids body · array

ID(s) of the indicator entities to retrieve.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_children_v2(ids=id_list)
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getChildrenV2(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "ids": ["string"]
}

response = falcon.command("getChildrenV2", body=body_payload)
print(response)

Get-FalconMemberCid -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Mssp.GetChildrenV2(
    &mssp.GetChildrenV2Params{
      Body: &models.MsaspecIdsRequest{
        Ids: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.getChildrenV2(
  {
    ids: []
}  // body
);

console.log(response);

use rusty_falcon::apis::mssp_api::get_children_v2;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaspecIdsRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaspecIdsRequest {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = get_children_v2(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

body = Falcon::MsaspecIdsRequest.new(
  ids: []
)

response = api.get_children_v2(body)

puts response

Responses

[
  {
    "checksum": "string",
    "child_cid": "string",
    "child_gcid": "string",
    "child_of": "string",
    "domains": [],
    "name": "string",
    "status": "string"
  }
]

{
  "MsaReplyMetaOnly": {
    "errors": [],
    "meta": {
      "pagination": {},
      "powered_by": "string",
      "query_time": 0.0,
      "trace_id": "string",
      "writes": {}
    }
  },
  "resources": [
    {
      "checksum": "string",
      "child_cid": "string",
      "child_gcid": "string",
      "child_of": "string",
      "domains": [],
      "name": "string",
      "status": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

getCIDGroupByIdV1

Deprecated : Please use GET /mssp/entities/cid-groups/v2.

Method GET

Route /mssp/entities/cid-groups/v1

Scope Flight Control: READ

PEP 8 get_cid_group_by_id_v1

Parameters

cid_group_ids query · string or list of strings

CID group IDs to be searched on

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_cid_group_by_id_v1(cid_group_ids=id_list)
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getCIDGroupByIdV1(cid_group_ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getCIDGroupByIdV1",
                          cid_group_ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Mssp.GetCIDGroupByID(
    &mssp.GetCIDGroupByIDParams{
      CidGroupIds: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.getCIDGroupById(["ID1", "ID2", "ID3"]);  // cidGroupIds

console.log(response);

use rusty_falcon::apis::mssp_api::get_cid_group_by_id;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_cid_group_by_id(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // cid_group_ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

response = api.get_cid_group_by_id(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "cid": "string",
    "cid_group_id": "string",
    "description": "string",
    "is_default": false,
    "name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "cid_group_id": "string",
      "description": "string",
      "is_default": false,
      "name": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

getCIDGroupByIdV2

Get CID Groups by ID.

Method GET

Route /mssp/entities/cid-groups/v2

Scope Flight Control: READ

PEP 8 get_cid_group_by_id

Parameters

ids query · string or list of strings

CID group IDs to search for

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_cid_group_by_id(ids=id_list)
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getCIDGroupByIdV2(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getCIDGroupByIdV2",
                          ids=id_list)
print(response)

Get-FalconCidGroup -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Mssp.GetCIDGroupByIDV2(
    &mssp.GetCIDGroupByIDV2Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.getCIDGroupByIdV2(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::mssp_api::get_cid_group_by_id_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_cid_group_by_id_v2(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

response = api.get_cid_group_by_id_v2(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "cid": "string",
    "cid_group_id": "string",
    "description": "string",
    "is_default": false,
    "name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "cid_group_id": "string",
      "description": "string",
      "is_default": false,
      "name": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

getCIDGroupMembersByV1

Deprecated : Please use GET /mssp/entities/cid-group-members/v2.

Method GET

Route /mssp/entities/cid-group-members/v1

Scope Flight Control: READ

PEP 8 get_cid_group_members_by_v1

Parameters

cid_group_ids query · string or list of strings

CID group IDs to search for

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_cid_group_members_by_v1(cid_group_ids=id_list)
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getCIDGroupMembersByV1(cid_group_ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getCIDGroupMembersByV1",
                          cid_group_ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Mssp.GetCIDGroupMembersBy(
    &mssp.GetCIDGroupMembersByParams{
      CidGroupIds: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.getCIDGroupMembersBy(["ID1", "ID2", "ID3"]);  // cidGroupIds

console.log(response);

use rusty_falcon::apis::mssp_api::get_cid_group_members_by;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_cid_group_members_by(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // cid_group_ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

response = api.get_cid_group_members_by(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "cid_group_id": "string",
    "cids": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid_group_id": "string",
      "cids": []
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

getCIDGroupMembersByV2

Get CID group members by CID Group ID.

Method GET

Route /mssp/entities/cid-group-members/v2

Scope Flight Control: READ

PEP 8 get_cid_group_members_by

Parameters

ids query · string or list of strings

CID group IDs search for

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_cid_group_members_by(ids=id_list)
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getCIDGroupMembersByV2(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getCIDGroupMembersByV2",
                          ids=id_list)
print(response)

Get-FalconCidGroupMember -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Mssp.GetCIDGroupMembersByV2(
    &mssp.GetCIDGroupMembersByV2Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.getCIDGroupMembersByV2(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::mssp_api::get_cid_group_members_by_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_cid_group_members_by_v2(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

response = api.get_cid_group_members_by_v2(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "cid_group_id": "string",
    "cids": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid_group_id": "string",
      "cids": []
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

getRolesByID

Get link between user group and CID group by ID.

Method GET

Route /mssp/entities/mssp-roles/v1

Scope Flight Control: READ

PEP 8 get_roles_by_id

Parameters

ids query · string or list of strings

Link ID is a string consisting of multiple components, but should be treated as opaque.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_roles_by_id(ids=id_list)
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getRolesByID(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getRolesByID",
                          ids=id_list)
print(response)

Get-FalconGroupRole -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Mssp.GetRolesByID(
    &mssp.GetRolesByIDParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.getRolesByID(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::mssp_api::get_roles_by_id;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_roles_by_id(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

response = api.get_roles_by_id(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "cid_group_id": "string",
    "id": "string",
    "role_ids": [],
    "user_group_id": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid_group_id": "string",
      "id": "string",
      "role_ids": [],
      "user_group_id": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

getUserGroupMembersByIDV1

Deprecated : Please use GET /mssp/entities/user-group-members/v2.

Method GET

Route /mssp/entities/user-group-members/v1

Scope Flight Control: READ

PEP 8 get_user_group_members_by_id_v1

Parameters

user_group_ids query · string or list of strings

User group IDs to search for

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_user_group_members_by_id_v1(user_group_ids=id_list)
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getUserGroupMembersByIDV1(user_group_ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getUserGroupMembersByIDV1",
                          user_group_ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Mssp.GetUserGroupMembersByID(
    &mssp.GetUserGroupMembersByIDParams{
      UserGroupIds: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.getUserGroupMembersByID(["ID1", "ID2", "ID3"]);  // userGroupIds

console.log(response);

use rusty_falcon::apis::mssp_api::get_user_group_members_by_id;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_user_group_members_by_id(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // user_group_ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

response = api.get_user_group_members_by_id(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "user_group_id": "string",
    "user_uuids": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "user_group_id": "string",
      "user_uuids": []
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

getUserGroupMembersByIDV2

Get user group members by user group ID.

Method GET

Route /mssp/entities/user-group-members/v2

Scope Flight Control: READ

PEP 8 get_user_group_members_by_id

Parameters

ids query · string or list of strings

User group IDs to search for

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_user_group_members_by_id(ids=id_list)
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getUserGroupMembersByIDV2(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getUserGroupMembersByIDV2",
                          ids=id_list)
print(response)

Get-FalconUserGroupMember -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Mssp.GetUserGroupMembersByIDV2(
    &mssp.GetUserGroupMembersByIDV2Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.getUserGroupMembersByIDV2(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::mssp_api::get_user_group_members_by_idv2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_user_group_members_by_idv2(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

response = api.get_user_group_members_by_idv2(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "user_group_id": "string",
    "user_uuids": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "user_group_id": "string",
      "user_uuids": []
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

getUserGroupsByIDV1

Deprecated : Please use GET /entities/user-groups/v2.

Method GET

Route /mssp/entities/user-groups/v1

Scope Flight Control: READ

PEP 8 get_user_groups_by_id_v1

Parameters

user_group_ids query · string or list of strings

User Group IDs to search for

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_user_groups_by_id_v1(user_group_ids=id_list)
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getUserGroupsByIDV1(user_group_ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getUserGroupsByIDV1",
                          user_group_ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Mssp.GetUserGroupsByID(
    &mssp.GetUserGroupsByIDParams{
      UserGroupIds: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.getUserGroupsByID(["ID1", "ID2", "ID3"]);  // userGroupIds

console.log(response);

use rusty_falcon::apis::mssp_api::get_user_groups_by_id;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_user_groups_by_id(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // user_group_ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

response = api.get_user_groups_by_id(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "cid": "string",
    "description": "string",
    "name": "string",
    "user_group_id": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "description": "string",
      "name": "string",
      "user_group_id": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

getUserGroupsByIDV2

Get user groups by ID.

Method GET

Route /mssp/entities/user-groups/v2

Scope Flight Control: READ

PEP 8 get_user_groups_by_id

Parameters

ids query · string or list of strings

User group IDs to search for

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_user_groups_by_id(ids=id_list)
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getUserGroupsByIDV2(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getUserGroupsByIDV2",
                          ids=id_list)
print(response)

Get-FalconUserGroup -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Mssp.GetUserGroupsByIDV2(
    &mssp.GetUserGroupsByIDV2Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.getUserGroupsByIDV2(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::mssp_api::get_user_groups_by_idv2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_user_groups_by_idv2(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

response = api.get_user_groups_by_idv2(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "cid": "string",
    "description": "string",
    "name": "string",
    "user_group_id": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "description": "string",
      "name": "string",
      "user_group_id": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

queryChildren

Query for customers linked as children

Method GET

Route /mssp/queries/children/v1

Scope Flight Control: READ

PEP 8 query_children

Parameters

filter query · string

Filter using a query in Falcon Query Language (FQL). Supported filters:

Available values (1)

cid

sort query · string

The property to sort by. (Ex: last_modified_timestamp|desc)

Available values (2)

last_modified_timestamp|asc last_modified_timestamp|desc

offset query · integer

Starting index of overall result set from which to return ids

limit query · integer

Number of ids to return

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.query_children(filter="string",
                                 limit=integer,
                                 offset=integer,
                                 sort="string")
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.queryChildren(filter="string",
                                limit=integer,
                                offset=integer,
                                sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryChildren",
                          filter="string",
                          sort="string",
                          offset=integer,
                          limit=integer)
print(response)

Get-FalconMemberCid -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  offset := int64(0)
  limit := int64(0)

  response, err := client.Mssp.QueryChildren(
    &mssp.QueryChildrenParams{
      Filter: &filter,
      Sort: &sort,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.queryChildren(
  "string",  // filter
  "string",  // sort
  integer,  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::mssp_api::query_children;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_children(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

response = api.query_children(filter: 'string',
                              sort: 'string',
                              offset: integer,
                              limit: integer)

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

queryCIDGroupMembers

Query a CID groups members by associated CID.

Method GET

Route /mssp/queries/cid-group-members/v1

Scope Flight Control: READ

PEP 8 query_cid_group_members

Parameters

cid query · string

CID to lookup associated CID group ID

sort query · string

The property to sort by. (Ex: last_modified_timestamp|desc)

Available values (2)

last_modified_timestamp|asc last_modified_timestamp|desc

offset query · integer

Starting index of overall result set from which to return id

limit query · integer

Maximum number of results to return

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.query_cid_group_members(cid="string",
                                          limit=integer,
                                          offset=integer,
                                          sort="string")
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.queryCIDGroupMembers(cid="string",
                                       limit=integer,
                                       offset=integer,
                                       sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryCIDGroupMembers",
                          cid="string",
                          sort="string",
                          offset=integer,
                          limit=integer)
print(response)

Get-FalconCidGroupMember -Cid "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  sort := "string"
  offset := int64(0)
  limit := int64(0)

  response, err := client.Mssp.QueryCIDGroupMembers(
    &mssp.QueryCIDGroupMembersParams{
      Cid: "string",
      Sort: &sort,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.queryCIDGroupMembers(
  "string",  // cid
  "string",  // sort
  integer,  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::mssp_api::query_cid_group_members;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_cid_group_members(
        &falcon.cfg,  // configuration
        "string",  // cid
        Some("string"),  // sort
        Some(integer),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

response = api.query_cid_group_members('string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

queryCIDGroups

Query CID groups.

Method GET

Route /mssp/queries/cid-groups/v1

Scope Flight Control: READ

PEP 8 query_cid_groups

Parameters

name query · string

Name to lookup groups for

sort query · string

The property to sort by. (Ex: last_modified_timestamp|desc)

Available values (4)

`last_modified_timestamp\|asc`	`last_modified_timestamp\|desc`	`name\|asc`
`name\|desc`

offset query · integer

Starting index of overall result set from which to return ids

limit query · integer

Maximum number of results to return

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.query_cid_groups(name="string",
                                   limit=integer,
                                   offset=integer,
                                   sort="string")
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.queryCIDGroups(name="string",
                                 limit=integer,
                                 offset=integer,
                                 sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryCIDGroups",
                          name="string",
                          sort="string",
                          offset=integer,
                          limit=integer)
print(response)

Get-FalconCidGroup -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"
  sort := "string"
  offset := int64(0)
  limit := int64(0)

  response, err := client.Mssp.QueryCIDGroups(
    &mssp.QueryCIDGroupsParams{
      Name: &name,
      Sort: &sort,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.queryCIDGroups(
  "string",  // name
  "string",  // sort
  integer,  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::mssp_api::query_cid_groups;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_cid_groups(
        &falcon.cfg,  // configuration
        Some("string"),  // name
        Some("string"),  // sort
        Some(integer),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

response = api.query_cid_groups(name: 'string',
                                sort: 'string',
                                offset: integer,
                                limit: integer)

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

queryRoles

Query links between user groups and CID groups.

Method GET

Route /mssp/queries/mssp-roles/v1

Scope Flight Control: READ

PEP 8 query_roles

Parameters

user_group_id query · string

User group ID to fetch MSSP role for

cid_group_id query · string

CID group ID to fetch MSSP role for

role_id query · string

Role ID to fetch MSSP role for

sort query · string

The property to sort by. (Ex: last_modified_timestamp|desc)

Available values (2)

last_modified_timestamp|asc last_modified_timestamp|desc

offset query · integer

Starting index of overall result set from which to return ids

limit query · integer

Maximum number of results to return

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.query_roles(user_group_id="string",
                              cid_group_id="string",
                              role_id="string",
                              limit=integer,
                              offset=integer,
                              sort="string")
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.queryRoles(user_group_id="string",
                             cid_group_id="string",
                             role_id="string",
                             limit=integer,
                             offset=integer,
                             sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryRoles",
                          user_group_id="string",
                          cid_group_id="string",
                          role_id="string",
                          sort="string",
                          offset=integer,
                          limit=integer)
print(response)

Get-FalconGroupRole -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  userGroupID := "string"
  cidGroupID := "string"
  roleID := "string"
  sort := "string"
  offset := int64(0)
  limit := int64(0)

  response, err := client.Mssp.QueryRoles(
    &mssp.QueryRolesParams{
      UserGroupID: &userGroupID,
      CidGroupID: &cidGroupID,
      RoleID: &roleID,
      Sort: &sort,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.queryRoles(
  "string",  // userGroupId
  "string",  // cidGroupId
  "string",  // roleId
  "string",  // sort
  integer,  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::mssp_api::query_roles;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_roles(
        &falcon.cfg,  // configuration
        Some("string"),  // user_group_id
        Some("string"),  // cid_group_id
        Some("string"),  // role_id
        Some("string"),  // sort
        Some(integer),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

response = api.query_roles(user_group_id: 'string',
                           cid_group_id: 'string',
                           role_id: 'string',
                           sort: 'string',
                           offset: integer,
                           limit: integer)

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

queryUserGroupMembers

Query user group member by user UUID.

Method GET

Route /mssp/queries/user-group-members/v1

Scope Flight Control: READ

PEP 8 query_user_group_members

Parameters

user_uuid query · string

User UUID to lookup associated user group ID

sort query · string

The property to sort by. (Ex: last_modified_timestamp|desc)

Available values (2)

last_modified_timestamp|asc last_modified_timestamp|desc

offset query · integer

Starting index of overall result set from which to return ids

limit query · integer

Number of ids to return

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.query_user_group_members(user_uuid="string",
                                           limit=integer,
                                           offset=integer,
                                           sort="string")
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.queryUserGroupMembers(user_uuid="string",
                                        limit=integer,
                                        offset=integer,
                                        sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryUserGroupMembers",
                          user_uuid="string",
                          sort="string",
                          offset=integer,
                          limit=integer)
print(response)

Get-FalconUserGroupMember -UserId "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  sort := "string"
  offset := int64(0)
  limit := int64(0)

  response, err := client.Mssp.QueryUserGroupMembers(
    &mssp.QueryUserGroupMembersParams{
      UserUUID: "string",
      Sort: &sort,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.queryUserGroupMembers(
  "string",  // userUuid
  "string",  // sort
  integer,  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::mssp_api::query_user_group_members;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_user_group_members(
        &falcon.cfg,  // configuration
        "string",  // user_uuid
        Some("string"),  // sort
        Some(integer),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

response = api.query_user_group_members('string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

queryUserGroups

Query user groups.

Method GET

Route /mssp/queries/user-groups/v1

Scope Flight Control: READ

PEP 8 query_user_groups

Parameters

name query · string

Name to lookup groups for

sort query · string

The property to sort by. (Ex: last_modified_timestamp|desc)

Available values (4)

`last_modified_timestamp\|asc`	`last_modified_timestamp\|desc`	`name\|asc`
`name\|desc`

offset query · integer

Starting index of overall result set from which to return ids

limit query · integer

Maximum number of results to return

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.query_user_groups(name="string",
                                    limit=integer,
                                    offset=integer,
                                    sort="string")
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.queryUserGroups(name="string",
                                  limit=integer,
                                  offset=integer,
                                  sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryUserGroups",
                          name="string",
                          sort="string",
                          offset=integer,
                          limit=integer)
print(response)

Get-FalconUserGroup -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"
  sort := "string"
  offset := int64(0)
  limit := int64(0)

  response, err := client.Mssp.QueryUserGroups(
    &mssp.QueryUserGroupsParams{
      Name: &name,
      Sort: &sort,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.queryUserGroups(
  "string",  // name
  "string",  // sort
  integer,  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::mssp_api::query_user_groups;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_user_groups(
        &falcon.cfg,  // configuration
        Some("string"),  // name
        Some("string"),  // sort
        Some(integer),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

response = api.query_user_groups(name: 'string',
                                 sort: 'string',
                                 offset: integer,
                                 limit: integer)

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

updateCIDGroups

Update existing CID groups.

Method PATCH

Route /mssp/entities/cid-groups/v1

Scope Flight Control: WRITE

PEP 8 update_cid_groups

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

cid body · string

CID to initially add to the group.

cid_group_id body · string

CID Group ID.

description body · string

Description for the CID group.

name body · string

Name of the CID group.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.update_cid_groups(cid="string",
                                    cid_group_id="string",
                                    description="string",
                                    name="string")
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.updateCIDGroups(cid="string",
                                  cid_group_id="string",
                                  description="string",
                                  name="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "cid": "string",
            "cid_group_id": "string",
            "description": "string",
            "is_default": boolean,
            "name": "string"
        }
    ]
}

response = falcon.command("updateCIDGroups", body=body_payload)
print(response)

Edit-FalconCidGroup -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cid := "string"
  cid_group_id := "string"
  description := "string"
  is_default := boolean
  name := "string"

  response, err := client.Mssp.UpdateCIDGroups(
    &mssp.UpdateCIDGroupsParams{
      Body: &models.DomainCIDGroupsRequestV1{
        Resources: []interface{}{
          {
          CID: &cid,
          CIDGroupID: &cid_group_id,
          Description: &description,
          IsDefault: &is_default,
          Name: &name,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.updateCIDGroups(
  {
    resources: [{
        cid: "string",
        cidGroupId: "string",
        description: "string",
        isDefault: boolean,
        name: "string"
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::mssp_api::update_cid_groups;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainCidGroupsRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainCidGroupsRequestV1 {
        resources: vec![CIDGroup {
            cid_group_id: Some("string".to_string()),
            name: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = update_cid_groups(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

body = Falcon::DomainCIDGroupsRequestV1.new(
  resources: [{
      cid: 'string',
      cid_group_id: 'string',
      description: 'string',
      is_default: boolean,
      name: 'string'
    }]
)

response = api.update_cid_groups(body)

puts response

Responses

[
  {
    "cid": "string",
    "cid_group_id": "string",
    "description": "string",
    "is_default": false,
    "name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "cid_group_id": "string",
      "description": "string",
      "is_default": false,
      "name": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

updateUserGroups

Update existing user group(s).

Method PATCH

Route /mssp/entities/user-groups/v1

Scope Flight Control: WRITE

PEP 8 update_user_groups

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

cid body · string

CID to initially add to the group.

description body · string

Description for the CID group.

name body · string

Name of the CID group.

user_group_id body · string

User Group ID to update.

Code Examples

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.update_user_groups(cid="string",
                                     description="string",
                                     name="string",
                                     user_group_id="string")
print(response)

from falconpy import FlightControl

falcon = FlightControl(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.updateUserGroups(cid="string",
                                   description="string",
                                   name="string",
                                   user_group_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "cid": "string",
            "description": "string",
            "name": "string",
            "user_group_id": "string"
        }
    ]
}

response = falcon.command("updateUserGroups", body=body_payload)
print(response)

Edit-FalconUserGroup -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/mssp"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cid := "string"
  description := "string"
  name := "string"
  user_group_id := "string"

  response, err := client.Mssp.UpdateUserGroups(
    &mssp.UpdateUserGroupsParams{
      Body: &models.DomainUserGroupsRequestV1{
        Resources: []interface{}{
          {
          CID: &cid,
          Description: &description,
          Name: &name,
          UserGroupID: &user_group_id,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.mssp.updateUserGroups(
  {
    resources: [{
        cid: "string",
        description: "string",
        name: "string",
        userGroupId: "string"
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::mssp_api::update_user_groups;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainUserGroupsRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainUserGroupsRequestV1 {
        resources: vec![UserGroup {
            description: Some("string".to_string()),
            name: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = update_user_groups(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Mssp.new

body = Falcon::DomainUserGroupsRequestV1.new(
  resources: [{
      cid: 'string',
      description: 'string',
      name: 'string',
      user_group_id: 'string'
    }]
)

response = api.update_user_groups(body)

puts response

Responses

[
  {
    "cid": "string",
    "description": "string",
    "name": "string",
    "user_group_id": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "description": "string",
      "name": "string",
      "user_group_id": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

MSSP (Flight Control)

Table of Contents

addCIDGroupMembers

Parameters

addRole

Parameters

addUserGroupMembers

Parameters

createCIDGroups

Parameters

createUserGroups

Parameters

deleteCIDGroupMembersV1

Parameters

deleteCIDGroupMembersV2

Parameters

deleteCIDGroups

Parameters

deletedRoles

Parameters

deleteUserGroupMembers

Parameters

deleteUserGroups

Parameters

getChildren

Parameters

getChildrenV2

Parameters

getCIDGroupByIdV1

Parameters

getCIDGroupByIdV2

Parameters

getCIDGroupMembersByV1

Parameters

getCIDGroupMembersByV2

Parameters

getRolesByID

Parameters

getUserGroupMembersByIDV1

Parameters

getUserGroupMembersByIDV2

Parameters

getUserGroupsByIDV1

Parameters

getUserGroupsByIDV2

Parameters

queryChildren

Parameters

queryCIDGroupMembers

Parameters

queryCIDGroups

Parameters

queryRoles

Parameters

queryUserGroupMembers

Parameters

queryUserGroups

Parameters

updateCIDGroups

Parameters

updateUserGroups

Parameters