Network Scan Templates

Operations for the Network Scan Templates service collection.

Language	Last Update
Python	v1.6.5
PowerShell
Go	v0.22.0
TypeScript	v0.6.0
Rust
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
create-templates create_templates	Create “templates” using provided specifications
delete-templates delete_templates	Delete “templates” by their IDs
get-template-configs get_template_configs	Get details on the network scan template configurations
get-templates get_templates	Get “templates” by their IDs
query-templates query_templates	Get “templates IDs” by filter
update-templates update_templates	Update “templates” using provided specifications

---

create-templates

Create “templates” using provided specifications

Method POST

Route /netscan/entities/templates/v1

Scope Network scanning: WRITE

PEP 8 create_templates

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

active_check_level body · string

The active check level associated with the template

Available values (2)

active_check_safe_only

active_check_all

additional_tcp_ports body · array

Additional TCP ports associated with the template

additional_udp_ports body · array

Additional UDP ports associated with the template

auto_include_new_detections body · boolean

Automatically include new detections in the template

detections body · array

Detections associated with the template

excluded_tcp_ports body · array

Excluded TCP ports associated with the template

excluded_udp_ports body · array

Excluded UDP ports associated with the template

ignore_tcp_resets body · boolean

Ignore TCP resets associated with the template

name body · string

The name given to the template

ports_scan_level body · string

The port scan level associated with the template

Available values (3)

default

all_ports

custom

scan_flags body · object

Custom nmap flag overrides for this template

scan_intensity body · string

The scan intensity at which scans will run from this template

Available values (5)

basic	standard	cautious
maximum	custom

type body · string

The type of the template

Available values (2)

discovery

assessment

Code Examples

Python

PEP 8

from falconpy import NetworkScanTemplates

falcon = NetworkScanTemplates(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.create_templates(active_check_level="string",
                                   additional_tcp_ports=id_list,
                                   additional_udp_ports=id_list,
                                   auto_include_new_detections=boolean,
                                   detections=id_list,
                                   ignore_tcp_resets=boolean,
                                   name="string",
                                   ports_scan_level="string",
                                   scan_intensity="string",
                                   type="string")
print(response)

Operation ID

from falconpy import NetworkScanTemplates

falcon = NetworkScanTemplates(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.create_templates(active_check_level="string",
                                   additional_tcp_ports=id_list,
                                   additional_udp_ports=id_list,
                                   auto_include_new_detections=boolean,
                                   detections=id_list,
                                   ignore_tcp_resets=boolean,
                                   name="string",
                                   ports_scan_level="string",
                                   scan_intensity="string",
                                   type="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = [
    {
        "active_check_level": "string",
        "additional_tcp_ports": ["string"],
        "additional_udp_ports": ["string"],
        "auto_include_new_detections": boolean,
        "detections": ["string"],
        "excluded_tcp_ports": ["string"],
        "excluded_udp_ports": ["string"],
        "ignore_tcp_resets": boolean,
        "name": "string",
        "ports_scan_level": "string",
        "scan_flags": {
            "defeat_rst_ratelimit": boolean,
            "host_timeout": integer,
            "ignore_tcp_resets": boolean,
            "initial_rtt_timeout": integer,
            "max_parallelism": integer,
            "max_rate": integer,
            "max_retries": integer,
            "max_rtt_timeout": integer,
            "min_parallelism": integer,
            "min_rate": integer,
            "min_rtt_timeout": integer,
            "scan_delay": integer,
            "script_timeout": integer,
            "version_intensity": integer
        },
        "scan_intensity": "string",
        "type": "string"
    }
]

response = falcon.command("create_templates", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/network_scan_templates"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  active_check_level := "string"
  auto_include_new_detections := boolean
  ignore_tcp_resets := boolean
  name := "string"
  ports_scan_level := "string"
  scan_intensity := "string"
  typeVar := "string"

  response, err := client.NetworkScanTemplates.CreateTemplates(
    &network_scan_templates.CreateTemplatesParams{
      Body: []*models.DomainTemplateCreateRequest{
        {
          ActiveCheckLevel: &active_check_level,
          AdditionalTcpPorts: []string{"string"},
          AdditionalUdpPorts: []string{"string"},
          AutoIncludeNewDetections: &auto_include_new_detections,
          Detections: []string{"string"},
          ExcludedTcpPorts: []string{"string"},
          ExcludedUdpPorts: []string{"string"},
          IgnoreTcpResets: &ignore_tcp_resets,
          Name: &name,
          PortsScanLevel: &ports_scan_level,
          ScanFlags: &struct{}{},
          ScanIntensity: &scan_intensity,
          Type: &typeVar,
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.networkScanTemplates.createTemplates(
  [{
    activeCheckLevel: "string",
    additionalTcpPorts: [],
    additionalUdpPorts: [],
    autoIncludeNewDetections: boolean,
    detections: [],
    excludedTcpPorts: [],
    excludedUdpPorts: [],
    ignoreTcpResets: boolean,
    name: "string",
    portsScanLevel: "string",
    scanFlags: {
      defeatRstRatelimit: boolean,
      hostTimeout: integer,
      ignoreTcpResets: boolean,
      initialRttTimeout: integer,
      maxParallelism: integer,
      maxRate: integer,
      maxRetries: integer,
      maxRttTimeout: integer,
      minParallelism: integer,
      minRate: integer,
      minRttTimeout: integer,
      scanDelay: integer,
      scriptTimeout: integer,
      versionIntensity: integer
    },
    scanIntensity: "string",
    type: "string"
}]  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::NetworkScanTemplates.new

body = [Falcon::DomainTemplateCreateRequest.new(
  active_check_level: 'string',
  additional_tcp_ports: [],
  additional_udp_ports: [],
  auto_include_new_detections: boolean,
  detections: [],
  excluded_tcp_ports: [],
  excluded_udp_ports: [],
  ignore_tcp_resets: boolean,
  name: 'string',
  ports_scan_level: 'string',
  scan_flags: {
    defeat_rst_ratelimit: boolean,
    host_timeout: integer,
    ignore_tcp_resets: boolean,
    initial_rtt_timeout: integer,
    max_parallelism: integer,
    max_rate: integer,
    max_retries: integer,
    max_rtt_timeout: integer,
    min_parallelism: integer,
    min_rate: integer,
    min_rtt_timeout: integer,
    scan_delay: integer,
    script_timeout: integer,
    version_intensity: integer
  },
  scan_intensity: 'string',
  type: 'string'
)]

response = api.create_templates(body)

puts response

Responses

201 Created

[
  {
    "active_check_level": "string",
    "additional_tcp_ports": [],
    "additional_udp_ports": [],
    "auto_include_new_detections": false,
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "detections": [],
    "excluded_tcp_ports": [],
    "excluded_udp_ports": [],
    "id": "string",
    "ignore_tcp_resets": false,
    "name": "string",
    "ports_scan_level": "string",
    "scan_flags": {},
    "scan_intensity": "string",
    "type": "string",
    "updated_by": "string",
    "updated_timestamp": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

409 Conflict

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

413 Request Entity Too Large

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

delete-templates

Delete “templates” by their IDs

Method DELETE

Route /netscan/entities/templates/v1

Scope Network scanning: WRITE

PEP 8 delete_templates

Parameters

ids query · string or list of strings

IDs of “templates” to be deleted (Min: 1, Max: 100)

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import NetworkScanTemplates

falcon = NetworkScanTemplates(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_templates(ids=id_list)
print(response)

Operation ID

from falconpy import NetworkScanTemplates

falcon = NetworkScanTemplates(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_templates(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("delete_templates",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/network_scan_templates"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.NetworkScanTemplates.DeleteTemplates(
    &network_scan_templates.DeleteTemplatesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.networkScanTemplates.deleteTemplates(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::NetworkScanTemplates.new

response = api.delete_templates(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

409 Conflict

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

get-template-configs

Get details on the network scan template configurations

Method GET

Route /netscan/entities/template-configs/v1

Scope Network scanning: READ

PEP 8 get_template_configs

Code Examples

Python

PEP 8

from falconpy import NetworkScanTemplates

falcon = NetworkScanTemplates(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.get_template_configs()
print(response)

Operation ID

from falconpy import NetworkScanTemplates

falcon = NetworkScanTemplates(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.get_template_configs()
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("get_template_configs")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/network_scan_templates"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  xCSUSERUUID := "string"

  response, err := client.NetworkScanTemplates.GetTemplateConfigs(
    &network_scan_templates.GetTemplateConfigsParams{
      XCSUSERUUID: &xCSUSERUUID,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.networkScanTemplates.getTemplateConfigs();

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::NetworkScanTemplates.new

response = api.get_template_configs

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

get-templates

Get “templates” by their IDs

Method GET

Route /netscan/entities/templates/v1

Scope Network scanning: READ

PEP 8 get_templates

Parameters

ids query · string or list of strings

IDs of “templates” to be retrieved (Min: 1, Max: 100)

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import NetworkScanTemplates

falcon = NetworkScanTemplates(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_templates(ids=id_list)
print(response)

Operation ID

from falconpy import NetworkScanTemplates

falcon = NetworkScanTemplates(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_templates(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_templates",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/network_scan_templates"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.NetworkScanTemplates.GetTemplates(
    &network_scan_templates.GetTemplatesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.networkScanTemplates.getTemplates(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::NetworkScanTemplates.new

response = api.get_templates(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "active_check_level": "string",
    "additional_tcp_ports": [],
    "additional_udp_ports": [],
    "auto_include_new_detections": false,
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "detections": [],
    "excluded_tcp_ports": [],
    "excluded_udp_ports": [],
    "id": "string",
    "ignore_tcp_resets": false,
    "name": "string",
    "ports_scan_level": "string",
    "scan_flags": {},
    "scan_intensity": "string",
    "type": "string",
    "updated_by": "string",
    "updated_timestamp": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

query-templates

Get “templates IDs” by filter

Method GET

Route /netscan/queries/templates/v1

Scope Network scanning: READ

PEP 8 query_templates

Parameters

offset query · integer

An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide an offset. On subsequent requests, add previous offset with the previous limit to continue from that place in the results

limit query · integer

The number of “templates IDs” to return in this response (Min: 1, Max: 100, Default: 100)

sort query · string

Sort “templates” by their properties. A single sort field is allowed

filter query · string

Search for “templates” by providing an FQL filter

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import NetworkScanTemplates

falcon = NetworkScanTemplates(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.query_templates(offset=integer,
                                  limit=integer,
                                  sort="string",
                                  filter="string")
print(response)

Operation ID

from falconpy import NetworkScanTemplates

falcon = NetworkScanTemplates(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.query_templates(offset=integer,
                                  limit=integer,
                                  sort="string",
                                  filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("query_templates",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/network_scan_templates"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.NetworkScanTemplates.QueryTemplates(
    &network_scan_templates.QueryTemplatesParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.networkScanTemplates.queryTemplates(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string"  // filter
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::NetworkScanTemplates.new

response = api.query_templates(offset: integer,
                               limit: integer,
                               sort: 'string',
                               filter: 'string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

update-templates

Update “templates” using provided specifications

Method PATCH

Route /netscan/entities/templates/v1

Scope Network scanning: WRITE

PEP 8 update_templates

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

active_check_level body · string

The active check level associated with the template

Available values (2)

active_check_safe_only

active_check_all

additional_tcp_ports body · array

Additional TCP ports associated with the template

additional_udp_ports body · array

Additional UDP ports associated with the template

auto_include_new_detections body · boolean

Automatically include new detections in the template

detections body · array

Detections associated with the template

excluded_tcp_ports body · array

Excluded TCP ports associated with the template

excluded_udp_ports body · array

Excluded UDP ports associated with the template

id body · string

The unique identifier of the template

ignore_tcp_resets body · boolean

Ignore TCP resets associated with the template

name body · string

The name given to the template

ports_scan_level body · string

The port scan level associated with the template

Available values (3)

default

all_ports

custom

scan_flags body · object

Custom nmap flag overrides for this template

scan_intensity body · string

The scan intensity at which scans will run from this template

Available values (5)

basic	standard	cautious
maximum	custom

Code Examples

Python

PEP 8

from falconpy import NetworkScanTemplates

falcon = NetworkScanTemplates(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_templates(active_check_level="string",
                                   additional_tcp_ports=id_list,
                                   additional_udp_ports=id_list,
                                   auto_include_new_detections=boolean,
                                   detections=id_list,
                                   id="string",
                                   ignore_tcp_resets=boolean,
                                   name="string",
                                   ports_scan_level="string",
                                   scan_intensity="string")
print(response)

Operation ID

from falconpy import NetworkScanTemplates

falcon = NetworkScanTemplates(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_templates(active_check_level="string",
                                   additional_tcp_ports=id_list,
                                   additional_udp_ports=id_list,
                                   auto_include_new_detections=boolean,
                                   detections=id_list,
                                   id="string",
                                   ignore_tcp_resets=boolean,
                                   name="string",
                                   ports_scan_level="string",
                                   scan_intensity="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = [
    {
        "active_check_level": "string",
        "additional_tcp_ports": ["string"],
        "additional_udp_ports": ["string"],
        "auto_include_new_detections": boolean,
        "detections": ["string"],
        "excluded_tcp_ports": ["string"],
        "excluded_udp_ports": ["string"],
        "id": "string",
        "ignore_tcp_resets": boolean,
        "name": "string",
        "ports_scan_level": "string",
        "scan_flags": {
            "defeat_rst_ratelimit": boolean,
            "host_timeout": integer,
            "ignore_tcp_resets": boolean,
            "initial_rtt_timeout": integer,
            "max_parallelism": integer,
            "max_rate": integer,
            "max_retries": integer,
            "max_rtt_timeout": integer,
            "min_parallelism": integer,
            "min_rate": integer,
            "min_rtt_timeout": integer,
            "scan_delay": integer,
            "script_timeout": integer,
            "version_intensity": integer
        },
        "scan_intensity": "string"
    }
]

response = falcon.command("update_templates", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/network_scan_templates"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  active_check_level := "string"
  auto_include_new_detections := boolean
  id := "string"
  ignore_tcp_resets := boolean
  name := "string"
  ports_scan_level := "string"
  scan_intensity := "string"

  response, err := client.NetworkScanTemplates.UpdateTemplates(
    &network_scan_templates.UpdateTemplatesParams{
      Body: []*models.DomainTemplateUpdateRequest{
        {
          ActiveCheckLevel: &active_check_level,
          AdditionalTcpPorts: []string{"string"},
          AdditionalUdpPorts: []string{"string"},
          AutoIncludeNewDetections: &auto_include_new_detections,
          Detections: []string{"string"},
          ExcludedTcpPorts: []string{"string"},
          ExcludedUdpPorts: []string{"string"},
          ID: &id,
          IgnoreTcpResets: &ignore_tcp_resets,
          Name: &name,
          PortsScanLevel: &ports_scan_level,
          ScanFlags: &struct{}{},
          ScanIntensity: &scan_intensity,
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.networkScanTemplates.updateTemplates(
  [{
    activeCheckLevel: "string",
    additionalTcpPorts: [],
    additionalUdpPorts: [],
    autoIncludeNewDetections: boolean,
    detections: [],
    excludedTcpPorts: [],
    excludedUdpPorts: [],
    id: "string",
    ignoreTcpResets: boolean,
    name: "string",
    portsScanLevel: "string",
    scanFlags: {
      defeatRstRatelimit: boolean,
      hostTimeout: integer,
      ignoreTcpResets: boolean,
      initialRttTimeout: integer,
      maxParallelism: integer,
      maxRate: integer,
      maxRetries: integer,
      maxRttTimeout: integer,
      minParallelism: integer,
      minRate: integer,
      minRttTimeout: integer,
      scanDelay: integer,
      scriptTimeout: integer,
      versionIntensity: integer
    },
    scanIntensity: "string"
}]  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::NetworkScanTemplates.new

body = [Falcon::DomainTemplateUpdateRequest.new(
  active_check_level: 'string',
  additional_tcp_ports: [],
  additional_udp_ports: [],
  auto_include_new_detections: boolean,
  detections: [],
  excluded_tcp_ports: [],
  excluded_udp_ports: [],
  id: 'string',
  ignore_tcp_resets: boolean,
  name: 'string',
  ports_scan_level: 'string',
  scan_flags: {
    defeat_rst_ratelimit: boolean,
    host_timeout: integer,
    ignore_tcp_resets: boolean,
    initial_rtt_timeout: integer,
    max_parallelism: integer,
    max_rate: integer,
    max_retries: integer,
    max_rtt_timeout: integer,
    min_parallelism: integer,
    min_rate: integer,
    min_rtt_timeout: integer,
    scan_delay: integer,
    script_timeout: integer,
    version_intensity: integer
  },
  scan_intensity: 'string'
)]

response = api.update_templates(body)

puts response

Responses

200 OK

[
  {
    "active_check_level": "string",
    "additional_tcp_ports": [],
    "additional_udp_ports": [],
    "auto_include_new_detections": false,
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "detections": [],
    "excluded_tcp_ports": [],
    "excluded_udp_ports": [],
    "id": "string",
    "ignore_tcp_resets": false,
    "name": "string",
    "ports_scan_level": "string",
    "scan_flags": {},
    "scan_intensity": "string",
    "type": "string",
    "updated_by": "string",
    "updated_timestamp": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

409 Conflict

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

413 Request Entity Too Large

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}