Network Containment
Operations for the Network Containment service collection.
| Language | Last Update |
|---|---|
| Python | v1.6.6 |
| PowerShell | |
| Go | v0.24.0 |
| TypeScript | v0.9.0 |
| Rust | |
| Ruby | v1.6.0 |
Table of Contents
Section titled “Table of Contents”| Operation | Description |
|---|---|
CreateContainmentAllowlistRulescreate_allowlist_rules | Add new network containment allowlist rules |
DeleteContainmentAllowlistRulesdelete_allowlist_rules | Delete network containment allowlist rules by ID |
GetContainmentAllowlistRulesget_allowlist_rules | Get network containment allowlist rules for the specified IDs |
QueryContainmentAllowlistRulesquery_allowlist_rules | Search for network containment allowlist rules by context |
UpdateContainmentAllowlistRulesupdate_allowlist_rules | Update network containment allowlist rules |
CreateContainmentAllowlistRules
Section titled “CreateContainmentAllowlistRules”Add new network containment allowlist rules
Method POST
Route /customers/entities/containment-allowlist-rules/v1
Scope Network Containment Allowlist: WRITE
PEP 8
create_allowlist_rulesParameters
Section titled “Parameters”body body · dictionary
Full body payload as JSON formatted dictionary.
rules body · array
The rules value.
Code Examples
from falconpy import NetworkContainment
falcon = NetworkContainment(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
rules = [ { "cid": "string", "context": "string", "created_by": "string", "created_on": "string", "id": "string", "label": "string", "options": { "allow_subdomain": True }, "rule": "string", "type": "string" }]
response = falcon.create_allowlist_rules(rules=rules)print(response)from falconpy import NetworkContainment
falcon = NetworkContainment(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
rules = [ { "cid": "string", "context": "string", "created_by": "string", "created_on": "string", "id": "string", "label": "string", "options": { "allow_subdomain": True }, "rule": "string", "type": "string" }]
response = falcon.CreateContainmentAllowlistRules(rules=rules)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
body_payload = { "rules": [ { "cid": "string", "context": "string", "created_by": "string", "created_on": "string", "id": "string", "label": "string", "options": { "allow_subdomain": boolean }, "rule": "string", "type": "string" } ]}
response = falcon.command("CreateContainmentAllowlistRules", body=body_payload)print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/containment_allowlist_rules" "github.com/go-openapi/strfmt" "github.com/crowdstrike/gofalcon/falcon/models")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
context := "string" createdBy := "string" createdOn := strfmt.DateTime{} label := "string" rule := "string" typeVar := "string"
response, err := client.ContainmentAllowlistRules.CreateContainmentAllowlistRules( &containment_allowlist_rules.CreateContainmentAllowlistRulesParams{ Body: &models.IpwhitelistAllowlistRequest{ Rules: []*models.IpwhitelistinteractorAllowlistRule{ { Cid: "string", Context: &context, CreatedBy: &createdBy, CreatedOn: &createdOn, ID: "string", Label: &label, Options: &models.IpwhitelistinteractorRuleOption{}, Rule: &rule, Type: &typeVar, }, }, }, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: "us-1", clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.containmentAllowlistRules.createContainmentAllowlistRules( { rules: [{ cid: "string", context: "string", createdBy: "string", createdOn: new Date(), id: "string", label: "string", options: { allowSubdomain: boolean }, rule: "string", type: "string" }]} // body);
console.log(response);Examples coming soon.
require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::ContainmentAllowlistRules.new
body = Falcon::IpwhitelistAllowlistRequest.new( rules: [{ cid: 'string', context: 'string', created_by: 'string', created_on: 'string', id: 'string', label: 'string', options: { allow_subdomain: boolean }, rule: 'string', type: 'string' }])
response = api.create_containment_allowlist_rules(body)
puts responseResponses
[ { "cid": "string", "context": "string", "created_by": "string", "created_on": "string", "id": "string", "label": "string", "options": {}, "rule": "string", "type": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}DeleteContainmentAllowlistRules
Section titled “DeleteContainmentAllowlistRules”Delete network containment allowlist rules by ID
Method DELETE
Route /customers/entities/containment-allowlist-rules/v1
Scope Network Containment Allowlist: WRITE
PEP 8
delete_allowlist_rulesParameters
Section titled “Parameters”ids query · string
Containment allowlist rule ID
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NetworkContainment
falcon = NetworkContainment(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.delete_allowlist_rules(ids=id_list)print(response)from falconpy import NetworkContainment
falcon = NetworkContainment(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.DeleteContainmentAllowlistRules(ids=id_list)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("DeleteContainmentAllowlistRules", ids="string")print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/containment_allowlist_rules")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
response, err := client.ContainmentAllowlistRules.DeleteContainmentAllowlistRules( &containment_allowlist_rules.DeleteContainmentAllowlistRulesParams{ Ids: []string{"ID1", "ID2", "ID3"}, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: "us-1", clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.containmentAllowlistRules.deleteContainmentAllowlistRules("string"); // ids
console.log(response);Examples coming soon.
require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::ContainmentAllowlistRules.new
response = api.delete_containment_allowlist_rules(ids: 'string')
puts responseResponses
[ { "cid": "string", "context": "string", "created_by": "string", "created_on": "string", "id": "string", "label": "string", "options": {}, "rule": "string", "type": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}GetContainmentAllowlistRules
Section titled “GetContainmentAllowlistRules”Get network containment allowlist rules for the specified IDs
Method GET
Route /customers/entities/containment-allowlist-rules/v1
Scope Network Containment Allowlist: READ
PEP 8
get_allowlist_rulesParameters
Section titled “Parameters”ids query · string or list of strings
Containment allowlist rule ID
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NetworkContainment
falcon = NetworkContainment(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_allowlist_rules(ids=id_list)print(response)from falconpy import NetworkContainment
falcon = NetworkContainment(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.GetContainmentAllowlistRules(ids=id_list)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("GetContainmentAllowlistRules", ids=id_list)print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/containment_allowlist_rules")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
response, err := client.ContainmentAllowlistRules.GetContainmentAllowlistRules( &containment_allowlist_rules.GetContainmentAllowlistRulesParams{ Ids: []string{"ID1", "ID2", "ID3"}, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: "us-1", clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.containmentAllowlistRules.getContainmentAllowlistRules(["ID1", "ID2", "ID3"]); // ids
console.log(response);Examples coming soon.
require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::ContainmentAllowlistRules.new
response = api.get_containment_allowlist_rules(['ID1', 'ID2', 'ID3'])
puts responseResponses
[ { "cid": "string", "context": "string", "created_by": "string", "created_on": "string", "id": "string", "label": "string", "options": {}, "rule": "string", "type": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}QueryContainmentAllowlistRules
Section titled “QueryContainmentAllowlistRules”Search for network containment allowlist rules by context
Method GET
Route /customers/queries/containment-allowlist-rules/v1
Scope Network Containment Allowlist: READ
PEP 8
query_allowlist_rulesParameters
Section titled “Parameters”filter query · string
Allowlist FQL filter. Can only filter based on the context parameter
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NetworkContainment
falcon = NetworkContainment(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.query_allowlist_rules(filter="string")print(response)from falconpy import NetworkContainment
falcon = NetworkContainment(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.QueryContainmentAllowlistRules(filter="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("QueryContainmentAllowlistRules", filter="string")print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/containment_allowlist_rules")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
filter := "string"
response, err := client.ContainmentAllowlistRules.QueryContainmentAllowlistRules( &containment_allowlist_rules.QueryContainmentAllowlistRulesParams{ Filter: &filter, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: "us-1", clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.containmentAllowlistRules.queryContainmentAllowlistRules("string"); // filter
console.log(response);Examples coming soon.
require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::ContainmentAllowlistRules.new
response = api.query_containment_allowlist_rules(filter: 'string')
puts responseResponses
[ "string"]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}UpdateContainmentAllowlistRules
Section titled “UpdateContainmentAllowlistRules”Update network containment allowlist rules
Method PATCH
Route /customers/entities/containment-allowlist-rules/v1
Scope Network Containment Allowlist: WRITE
PEP 8
update_allowlist_rulesParameters
Section titled “Parameters”body body · dictionary
Full body payload as JSON formatted dictionary.
rules body · array
The rules value.
Code Examples
from falconpy import NetworkContainment
falcon = NetworkContainment(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
rules = [ { "cid": "string", "context": "string", "created_by": "string", "created_on": "string", "id": "string", "label": "string", "options": { "allow_subdomain": True }, "rule": "string", "type": "string" }]
response = falcon.update_allowlist_rules(rules=rules)print(response)from falconpy import NetworkContainment
falcon = NetworkContainment(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
rules = [ { "cid": "string", "context": "string", "created_by": "string", "created_on": "string", "id": "string", "label": "string", "options": { "allow_subdomain": True }, "rule": "string", "type": "string" }]
response = falcon.UpdateContainmentAllowlistRules(rules=rules)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
body_payload = { "rules": [ { "cid": "string", "context": "string", "created_by": "string", "created_on": "string", "id": "string", "label": "string", "options": { "allow_subdomain": boolean }, "rule": "string", "type": "string" } ]}
response = falcon.command("UpdateContainmentAllowlistRules", body=body_payload)print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/containment_allowlist_rules" "github.com/go-openapi/strfmt" "github.com/crowdstrike/gofalcon/falcon/models")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
context := "string" createdBy := "string" createdOn := strfmt.DateTime{} label := "string" rule := "string" typeVar := "string"
response, err := client.ContainmentAllowlistRules.UpdateContainmentAllowlistRules( &containment_allowlist_rules.UpdateContainmentAllowlistRulesParams{ Body: &models.IpwhitelistAllowlistRequest{ Rules: []*models.IpwhitelistinteractorAllowlistRule{ { Cid: "string", Context: &context, CreatedBy: &createdBy, CreatedOn: &createdOn, ID: "string", Label: &label, Options: &models.IpwhitelistinteractorRuleOption{}, Rule: &rule, Type: &typeVar, }, }, }, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: "us-1", clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.containmentAllowlistRules.updateContainmentAllowlistRules( { rules: [{ cid: "string", context: "string", createdBy: "string", createdOn: new Date(), id: "string", label: "string", options: { allowSubdomain: boolean }, rule: "string", type: "string" }]} // body);
console.log(response);Examples coming soon.
require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::ContainmentAllowlistRules.new
body = Falcon::IpwhitelistAllowlistRequest.new( rules: [{ cid: 'string', context: 'string', created_by: 'string', created_on: 'string', id: 'string', label: 'string', options: { allow_subdomain: boolean }, rule: 'string', type: 'string' }])
response = api.update_containment_allowlist_rules(body)
puts responseResponses
[ { "cid": "string", "context": "string", "created_by": "string", "created_on": "string", "id": "string", "label": "string", "options": {}, "rule": "string", "type": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}