Skip to content
CrowdStrike Developer Center

NGSIEM

The NGSIEM service collection provides operations for managing NGSIEM search, lookup files, dashboards, parsers, and saved queries. Upload and retrieve lookup files, initiate and manage searches, and manage dashboards, parsers, and data connections.

LanguageLast Update
Pythonv1.6.5
PowerShellv2.2.9
Gov0.22.0
TypeScriptv0.6.0
Rustv0.7.1
Rubyv1.4.0

This service collection has code examples posted to the repository.

Table of Contents

Section titled “Table of Contents”
OperationDescription
addDashboardLabels
add_dashboard_labels		Add multiple labels to a single dashboard
addFileLabels
add_file_labels		Add multiple labels to a single file
addSavedQueryLabels
add_saved_query_labels		Add multiple labels to a saved query
bulkAddDashboardLabels
bulk_add_dashboard_labels		Add labels to multiple dashboards (max 100 items, non-transactional)
bulkAddLookupFileLabels
bulk_add_lookup_file_labels		Add labels to multiple lookup files (max 100 items, non-transactional)
bulkAddSavedQueryLabels
bulk_add_saved_query_labels		Add labels to multiple saved queries (max 100 items, non-transactional)
BulkCreateDashboardsFromTemplate
bulk_create_dashboards_from_template		Create Multiple Dashboards from YAML Templates.
BulkCreateLookupFiles
bulk_create_lookup_files		Create Multiple Lookup Files.
BulkCreateSavedQueriesFromTemplate
bulk_create_saved_queries_from_template		Create Multiple Saved Queries from LogScale YAML Templates.
BulkGetLookupFiles
bulk_get_lookup_files		Retrieve Multiple Lookup Files by Filenames in NGSIEM.
BulkInstallParsers
bulk_install_parsers		Installs multiple CrowdStrike-managed out-of-the-box (OOTB) parsers into the customer’s repository in a single operation.
bulkRemoveDashboardLabels
bulk_remove_dashboard_labels		Remove labels from multiple dashboards (max 100 items, non-transactional)
bulkRemoveLookupFileLabels
bulk_remove_lookup_file_labels		Remove labels from multiple lookup files (max 100 items, non-transactional)
bulkRemoveSavedQueryLabels
bulk_remove_saved_query_labels		Remove labels from multiple saved queries (max 100 items, non-transactional)
bulkUpdateDashboardLabels
bulk_update_dashboard_labels		Replace all labels on multiple dashboards (max 100 items, non-transactional)
BulkUpdateDashboardsFromTemplate
bulk_update_dashboards_from_template		Update Multiple Dashboards from YAML Templates.
bulkUpdateLookupFileLabels
bulk_update_lookup_file_labels		Replace all labels on multiple lookup files (max 100 items, non-transactional)
BulkUpdateLookupFiles
bulk_update_lookup_files		Update Multiple Lookup Files.
BulkUpdateSavedQueriesFromTemplate
bulk_update_saved_queries_from_template		Update Multiple Saved Queries from LogScale YAML Templates.
bulkUpdateSavedQueryLabels
bulk_update_saved_query_labels		Replace all labels on multiple saved queries (max 100 items, non-transactional)
CloneParser
clone_parser		Clone an existing parser with a new name
CreateDashboardFromTemplate
create_dashboard_from_template		Create Dashboard from LogScale YAML Template in NGSIEM
CreateLookupFile
create_lookup_file		Create Lookup File in NGSIEM
CreateParser
create_parser		Create Parser in NGSIEM.
deprecated
CreateParserExtension
create_parser_extension		Create a Parser extension in NGSIEM for the provided base parser.
CreateParserFromTemplate
create_parser_from_template		Create Parser from LogScale YAML Template in NGSIEM
CreateSavedQuery
create_saved_query		Create Saved Query from LogScale YAML Template in NGSIEM
DeleteDashboard
delete_dashboard		Delete Dashboard in NGSIEM
DeleteLookupFile
delete_lookup_file		Delete Lookup File in NGSIEM
DeleteParser
delete_parser		Delete Parser in NGSIEM
DeleteSavedQuery
delete_saved_query		Delete Saved Query in NGSIEM
ExternalCreateConnectorConfig
create_connector_config		Create a new configuration for a data connector
ExternalCreateDataConnection
create_data_connection		Create a new data connection
ExternalDeleteConnectorConfigs
delete_connector_configs		Delete data connection config
ExternalDeleteDataConnection
delete_data_connection		Delete a data connection
ExternalGetDataConnectionByID
get_connection_by_id		Get data connection by ID
ExternalGetDataConnectionStatus
get_provisioning_status		Get data connection provisioning status
ExternalGetDataConnectionToken
get_ingest_token		Get Ingest token for data connection
ExternalListConnectorConfigs
list_connector_configs		List configurations for a data connector
ExternalListDataConnections
list_data_connections		List and search data connections
ExternalListDataConnectors
list_data_connectors		List available data connectors
ExternalPatchConnectorConfig
patch_connector_config		Patch configurations for a data connector
ExternalRegenerateDataConnectionToken
regenerate_ingest_token		Regenerate Ingest token for data connection
ExternalUpdateDataConnection
update_data_connection		Update a data connection
ExternalUpdateDataConnectionStatus
update_connection_status		Update data connection status
GetDashboardTemplate
get_dashboard_template		Retrieve Dashboard(s) in NGSIEM as LogScale YAML Template.
GetLookupFile
get_lookup_file		Retrieve Lookup File in NGSIEM
GetLookupFromPackageV1
get_file_from_package		Download lookup file in package from NGSIEM
GetLookupFromPackageWithNamespaceV1
get_file_from_package_with_namespace		Download lookup file in namespaced package from NGSIEM
GetLookupV1
get_file		Download lookup file from NGSIEM
GetParser
get_parser		Retrieve Parser in NGSIEM.
deprecated
GetParserTemplate
get_parser_template		Retrieve Parser in NGSIEM as LogScale YAML Template
GetSavedQueryTemplate
get_saved_query_template		Retrieve Saved Quer(ies) in NGSIEM as LogScale YAML Template.
GetSearchStatusV1
get_search_status		Get status of search
InstallParser
install_parser		Installs a CrowdStrike-managed out-of-the-box (OOTB) parser into the customer’s repository.
ListDashboards
list_dashboards		List Dashboards in NGSIEM with Pagination and Filtering.
ListLookupFiles
list_lookup_files		List Lookup Files in NGSIEM with Pagination and Filtering.
ListParsers
list_parsers		List Parsers in NGSIEM
ListSavedQueries
list_saved_queries		List Saved Queries in NGSIEM with Pagination and Filtering.
removeDashboardLabels
remove_dashboard_labels		Remove multiple labels from a single dashboard
removeFileLabels
remove_file_labels		Remove multiple labels from a single file
removeSavedQueryLabels
remove_saved_query_labels		Remove multiple labels from a saved query
StartSearchV1
start_search		Initiate search
StopSearchV1
stop_search		Stop search
TestParserFromTemplate
test_parser_from_template		Test Parser from LogScale YAML Template in NGSIEM
UpdateDashboardFromTemplate
update_dashboard_from_template		Update Dashboard from LogScale YAML Template in NGSIEM.
updateDashboardLabels
update_dashboard_labels		Replace all labels on a single dashboard
updateFileLabels
update_file_labels		Replace all labels on a single file
UpdateLookupFile
update_lookup_file		Update an entire Lookup File in NGSIEM
UpdateLookupFileEntries
update_lookup_file_entries		Update entries in an existing Lookup File in NGSIEM
UpdateParser
update_parser		Update Parser in NGSIEM.
deprecated
UpdateParserAutoUpdatePolicy
update_parser_auto_update_policy		Updates a parser auto update policy - ‘on’ enables auto-updates, ‘off’ disables them
UpdateParserExtension
update_parser_extension		Update an existing Parser extension in NGSIEM.
UpdateParserFromTemplate
update_parser_from_template		Update Parser in NGSIEM from YAML Template.
UpdateSavedQueryFromTemplate
update_saved_query_from_template		Update Saved Query from LogScale YAML Template in NGSIEM.
updateSavedQueryLabels
update_saved_query_labels		Replace all labels on a single saved query
UploadLookupV1
upload_file		Upload file to NGSIEM

addDashboardLabels

Section titled “addDashboardLabels”

Add multiple labels to a single dashboard

Method POST
Route /ngsiem-content/entities/dashboard-labels/v1
Scope NGSIEM Dashboards: WRITE
PEP 8 add_dashboard_labels

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
id body · string
The unique identifier of the dashboard
labels body · array
The labels to add (max 10 labels, max 60 chars each)
search_domain body · string
The search domain (view or repository) containing the dashboard
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.add_dashboard_labels(id="string",
                                       labels=["string"],
                                       search_domain="string")
print(response)
Responses
[
  {
    "id": "string",
    "labels": [],
    "name": "string"
  }
]

addFileLabels

Section titled “addFileLabels”

Add multiple labels to a single file

Method POST
Route /ngsiem-content/entities/lookupfile-labels/v1
Scope NGSIEM Lookup Files: WRITE
PEP 8 add_file_labels

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
filename body · string
The name of the lookup file
labels body · array
The labels to add (max 10 total labels per file, max 60 chars each)
search_domain body · string
The search domain (view or repository) containing the file
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.add_file_labels(filename="string",
                                  labels=["string"],
                                  search_domain="string")
print(response)
Responses
[
  {
    "filename": "string",
    "labels": []
  }
]

addSavedQueryLabels

Section titled “addSavedQueryLabels”

Add multiple labels to a saved query

Method POST
Route /ngsiem-content/entities/savedquery-labels/v1
Scope NGSIEM Saved Queries: WRITE
PEP 8 add_saved_query_labels

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
id body · string
The unique identifier of the saved query
labels body · array
The labels to add (max 10 labels, max 60 chars each)
search_domain body · string
The search domain (view or repository) containing the saved query
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.add_saved_query_labels(id="string",
                                         labels=["string"],
                                         search_domain="string")
print(response)
Responses
[
  {
    "id": "string",
    "labels": [],
    "name": "string"
  }
]

bulkAddDashboardLabels

Section titled “bulkAddDashboardLabels”

Add labels to multiple dashboards (max 100 items, non-transactional)

Method POST
Route /ngsiem-content/entities/bulk-dashboard-labels-add/v1
Scope NGSIEM Dashboards: WRITE
PEP 8 bulk_add_dashboard_labels

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
items body · array
List of dashboards with labels to add/remove/replace (max 100 items)
search_domain body · string
The search domain (view or repository) containing the dashboards
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.bulk_add_dashboard_labels(items=["string"],
                                            search_domain="string")
print(response)
Responses
[
  {
    "error": "string",
    "id": "string",
    "labels": [],
    "name": "string",
    "success": false
  }
]

bulkAddLookupFileLabels

Section titled “bulkAddLookupFileLabels”

Add labels to multiple lookup files (max 100 items, non-transactional)

Method POST
Route /ngsiem-content/entities/bulk-lookupfile-labels-add/v1
Scope NGSIEM Lookup Files: WRITE
PEP 8 bulk_add_lookup_file_labels

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
items body · array
List of files with labels to add/remove/replace (max 100 items)
search_domain body · string
The search domain (view or repository) containing the files
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.bulk_add_lookup_file_labels(items=["string"],
                                              search_domain="string")
print(response)
Responses
[
  {
    "error": "string",
    "filename": "string",
    "labels": [],
    "success": false
  }
]

bulkAddSavedQueryLabels

Section titled “bulkAddSavedQueryLabels”

Add labels to multiple saved queries (max 100 items, non-transactional)

Method POST
Route /ngsiem-content/entities/bulk-savedquery-labels-add/v1
Scope NGSIEM Saved Queries: WRITE
PEP 8 bulk_add_saved_query_labels

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
items body · array
List of saved queries with labels to add/remove/replace (max 100 items)
search_domain body · string
The search domain (view or repository) containing the saved queries
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.bulk_add_saved_query_labels(items=["string"],
                                              search_domain="string")
print(response)
Responses
[
  {
    "error": "string",
    "id": "string",
    "labels": [],
    "name": "string",
    "success": false
  }
]

BulkCreateDashboardsFromTemplate

Section titled “BulkCreateDashboardsFromTemplate”

Create Multiple Dashboards from YAML Templates.

Method POST
Route /ngsiem-content/entities/bulk-dashboards-template/v1
Scope NGSIEM Dashboards: WRITE
PEP 8 bulk_create_dashboards_from_template

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
dashboard_items body · array
List of dashboards to create
search_domain body · string
The name of the search domain where the dashboards will be created
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.bulk_create_dashboards_from_template(dashboard_items=["string"],
                                                       search_domain="string")
print(response)
Responses
[
  {
    "error": "string",
    "id": "string",
    "success": false
  }
]

BulkCreateLookupFiles

Section titled “BulkCreateLookupFiles”

Create Multiple Lookup Files.

Method POST
Route /ngsiem-content/entities/bulk-lookupfiles/v1
Scope NGSIEM Lookup Files: WRITE
PEP 8 bulk_create_lookup_files

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
lookup_files body · array
List of lookup files to create
search_domain body · string
The name of the search domain where the lookup files will be created
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.bulk_create_lookup_files(lookup_files=["string"],
                                           search_domain="string")
print(response)
Responses
[
  {
    "error": "string",
    "filename": "string",
    "success": false
  }
]

BulkCreateSavedQueriesFromTemplate

Section titled “BulkCreateSavedQueriesFromTemplate”

Create Multiple Saved Queries from LogScale YAML Templates.

Method POST
Route /ngsiem-content/entities/bulk-savedqueries-template/v1
Scope NGSIEM Saved Queries: WRITE
PEP 8 bulk_create_saved_queries_from_template

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
saved_query_items body · array
List of saved queries to create
search_domain body · string
The name of the search domain where saved queries will be created
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.bulk_create_saved_queries_from_template(saved_query_items=["string"],
                                                          search_domain="string")
print(response)
Responses
[
  {
    "error": "string",
    "id": "string",
    "success": false
  }
]

BulkGetLookupFiles

Section titled “BulkGetLookupFiles”

Retrieve Multiple Lookup Files by Filenames in NGSIEM.

Method GET
Route /ngsiem-content/entities/bulk-lookupfiles/v1
Scope NGSIEM Lookup Files: READ
PEP 8 bulk_get_lookup_files

Parameters

Section titled “Parameters”
filename query · string or list of strings
Lookup file filename(s) (required, multiple allowed)
search_domain query · string
name of search domain (view or repo)
Available values (5)
allfalconthird-party
dashboardsparsers-repository
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.bulk_get_lookup_files(filename=id_list,
                                        search_domain="string")
print(response)
Responses
[
  {
    "content": "string",
    "filename": "string"
  }
]

BulkInstallParsers

Section titled “BulkInstallParsers”

Installs multiple CrowdStrike-managed out-of-the-box (OOTB) parsers into the customer’s repository in a single operation.

Method POST
Route /ngsiem-content/entities/parsers/bulk-install/v1
Scope NGSIEM Parsers: WRITE
PEP 8 bulk_install_parsers

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
parsers body · array
List of parser objects containing parser_id and version.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


parsers = [
    {
        "parser_id": "string",
        "version": "string"
    }
]


response = falcon.bulk_install_parsers(parsers=parsers)
print(response)
Responses
[
  {
    "error": "string",
    "parser_id": "string",
    "success": false
  }
]

bulkRemoveDashboardLabels

Section titled “bulkRemoveDashboardLabels”

Remove labels from multiple dashboards (max 100 items, non-transactional)

Method POST
Route /ngsiem-content/entities/bulk-dashboard-labels-remove/v1
Scope NGSIEM Dashboards: WRITE
PEP 8 bulk_remove_dashboard_labels

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
items body · array
List of dashboards with labels to add/remove/replace (max 100 items)
search_domain body · string
The search domain (view or repository) containing the dashboards
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.bulk_remove_dashboard_labels(items=["string"],
                                               search_domain="string")
print(response)
Responses
[
  {
    "error": "string",
    "id": "string",
    "labels": [],
    "name": "string",
    "success": false
  }
]

bulkRemoveLookupFileLabels

Section titled “bulkRemoveLookupFileLabels”

Remove labels from multiple lookup files (max 100 items, non-transactional)

Method POST
Route /ngsiem-content/entities/bulk-lookupfile-labels-remove/v1
Scope NGSIEM Lookup Files: WRITE
PEP 8 bulk_remove_lookup_file_labels

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
items body · array
List of files with labels to add/remove/replace (max 100 items)
search_domain body · string
The search domain (view or repository) containing the files
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.bulk_remove_lookup_file_labels(items=["string"],
                                                 search_domain="string")
print(response)
Responses
[
  {
    "error": "string",
    "filename": "string",
    "labels": [],
    "success": false
  }
]

bulkRemoveSavedQueryLabels

Section titled “bulkRemoveSavedQueryLabels”

Remove labels from multiple saved queries (max 100 items, non-transactional)

Method POST
Route /ngsiem-content/entities/bulk-savedquery-labels-remove/v1
Scope NGSIEM Saved Queries: WRITE
PEP 8 bulk_remove_saved_query_labels

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
items body · array
List of saved queries with labels to add/remove/replace (max 100 items)
search_domain body · string
The search domain (view or repository) containing the saved queries
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.bulk_remove_saved_query_labels(items=["string"],
                                                 search_domain="string")
print(response)
Responses
[
  {
    "error": "string",
    "id": "string",
    "labels": [],
    "name": "string",
    "success": false
  }
]

bulkUpdateDashboardLabels

Section titled “bulkUpdateDashboardLabels”

Replace all labels on multiple dashboards (max 100 items, non-transactional)

Method POST
Route /ngsiem-content/entities/bulk-dashboard-labels-replace/v1
Scope NGSIEM Dashboards: WRITE
PEP 8 bulk_update_dashboard_labels

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
items body · array
List of dashboards with labels to add/remove/replace (max 100 items)
search_domain body · string
The search domain (view or repository) containing the dashboards
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.bulk_update_dashboard_labels(items=["string"],
                                               search_domain="string")
print(response)
Responses
[
  {
    "error": "string",
    "id": "string",
    "labels": [],
    "name": "string",
    "success": false
  }
]

BulkUpdateDashboardsFromTemplate

Section titled “BulkUpdateDashboardsFromTemplate”

Update Multiple Dashboards from YAML Templates.

Method PATCH
Route /ngsiem-content/entities/bulk-dashboards-template/v1
Scope NGSIEM Dashboards: WRITE
PEP 8 bulk_update_dashboards_from_template

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
dashboard_items body · array
Array of dashboards to update with their IDs and YAML templates
search_domain body · string
The name of the search domain containing the dashboards
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.bulk_update_dashboards_from_template(dashboard_items=["string"],
                                                       search_domain="string")
print(response)
Responses
[
  {
    "error": "string",
    "id": "string",
    "success": false
  }
]

bulkUpdateLookupFileLabels

Section titled “bulkUpdateLookupFileLabels”

Replace all labels on multiple lookup files (max 100 items, non-transactional)

Method POST
Route /ngsiem-content/entities/bulk-lookupfile-labels-replace/v1
Scope NGSIEM Lookup Files: WRITE
PEP 8 bulk_update_lookup_file_labels

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
items body · array
List of files with labels to add/remove/replace (max 100 items)
search_domain body · string
The search domain (view or repository) containing the files
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.bulk_update_lookup_file_labels(items=["string"],
                                                 search_domain="string")
print(response)
Responses
[
  {
    "error": "string",
    "filename": "string",
    "labels": [],
    "success": false
  }
]

BulkUpdateLookupFiles

Section titled “BulkUpdateLookupFiles”

Update Multiple Lookup Files.

Method PATCH
Route /ngsiem-content/entities/bulk-lookupfiles/v1
Scope NGSIEM Lookup Files: WRITE
PEP 8 bulk_update_lookup_files

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
lookup_files body · array
List of lookup files to update
search_domain body · string
The name of the search domain containing the lookup files
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.bulk_update_lookup_files(lookup_files=["string"],
                                           search_domain="string")
print(response)
Responses
[
  {
    "error": "string",
    "filename": "string",
    "success": false
  }
]

BulkUpdateSavedQueriesFromTemplate

Section titled “BulkUpdateSavedQueriesFromTemplate”

Update Multiple Saved Queries from LogScale YAML Templates.

Method PATCH
Route /ngsiem-content/entities/bulk-savedqueries-template/v1
Scope NGSIEM Saved Queries: WRITE
PEP 8 bulk_update_saved_queries_from_template

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
saved_query_items body · array
Array of saved queries to update with their IDs and YAML templates
search_domain body · string
The name of the search domain containing the saved queries
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.bulk_update_saved_queries_from_template(saved_query_items=["string"],
                                                          search_domain="string")
print(response)
Responses
[
  {
    "error": "string",
    "id": "string",
    "success": false
  }
]

bulkUpdateSavedQueryLabels

Section titled “bulkUpdateSavedQueryLabels”

Replace all labels on multiple saved queries (max 100 items, non-transactional)

Method POST
Route /ngsiem-content/entities/bulk-savedquery-labels-replace/v1
Scope NGSIEM Saved Queries: WRITE
PEP 8 bulk_update_saved_query_labels

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
items body · array
List of saved queries with labels to add/remove/replace (max 100 items)
search_domain body · string
The search domain (view or repository) containing the saved queries
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.bulk_update_saved_query_labels(items=["string"],
                                                 search_domain="string")
print(response)
Responses
[
  {
    "error": "string",
    "id": "string",
    "labels": [],
    "name": "string",
    "success": false
  }
]

CloneParser

Section titled “CloneParser”

Clone an existing parser with a new name

Method POST
Route /ngsiem-content/entities/parsers-clone/v1
Scope NGSIEM Parsers: WRITE
PEP 8 clone_parser

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
new_name body · string
The name for the cloned parser
source_id body · string
The ID of the source parser to clone
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.clone_parser(new_name="string", source_id="string")
print(response)
Responses
{
  "id": "string",
  "name": "string"
}

CreateDashboardFromTemplate

Section titled “CreateDashboardFromTemplate”

Create Dashboard from LogScale YAML Template in NGSIEM

Method POST
Route /ngsiem-content/entities/dashboards-template/v1
Scope NGSIEM Dashboards: WRITE
PEP 8 create_dashboard_from_template

Parameters

Section titled “Parameters”
search_domain body · string
name of search domain (view or repo)
Available values (3)
allfalconthird-party
name body · string
name of the dashboard
yaml_template body · file
LogScale dashboard YAML template content, see schema at https://schemas.humio.com/
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.create_dashboard_from_template(search_domain="string",
                                                 name="string",
                                                 yaml_template="string")
print(response)
Responses
[
  "string"
]

CreateLookupFile

Section titled “CreateLookupFile”

Create Lookup File in NGSIEM

Method POST
Route /ngsiem-content/entities/lookupfiles/v1
Scope NGSIEM Lookup Files: WRITE
PEP 8 create_lookup_file

Parameters

Section titled “Parameters”
search_domain body · string
name of search domain (view or repo)
Available values (5)
allfalconfalcon-for-it
third-partyparsers-repository
filename body · string
Filename of the lookup file to create
file body · file
file content to upload
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.create_lookup_file(search_domain="string",
                                     filename="string",
                                     file="string")
print(response)
Responses
[
  "string"
]

CreateParser

Section titled “CreateParser”

Create Parser in NGSIEM.

Method POST
Route /ngsiem-content/entities/parsers/v1
Scope NGSIEM Parsers: WRITE
PEP 8 create_parser

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
fields_to_be_removed_before_parsing body · array
A list of fields that will be removed from the event before it’s parsed. These fields will not be included when calculating usage
fields_to_tag body · array
A list of fields that should be used for sharding. See https://library.humio.com/stable/docs/parsers/tagging/
name body · string
The name of parser template
repository body · string
The name of the repository where the parser will be created
script body · string
The parser script that transforms the input into events. Humio Language v1
test_cases body · array
A list of tests that the parser can be tested against
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


test_cases = [
    {
        "event": {
            "raw_string": "string"
        },
        "output_assertions": [
            {
                "assertions": {
                    "fields_have_values": [
                        {
                            "expected_value": "string",
                            "field_name": "string"
                        }
                    ],
                    "fields_not_present": [
                        "string"
                    ]
                },
                "output_event_index": 0
            }
        ]
    }
]


response = falcon.create_parser(fields_to_be_removed_before_parsing=id_list,
                                fields_to_tag=id_list,
                                name="string",
                                repository="string",
                                script="string",
                                test_cases=test_cases)
print(response)
Responses
[
  "string"
]

CreateParserExtension

Section titled “CreateParserExtension”

Create a Parser extension in NGSIEM for the provided base parser.

Method POST
Route /ngsiem-content/entities/parsers-extensions/v1
Scope NGSIEM Parsers: WRITE
PEP 8 create_parser_extension

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
base_parser_id body · string
The base_parser_id value.
extension_name body · string
The extension_name value.
parser_id body · string
The parser_id value.
post_processing_script body · string
The post_processing_script value.
pre_processing_script body · string
The pre_processing_script value.
test_cases body · array
The test_cases value.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.create_parser_extension(base_parser_id="string",
                                          extension_name="string",
                                          parser_id="string",
                                          post_processing_script="string",
                                          pre_processing_script="string",
                                          test_cases=["string"])
print(response)
Responses
[
  "string"
]

CreateParserFromTemplate

Section titled “CreateParserFromTemplate”

Create Parser from LogScale YAML Template in NGSIEM

Method POST
Route /ngsiem-content/entities/parsers-template/v1
Scope NGSIEM Parsers: WRITE
PEP 8 create_parser_from_template

Parameters

Section titled “Parameters”
repository body · string
name of repository
Available values (1)
parsers-repository
yaml_template body · file
LogScale Parser YAML template content, see schema at https://schemas.humio.com/
name body · string
Name of the parser.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.create_parser_from_template(repository="string",
                                              name="string",
                                              yaml_template="string")
print(response)
Responses
[
  "string"
]

CreateSavedQuery

Section titled “CreateSavedQuery”

Create Saved Query from LogScale YAML Template in NGSIEM

Method POST
Route /ngsiem-content/entities/savedqueries-template/v1
Scope NGSIEM Saved Queries: WRITE
PEP 8 create_saved_query

Parameters

Section titled “Parameters”
search_domain body · string
name of search domain (view or repo)
Available values (3)
allfalconthird-party
yaml_template body · file
LogScale Saved Query YAML template content, see schema at https://schemas.humio.com/
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.create_saved_query(search_domain="string",
                                     yaml_template="string")
print(response)
Responses
[
  "string"
]

DeleteDashboard

Section titled “DeleteDashboard”

Delete Dashboard in NGSIEM

Method DELETE
Route /ngsiem-content/entities/dashboards/v1
Scope NGSIEM Dashboards: WRITE
PEP 8 delete_dashboard

Parameters

Section titled “Parameters”
ids query · string or list of strings
dashboard ID value(s). Supports single or multiple IDs for bulk delete.
search_domain query · string
name of search domain (view or repo)
Available values (3)
allfalconthird-party
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.delete_dashboard(ids=id_list, search_domain="string")
print(response)
Responses
[
  "string"
]

DeleteLookupFile

Section titled “DeleteLookupFile”

Delete Lookup File in NGSIEM

Method DELETE
Route /ngsiem-content/entities/lookupfiles/v1
Scope NGSIEM Lookup Files: WRITE
PEP 8 delete_lookup_file

Parameters

Section titled “Parameters”
filename query · string or list of strings
lookup file filename(s). Supports single or multiple filenames for bulk delete.
search_domain query · string
name of search domain (view or repo)
Available values (4)
allfalconthird-party
parsers-repository
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.delete_lookup_file(filename=id_list, search_domain="string")
print(response)
Responses
[
  "string"
]

DeleteParser

Section titled “DeleteParser”

Delete Parser in NGSIEM

Method DELETE
Route /ngsiem-content/entities/parsers/v1
Scope NGSIEM Parsers: WRITE
PEP 8 delete_parser

Parameters

Section titled “Parameters”
ids query · string
parser ID value
repository query · string
name of repository
Available values (1)
parsers-repository
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.delete_parser(ids=id_list, repository="string")
print(response)
Responses
[
  "string"
]

DeleteSavedQuery

Section titled “DeleteSavedQuery”

Delete Saved Query in NGSIEM

Method DELETE
Route /ngsiem-content/entities/savedqueries/v1
Scope NGSIEM Saved Queries: WRITE
PEP 8 delete_saved_query

Parameters

Section titled “Parameters”
ids query · string or list of strings
saved query ID value(s). Supports single or multiple IDs for bulk delete.
search_domain query · string
name of search domain (view or repo)
Available values (3)
allfalconthird-party
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.delete_saved_query(ids=id_list, search_domain="string")
print(response)
Responses
[
  "string"
]

ExternalCreateConnectorConfig

Section titled “ExternalCreateConnectorConfig”

Create a new configuration for a data connector

Method POST
Route /ngsiem/entities/connectors/configs/v1
Scope NGSIEM Data Connections API: WRITE
PEP 8 create_connector_config

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
config body · object
Configuration details for the connector including authentication and parameters.
connector_id body · string
Unique identifier of the data connector.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


config = {
    "auth": {},
    "name": "string",
    "params": {}
}


response = falcon.create_connector_config(config=config, connector_id="string")
print(response)
Responses
{
  "id": "string"
}

ExternalCreateDataConnection

Section titled “ExternalCreateDataConnection”

Create a new data connection

Method POST
Route /ngsiem/entities/connections/v1
Scope NGSIEM Data Connections API: WRITE
PEP 8 create_data_connection

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
config body · object
Configuration settings for the data connection, including auth and params.
config_id body · string
Identifier of the connector configuration to use.
connector_id body · string
Identifier of the connector for this data connection.
connector_type body · string
Type of the connector.
custom body · object
Custom properties for the data connection, such as connector-specific configuration keys (e.g., PluginConfigID).
description body · string
Description of the data connection.
enable_host_enrichment body · boolean
Flag to enable host enrichment on ingested data.
enable_user_enrichment body · boolean
Flag to enable user enrichment on ingested data.
log_sources body · array
Log sources associated with this data connection.
name body · string
Name of the data connection.
parser body · string
Parser to use for processing ingested data.
vendor_name body · string
Name of the vendor providing the data.
vendor_product_name body · string
Name of the vendor product providing the data.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


config = {
    "auth": {},
    "name": "string",
    "params": {}
}


custom = {
    "additionalProp1": "string"
}


response = falcon.create_data_connection(config=config,
                                         config_id="string",
                                         connector_id="string",
                                         connector_type="string",
                                         custom=custom,
                                         description="string",
                                         enable_host_enrichment=boolean,
                                         enable_user_enrichment=boolean,
                                         log_sources=id_list,
                                         name="string",
                                         parser="string",
                                         vendor_name="string",
                                         vendor_product_name="string")
print(response)
Responses
[
  {
    "id": "string"
  }
]

ExternalDeleteConnectorConfigs

Section titled “ExternalDeleteConnectorConfigs”

Delete data connection config

Method DELETE
Route /ngsiem/entities/connectors/configs/v1
Scope NGSIEM Data Connections API: WRITE
PEP 8 delete_connector_configs

Parameters

Section titled “Parameters”
connector_id query · string
Unique identifier of the connector
ids query · string or list of strings
Unique identifiers of the config(s) to delete
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.delete_connector_configs(connector_id="string", ids=id_list)
print(response)
Responses
[
  {
    "id": "string",
    "path": "string"
  }
]

ExternalDeleteDataConnection

Section titled “ExternalDeleteDataConnection”

Delete a data connection

Method DELETE
Route /ngsiem/entities/connections/v1
Scope NGSIEM Data Connections API: WRITE
PEP 8 delete_data_connection

Parameters

Section titled “Parameters”
ids query · string
Unique identifier of the data connection
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.delete_data_connection(ids=id_list)
print(response)
Responses
[
  {
    "id": "string",
    "path": "string"
  }
]

ExternalGetDataConnectionByID

Section titled “ExternalGetDataConnectionByID”

Get data connection by ID

Method GET
Route /ngsiem/entities/connections/v1
Scope NGSIEM Data Connections API: READ
PEP 8 get_connection_by_id

Parameters

Section titled “Parameters”
ids query · string or list of strings
Unique identifier of the data connection
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_connection_by_id(ids=id_list)
print(response)
Responses
[
  {
    "id": "string",
    "ingest_url": "string",
    "last_ingested": "string",
    "last_ingested_volume_one_day": "string",
    "name": "string",
    "parser_name": "string",
    "source_type": "string",
    "status": "string",
    "sub_connections": [],
    "vendor_name": "string",
    "vendor_product_name": "string"
  }
]

ExternalGetDataConnectionStatus

Section titled “ExternalGetDataConnectionStatus”

Get data connection provisioning status

Method GET
Route /ngsiem/entities/connections/status/v1
Scope NGSIEM Data Connections API: READ
PEP 8 get_provisioning_status

Parameters

Section titled “Parameters”
ids query · string or list of strings
Unique identifier of the data connection
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_provisioning_status(ids=id_list)
print(response)
Responses
[
  {
    "id": "string",
    "last_ingested_ts": "string",
    "last_ingested_volume_one_day": "string",
    "status": "string"
  }
]

ExternalGetDataConnectionToken

Section titled “ExternalGetDataConnectionToken”

Get Ingest token for data connection

Method GET
Route /ngsiem/entities/connections/token/v1
Scope NGSIEM Data Connections API: READ
PEP 8 get_ingest_token

Parameters

Section titled “Parameters”
ids query · string
Unique identifier of the data connection
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_ingest_token(ids=id_list)
print(response)
Responses
{
  "created_at": "string",
  "expires_at": "string",
  "ingest_url": "string",
  "token": "string"
}

ExternalListConnectorConfigs

Section titled “ExternalListConnectorConfigs”

List configurations for a data connector

Method GET
Route /ngsiem/entities/connectors/configs/v1
Scope NGSIEM Data Connections API: READ
PEP 8 list_connector_configs

Parameters

Section titled “Parameters”
ids query · string
Unique identifier of the data connector
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.list_connector_configs(ids=id_list)
print(response)
Responses
[
  {
    "id": "string",
    "name": "string",
    "params": {}
  }
]

ExternalListDataConnections

Section titled “ExternalListDataConnections”

List and search data connections

Method GET
Route /ngsiem/combined/connections/v1
Scope NGSIEM Data Connections API: READ
PEP 8 list_data_connections

Parameters

Section titled “Parameters”
filter query · string
Optional filter criteria in FQL format.
offset query · integer
Starting position for pagination
limit query · integer
Maximum number of items to return
sort query · string
Sort field and direction.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.list_data_connections(filter="string",
                                        offset=integer,
                                        limit=integer,
                                        sort="string")
print(response)
Responses
[
  {
    "id": "string",
    "ingest_url": "string",
    "last_ingested": "string",
    "last_ingested_volume_one_day": "string",
    "name": "string",
    "parser_name": "string",
    "source_type": "string",
    "status": "string",
    "sub_connections": [],
    "vendor_name": "string",
    "vendor_product_name": "string"
  }
]

ExternalListDataConnectors

Section titled “ExternalListDataConnectors”

List available data connectors

Method GET
Route /ngsiem/combined/connectors/v1
Scope NGSIEM Data Connections API: READ
PEP 8 list_data_connectors

Parameters

Section titled “Parameters”
filter query · string
Optional filter criteria in FQL format.
offset query · integer
Starting position for pagination
limit query · integer
Maximum number of items to return
sort query · string
Sort field and direction.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.list_data_connectors(filter="string",
                                       offset=integer,
                                       limit=integer,
                                       sort="string")
print(response)
Responses
[
  {
    "description": "string",
    "id": "string",
    "log_sources": [],
    "name": "string",
    "parsers": [],
    "subscription": "string",
    "type": "string",
    "vendor_name": "string",
    "vendor_product_name": "string"
  }
]

ExternalPatchConnectorConfig

Section titled “ExternalPatchConnectorConfig”

Patch configurations for a data connector

Method PATCH
Route /ngsiem/entities/connectors/configs/v1
Scope NGSIEM Data Connections API: WRITE
PEP 8 patch_connector_config

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
config body · object
Configuration details for the connector including authentication and parameters.
connector_id body · string
Unique identifier of the data connector.
ids query · string
Unique id of the config to update
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


config = {
    "auth": {},
    "name": "string",
    "params": {}
}


response = falcon.patch_connector_config(ids=id_list,
                                         config=config,
                                         connector_id="string")
print(response)
Responses
[
  {
    "id": "string",
    "path": "string"
  }
]

ExternalRegenerateDataConnectionToken

Section titled “ExternalRegenerateDataConnectionToken”

Regenerate Ingest token for data connection

Method POST
Route /ngsiem/entities/connections/token/v1
Scope NGSIEM Data Connections API: WRITE
PEP 8 regenerate_ingest_token

Parameters

Section titled “Parameters”
ids query · string
Unique identifier of the data connection
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.regenerate_ingest_token(ids=id_list)
print(response)
Responses
{
  "created_at": "string",
  "expires_at": "string",
  "ingest_url": "string",
  "token": "string"
}

ExternalUpdateDataConnection

Section titled “ExternalUpdateDataConnection”

Update a data connection

Method PATCH
Route /ngsiem/entities/connections/v1
Scope NGSIEM Data Connections API: WRITE
PEP 8 update_data_connection

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
config body · object
Configuration settings for the data connection, including auth and params.
config_id body · string
Identifier of the connector configuration to use.
custom body · object
description body · string
Description of the data connection.
enable_host_enrichment body · boolean
Flag to enable host enrichment on ingested data.
enable_user_enrichment body · boolean
Flag to enable user enrichment on ingested data.
log_sources body · array
name body · string
Name of the data connection.
parser body · string
Parser to use for processing ingested data.
ids query · string
Unique identifier of the data connection
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


config = {
    "auth": {},
    "name": "string",
    "params": {}
}


response = falcon.update_data_connection(ids=id_list,
                                         config=config,
                                         config_id="string",
                                         description="string",
                                         enable_host_enrichment=boolean,
                                         enable_user_enrichment=boolean,
                                         name="string",
                                         parser="string")
print(response)
Responses
[
  {
    "id": "string",
    "path": "string"
  }
]

ExternalUpdateDataConnectionStatus

Section titled “ExternalUpdateDataConnectionStatus”

Update data connection status

Method PATCH
Route /ngsiem/entities/connections/status/v1
Scope NGSIEM Data Connections API: WRITE
PEP 8 update_connection_status

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
status body · string
The status of the data connection.
ids query · string
Unique identifier of the data connection
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.update_connection_status(ids=id_list, status="string")
print(response)
Responses
[
  {
    "id": "string",
    "last_ingested_ts": "string",
    "last_ingested_volume_one_day": "string",
    "status": "string"
  }
]

GetDashboardTemplate

Section titled “GetDashboardTemplate”

Retrieve Dashboard(s) in NGSIEM as LogScale YAML Template.

Method GET
Route /ngsiem-content/entities/dashboards-template/v1
Scope NGSIEM Dashboards: READ
PEP 8 get_dashboard_template

Parameters

Section titled “Parameters”
ids query · string or list of strings
dashboard ID value(s)
search_domain query · string
name of search domain (view or repo)
Available values (4)
allfalconthird-party
dashboards
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_dashboard_template(ids=id_list, search_domain="string")
print(response)
Responses
[
  {
    "id": "string",
    "labels": [],
    "name": "string",
    "yaml_template": "string"
  }
]

GetLookupFile

Section titled “GetLookupFile”

Retrieve Lookup File in NGSIEM

Method GET
Route /ngsiem-content/entities/lookupfiles/v1
Scope NGSIEM Lookup Files: READ
PEP 8 get_lookup_file

Parameters

Section titled “Parameters”
filename query · string
lookup file filename
search_domain query · string
name of search domain (view or repo)
Available values (5)
allfalconthird-party
dashboardsparsers-repository
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


with open("output_file", "wb") as save_file:
    response = falcon.get_lookup_file(filename="string",
                                      search_domain="string",
                                      stream=boolean)
    save_file.write(response)
Responses
{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

GetLookupFromPackageV1

Section titled “GetLookupFromPackageV1”

Download lookup file in package from NGSIEM

Method GET
Route /humio/api/v1/repositories/{repository}/files/{package}/{filename}
Scope NGSIEM: READ
PEP 8 get_file_from_package

Parameters

Section titled “Parameters”
repository path · string
name of repository
package path · string
name of package
filename path · string
name of lookup file
stream body · boolean
Enable streaming download of the returned response.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


with open("output_file", "wb") as save_file:
    response = falcon.get_file_from_package(repository="string",
                                            package="string",
                                            filename="string",
                                            stream=boolean,
                                            stream=boolean)
    save_file.write(response)
Responses
{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

GetLookupFromPackageWithNamespaceV1

Section titled “GetLookupFromPackageWithNamespaceV1”

Download lookup file in namespaced package from NGSIEM

Method GET
Route /humio/api/v1/repositories/{repository}/files/{namespace}/{package}/{filename}
Scope NGSIEM: READ
PEP 8 get_file_from_package_with_namespace

Parameters

Section titled “Parameters”
repository path · string
name of repository
namespace path · string
name of namespace
package path · string
name of package
filename path · string
name of lookup file
stream body · boolean
Enable streaming download of the returned file.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


with open("output_file", "wb") as save_file:
    response = falcon.get_file_from_package_with_namespace(repository="string",
                                                           namespace="string",
                                                           package="string",
                                                           filename="string",
                                                           stream=boolean,
                                                           stream=boolean)
    save_file.write(response)
Responses
{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

GetLookupV1

Section titled “GetLookupV1”

Download lookup file from NGSIEM

Method GET
Route /humio/api/v1/repositories/{repository}/files/{filename}
Scope NGSIEM: READ
PEP 8 get_file

Parameters

Section titled “Parameters”
repository path · string
name of repository
filename path · string
name of lookup file
stream body · boolean
Enable streaming download of the returned file.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


with open("output_file", "wb") as save_file:
    response = falcon.get_file(repository="string",
                               filename="string",
                               stream=boolean,
                               stream=boolean)
    save_file.write(response)
Responses
{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

GetParser

Section titled “GetParser”

Retrieve Parser in NGSIEM.

Method GET
Route /ngsiem-content/entities/parsers/v1
Scope NGSIEM Parsers: READ
PEP 8 get_parser

Parameters

Section titled “Parameters”
ids query · string
parser ID value
repository query · string
name of repository
Available values (1)
parsers-repository
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_parser(ids=id_list, repository="string")
print(response)
Responses
[
  {
    "description": "string",
    "display_name": "string",
    "fields_to_be_removed_before_parsing": [],
    "fields_to_tag": [],
    "id": "string",
    "is_built_in": false,
    "name": "string",
    "package_id": "string",
    "script": "string",
    "test_cases": []
  }
]

GetParserTemplate

Section titled “GetParserTemplate”

Retrieve Parser in NGSIEM as LogScale YAML Template

Method GET
Route /ngsiem-content/entities/parsers-template/v1
Scope NGSIEM Parsers: READ
PEP 8 get_parser_template

Parameters

Section titled “Parameters”
ids query · string
parser ID value
repository query · string
name of repository
Available values (1)
parsers-repository
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_parser_template(ids=id_list, repository="string")
print(response)
Responses
[
  {
    "id": "string",
    "name": "string",
    "yaml_template": "string"
  }
]

GetSavedQueryTemplate

Section titled “GetSavedQueryTemplate”

Retrieve Saved Quer(ies) in NGSIEM as LogScale YAML Template.

Method GET
Route /ngsiem-content/entities/savedqueries-template/v1
Scope NGSIEM Saved Queries: READ
PEP 8 get_saved_query_template

Parameters

Section titled “Parameters”
ids query · string or list of strings
saved query ID value(s)
search_domain query · string
name of search domain (view or repo)
Available values (4)
allfalconthird-party
dashboards
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_saved_query_template(ids=id_list, search_domain="string")
print(response)
Responses
[
  {
    "id": "string",
    "name": "string",
    "yaml_template": "string"
  }
]

GetSearchStatusV1

Section titled “GetSearchStatusV1”

Get status of search

Method GET
Route /humio/api/v1/repositories/{repository}/queryjobs/{id}
Scope NGSIEM: READ
PEP 8 get_search_status

Parameters

Section titled “Parameters”
repository path · string
name of repository
id path · string
id of query
search_id body · string
ID of the query. Can be used instead of id keyword.
paginationLimit body · integer
Optional pagination limit.
paginationOffset body · integer
Optional pagination offset.
pagination_limit body · integer
Optional pagination limit (alias for paginationLimit)
pagination_offset body · integer
Optional pagination offset (alias for paginationOffset)
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.get_search_status(repository="string",
                                    id="string",
                                    search_id="string",
                                    paginationLimit=integer,
                                    paginationOffset=integer,
                                    pagination_limit=integer,
                                    pagination_offset=integer)
print(response)
Responses
{
  "cancelled": false,
  "done": false,
  "events": [
    {}
  ],
  "filesUsed": [
    {}
  ],
  "filterMatches": [
    {}
  ],
  "metaData": {
    "costs": {
      "liveCost": 0.0,
      "liveCostRate": 0.0,
      "staticCost": 0.0,
      "staticCostRate": 0.0
    },
    "digestFlow": {
      "ingestTimeKnownGood": 0,
      "maxIngestLatency": 0,
      "minIngestTimeIncluded": 0
    },
    "eventCount": 0,
    "extraData": {},
    "fieldOrder": [],
    "filterQuery": {},
    "isAggregate": false,
    "pollAfter": 0,
    "processedBytes": 0,
    "processedEvents": 0,
    "queryEnd": 0,
    "querySpent": {
      "day": {},
      "hour": {},
      "oneMinute": {},
      "tenMinutes": {}
    },
    "queryStart": 0,
    "queuedMillis": 0,
    "quotaTotalSpent": {
      "day": {},
      "hour": {},
      "oneMinute": {},
      "tenMinutes": {}
    },
    "responderVHost": 0,
    "resultBufferSize": 0,
    "timeMillis": 0,
    "totalWork": 0,
    "warning": "string",
    "warnings": [],
    "workDone": 0
  },
  "queryEventDistribution": {
    "bucket_first_bucket": "string",
    "bucket_last_bucket": "string",
    "bucket_span_humanized": "string",
    "bucket_span_millis": "string"
  },
  "warnings": [
    {
      "category": "string",
      "classification": "string",
      "code": "string",
      "message": "string"
    }
  ]
}

InstallParser

Section titled “InstallParser”

Installs a CrowdStrike-managed out-of-the-box (OOTB) parser into the customer’s repository.

Method POST
Route /ngsiem-content/entities/parsers/install/v1
Scope NGSIEM Parsers: WRITE
PEP 8 install_parser

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
parser_id body · string
The unique identifier of the parser to install.
version body · string
The version of the parser to install.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.install_parser(parser_id="string", version="string")
print(response)
Responses
{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "parser_id": "string"
}

ListDashboards

Section titled “ListDashboards”

List Dashboards in NGSIEM with Pagination and Filtering.

Method GET
Route /ngsiem-content/queries/dashboards/v1
Scope NGSIEM Dashboards: READ
PEP 8 list_dashboards

Parameters

Section titled “Parameters”
limit query · string
maximum number of results to return
offset query · string
number of results to offset the returned results by
filter query · string
FQL filter to apply to the name of the content, only currently support text match on name field: name:~‘value’
search_domain query · string
name of search domain (view or repo)
Available values (4)
allfalconthird-party
dashboards
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.list_dashboards(limit="string",
                                  offset="string",
                                  filter="string",
                                  search_domain="string")
print(response)
Responses
[
  "string"
]

ListLookupFiles

Section titled “ListLookupFiles”

List Lookup Files in NGSIEM with Pagination and Filtering.

Method GET
Route /ngsiem-content/queries/lookupfiles/v1
Scope NGSIEM Lookup Files: READ
PEP 8 list_lookup_files

Parameters

Section titled “Parameters”
limit query · string
maximum number of results to return
offset query · string
number of results to offset the returned results by
filter query · string
FQL filter to apply to the name of the content, only currently support text match on name field: name:~‘value’
search_domain query · string
name of search domain (view or repo)
Available values (5)
allfalconthird-party
dashboardsparsers-repository
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.list_lookup_files(limit="string",
                                    offset="string",
                                    filter="string",
                                    search_domain="string")
print(response)
Responses
[
  "string"
]

ListParsers

Section titled “ListParsers”

List Parsers in NGSIEM

Method GET
Route /ngsiem-content/queries/parsers/v1
Scope NGSIEM Parsers: READ
PEP 8 list_parsers

Parameters

Section titled “Parameters”
limit query · string
maximum number of results to return
offset query · string
number of results to offset the returned results by
filter query · string
FQL filter to apply to the name of the content, only currently support text match on name field: name:~‘value’
repository query · string
name of repository
Available values (1)
parsers-repository
update_available query · string
filter parsers by update availability
Available values (2)
truefalse
parser_type query · string
filter parsers by type
Available values (3)
ootbcustomextension
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.list_parsers(limit="string",
                               offset="string",
                               filter="string",
                               repository="string",
                               update_available="string",
                               parser_type="string")
print(response)
Responses
[
  {
    "ID": "string",
    "Name": "string",
    "built_by": "string",
    "changelog": "string",
    "current_version": "string",
    "impacted_connections": false,
    "latest_version": "string",
    "parser_type": "string",
    "pass_through_alerts": false,
    "product": [],
    "update_available": false,
    "vendor": "string",
    "version": "string"
  }
]

ListSavedQueries

Section titled “ListSavedQueries”

List Saved Queries in NGSIEM with Pagination and Filtering.

Method GET
Route /ngsiem-content/queries/savedqueries/v1
Scope NGSIEM Saved Queries: READ
PEP 8 list_saved_queries

Parameters

Section titled “Parameters”
limit query · string
maximum number of results to return
offset query · string
number of results to offset the returned results by
filter query · string
FQL filter to apply to the name of the content, only currently support text match on name field: name:~‘value’
search_domain query · string
name of search domain (view or repo)
Available values (4)
allfalconthird-party
dashboards
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.list_saved_queries(limit="string",
                                     offset="string",
                                     filter="string",
                                     search_domain="string")
print(response)
Responses
[
  "string"
]

removeDashboardLabels

Section titled “removeDashboardLabels”

Remove multiple labels from a single dashboard

Method DELETE
Route /ngsiem-content/entities/dashboard-labels/v1
Scope NGSIEM Dashboards: WRITE
PEP 8 remove_dashboard_labels

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
id body · string
The unique identifier of the dashboard
labels body · array
The labels to remove (max 10 labels, max 60 chars each)
search_domain body · string
The search domain (view or repository) containing the dashboard
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.remove_dashboard_labels(id="string",
                                          labels=["string"],
                                          search_domain="string")
print(response)
Responses
[
  {
    "id": "string",
    "labels": [],
    "name": "string"
  }
]

removeFileLabels

Section titled “removeFileLabels”

Remove multiple labels from a single file

Method DELETE
Route /ngsiem-content/entities/lookupfile-labels/v1
Scope NGSIEM Lookup Files: WRITE
PEP 8 remove_file_labels

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
filename body · string
The name of the lookup file
labels body · array
The labels to remove
search_domain body · string
The search domain (view or repository) containing the file
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.remove_file_labels(filename="string",
                                     labels=["string"],
                                     search_domain="string")
print(response)
Responses
[
  {
    "filename": "string",
    "labels": []
  }
]

removeSavedQueryLabels

Section titled “removeSavedQueryLabels”

Remove multiple labels from a saved query

Method DELETE
Route /ngsiem-content/entities/savedquery-labels/v1
Scope NGSIEM Saved Queries: WRITE
PEP 8 remove_saved_query_labels

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
id body · string
The unique identifier of the saved query
labels body · array
The labels to remove (max 10 labels, max 60 chars each)
search_domain body · string
The search domain (view or repository) containing the saved query
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.remove_saved_query_labels(id="string",
                                            labels=["string"],
                                            search_domain="string")
print(response)
Responses
[
  {
    "id": "string",
    "labels": [],
    "name": "string"
  }
]

StartSearchV1

Section titled “StartSearchV1”

Initiate search

Method POST
Route /humio/api/v1/repositories/{repository}/queryjobs
Scope NGSIEM: WRITE
PEP 8 start_search

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
allow_event_skipping body · boolean
Enables some LogScale functions, such as head() and tail(), to stop processing all data in the selected timeframe and exit the query early
allowEventSkipping body · boolean
Enables some LogScale functions, such as head() and tail(), to stop processing all data in the selected timeframe and exit the query early
AllowEventSkipping body · boolean
Enables some LogScale functions, such as head() and tail(), to stop processing all data in the selected timeframe and exit the query early
arguments body · object
JSON blob with parameters defined in query
around body · object
Find events that occurred around the time of a specific event.
autobucket_count body · integer
The number of buckets the system should create during live query searches, when no other explicit bucketing aggregate is specified
autobucketCount body · integer
The number of buckets the system should create during live query searches, when no other explicit bucketing aggregate is specified
AutobucketCount body · integer
The number of buckets the system should create during live query searches, when no other explicit bucketing aggregate is specified
end body · string
The date and time to use as the ending point of the search results
ingest_end body · string
The end date and time applied for @ingesttimestamp
ingestEnd body · string
The end date and time applied for @ingesttimestamp
IngestEnd body · string
The end date and time applied for @ingesttimestamp
ingest_start body · string
The end date and time applied for @ingesttimestamp
ingestStart body · string
The end date and time applied for @ingesttimestamp
IngestStart body · string
The end date and time applied for @ingesttimestamp
is_live body · boolean
Sets whether this query is live. Defaults to false . Live queries are continuously updated.
isLive body · boolean
Sets whether this query is live. Defaults to false . Live queries are continuously updated.
IsLive body · boolean
Sets whether this query is live. Defaults to false . Live queries are continuously updated.
query_string body · string
The CQL query to use for the search
queryString body · string
The CQL query to use for the search
QueryString body · string
The CQL query to use for the search
start body · string
The date and time to use as the starting point of the search results
time_zone body · string
The time zone to use if start and end times are not specified in milliseconds. Eg: UTC
timeZone body · string
The time zone to use if start and end times are not specified in milliseconds. Eg: UTC
TimeZone body · string
The time zone to use if start and end times are not specified in milliseconds. Eg: UTC
time_zone_offset_minutes body · integer
A positive or negative number representing how many minutes a given time zone is ahead or behind Coordinated Universal Time (UTC)
timeZoneOffsetMinutes body · integer
A positive or negative number representing how many minutes a given time zone is ahead or behind Coordinated Universal Time (UTC)
TimeZoneOffsetMinutes body · integer
A positive or negative number representing how many minutes a given time zone is ahead or behind Coordinated Universal Time (UTC)
use_ingest_time body · boolean
When set to true, the event’s ingestStart and ingestEnd times are used as the basis for the query timespan rather than the start and end timestamps
useIngestTime body · boolean
When set to true, the event’s ingestStart and ingestEnd times are used as the basis for the query timespan rather than the start and end timestamps
UseIngestTime body · boolean
When set to true, the event’s ingestStart and ingestEnd times are used as the basis for the query timespan rather than the start and end timestamps
repository path · string
name of repository
search body · string
Search to perform. JSON formatted string. Can be used instead of body. Not required if using other keywords.
timezone_offset_minutes body · integer
Timezone offset.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


arguments = {}


around = {
    "eventId": "string",
    "numberOfEventsAfter": "integer",
    "numberOfEventsBefore": "integer",
    "timestamp": "integer"
}


response = falcon.start_search(allow_event_skipping=boolean,
                               arguments=arguments,
                               around=around,
                               autobucket_count=integer,
                               end="string",
                               ingest_end=integer,
                               ingest_start=integer,
                               is_live=boolean,
                               query_string="string",
                               repository="string",
                               search="string",
                               start="string",
                               timezone="string",
                               timezone_offset_minutes=integer)
print(response)
Responses
{
  "hashedQueryOnView": "string",
  "id": "string"
}

StopSearchV1

Section titled “StopSearchV1”

Stop search

Method DELETE
Route /humio/api/v1/repositories/{repository}/queryjobs/{id}
Scope NGSIEM: WRITE
PEP 8 stop_search

Parameters

Section titled “Parameters”
repository path · string
name of repository
id path · string
id of query
search_id body · string
ID of the query. Can be used instead of id keyword.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.stop_search(repository="string",
                              id="string",
                              search_id="string")
print(response)
Responses
{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

TestParserFromTemplate

Section titled “TestParserFromTemplate”

Test Parser from LogScale YAML Template in NGSIEM

Method POST
Route /ngsiem-content/entities/parsers-template-test/v1
Scope NGSIEM Parsers: READ
PEP 8 test_parser_from_template

Parameters

Section titled “Parameters”
yaml_template body · file
LogScale Parser YAML template content, see schema at https://schemas.humio.com/
schema_validation_enabled body · boolean
When true, schema validation is enforced (CPS) and validates against Crowdstrike Parsing Standard
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.test_parser_from_template(yaml_template="string",
                                            schema_validation_enabled=boolean)
print(response)
Responses
[
  {
    "results": []
  }
]

UpdateDashboardFromTemplate

Section titled “UpdateDashboardFromTemplate”

Update Dashboard from LogScale YAML Template in NGSIEM.

Method PATCH
Route /ngsiem-content/entities/dashboards-template/v1
Scope NGSIEM Dashboards: WRITE
PEP 8 update_dashboard_from_template

Parameters

Section titled “Parameters”
search_domain body · string
name of search domain (view or repo)
Available values (3)
allfalconthird-party
ids body · string
id of the dashboard
yaml_template body · file
LogScale dashboard YAML template content, see schema at https://schemas.humio.com/
name body · string
Name of the dashboard.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.update_dashboard_from_template(search_domain="string",
                                                 name="string",
                                                 yaml_template="string")
print(response)
Responses
[
  "string"
]

updateDashboardLabels

Section titled “updateDashboardLabels”

Replace all labels on a single dashboard

Method PUT
Route /ngsiem-content/entities/dashboard-labels/v1
Scope NGSIEM Dashboards: WRITE
PEP 8 update_dashboard_labels

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
id body · string
The unique identifier of the dashboard
labels body · array
The new labels (replaces all existing, max 10 labels, max 60 chars each)
search_domain body · string
The search domain (view or repository) containing the dashboard
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.update_dashboard_labels(id="string",
                                          labels=["string"],
                                          search_domain="string")
print(response)
Responses
[
  {
    "id": "string",
    "labels": [],
    "name": "string"
  }
]

updateFileLabels

Section titled “updateFileLabels”

Replace all labels on a single file

Method PUT
Route /ngsiem-content/entities/lookupfile-labels/v1
Scope NGSIEM Lookup Files: WRITE
PEP 8 update_file_labels

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
filename body · string
The name of the lookup file
labels body · array
The new labels (replaces all existing labels, max 10 labels, max 60 chars each)
search_domain body · string
The search domain (view or repository) containing the file
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.update_file_labels(filename="string",
                                     labels=["string"],
                                     search_domain="string")
print(response)
Responses
[
  {
    "filename": "string",
    "labels": []
  }
]

UpdateLookupFile

Section titled “UpdateLookupFile”

Update an entire Lookup File in NGSIEM

Method PATCH
Route /ngsiem-content/entities/lookupfiles/v1
Scope NGSIEM Lookup Files: WRITE
PEP 8 update_lookup_file

Parameters

Section titled “Parameters”
search_domain body · string
name of search domain (view or repo)
Available values (5)
allfalconfalcon-for-it
third-partyparsers-repository
filename body · string
Filename of the lookup file to update
file body · file
file content to upload
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.update_lookup_file(search_domain="string",
                                     filename="string",
                                     file="string")
print(response)
Responses
[
  "string"
]

UpdateLookupFileEntries

Section titled “UpdateLookupFileEntries”

Update entries in an existing Lookup File in NGSIEM

Method PATCH
Route /ngsiem-content/entities/lookupfiles-entries/v1
Scope NGSIEM Lookup Files: WRITE
PEP 8 update_lookup_file_entries

Parameters

Section titled “Parameters”
search_domain body · string
name of search domain (view or repo)
Available values (4)
allfalconthird-party
parsers-repository
filename body · string
Filename of the lookup file to update
file body · file
The file content for updating or appending the entries
update_mode body · string
How to update the file entries
Available values (2)
appendupdate
key_columns body · string
For update mode, the comma separated list of key columns to use when matching entries (REQUIRED when update_mode=update)
ignore_case body · string
For update mode, whether to ignore case when matching keys (REQUIRED when update_mode=update)
Available values (2)
truefalse
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.update_lookup_file_entries(search_domain="string",
                                             filename="string",
                                             file="string",
                                             update_mode="string",
                                             key_columns="string",
                                             ignore_case="string")
print(response)
Responses
[
  "string"
]

UpdateParser

Section titled “UpdateParser”

Update Parser in NGSIEM.

Method PATCH
Route /ngsiem-content/entities/parsers/v1
Scope NGSIEM Parsers: WRITE
PEP 8 update_parser

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
fields_to_be_removed_before_parsing body · array
A list of fields that will be removed from the event before it’s parsed. These fields will not be included when calculating usage
fields_to_tag body · array
A list of fields that should be used for sharding. See https://library.humio.com/stable/docs/parsers/tagging/
id body · string
The unique identifier of the parser to update
repository body · string
The name of the repository containing the parser
script body · string
The parser script that transforms the input into events. Humio Language v1
test_cases body · array
A list of tests that the parser can be tested against
name body · string
Parser name.
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


test_cases = [
    {
        "event": {
            "raw_string": "string"
        },
        "output_assertions": [
            {
                "assertions": {
                    "fields_have_values": [
                        {
                            "expected_value": "string",
                            "field_name": "string"
                        }
                    ],
                    "fields_not_present": [
                        "string"
                    ]
                },
                "output_event_index": 0
            }
        ]
    }
]


response = falcon.update_parser(fields_to_be_removed_before_parsing=id_list,
                                fields_to_tag=id_list,
                                id="string",
                                name="string",
                                repository="string",
                                script="string",
                                test_cases=test_cases)
print(response)
Responses
[
  "string"
]

UpdateParserAutoUpdatePolicy

Section titled “UpdateParserAutoUpdatePolicy”

Updates a parser auto update policy - ‘on’ enables auto-updates, ‘off’ disables them

Method PUT
Route /ngsiem-content/entities/parsers/autoupdate/v1
Scope NGSIEM Parsers: WRITE
PEP 8 update_parser_auto_update_policy

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
autoupdate_policy body · string
The auto-update policy setting: ‘on’ to enable auto-updates, ‘off’ to disable
reason body · string
The reason for disabling auto-updates (only used when policy is ‘off’)
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.update_parser_auto_update_policy(autoupdate_policy="string",
                                                   reason="string")
print(response)
Responses
{
  "autoupdate_policy": "string",
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "updated_at": "string"
}

UpdateParserExtension

Section titled “UpdateParserExtension”

Update an existing Parser extension in NGSIEM.

Method PATCH
Route /ngsiem-content/entities/parsers-extensions/v1
Scope NGSIEM Parsers: WRITE
PEP 8 update_parser_extension

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
extension_id body · string
The unique identifier of the parser extension to update
post_processing_script body · string
Optional - update postprocessing logic
pre_processing_script body · string
Optional - update preprocessing logic
test_cases body · array
Optional - update test cases
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.update_parser_extension(extension_id="string",
                                          post_processing_script="string",
                                          pre_processing_script="string",
                                          test_cases=["string"])
print(response)
Responses
[
  "string"
]

UpdateParserFromTemplate

Section titled “UpdateParserFromTemplate”

Update Parser in NGSIEM from YAML Template.

Method PATCH
Route /ngsiem-content/entities/parsers-template/v1
Scope NGSIEM Parsers: WRITE
PEP 8 update_parser_from_template

Parameters

Section titled “Parameters”
repository body · string
name of repository
Available values (1)
parsers-repository
ids body · string
id of the parser
yaml_template body · file
LogScale Parser YAML template content, see schema at https://schemas.humio.com/
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.update_parser_from_template(repository="string",
                                              ids=id_list,
                                              yaml_template="string")
print(response)
Responses
[
  "string"
]

UpdateSavedQueryFromTemplate

Section titled “UpdateSavedQueryFromTemplate”

Update Saved Query from LogScale YAML Template in NGSIEM.

Method PATCH
Route /ngsiem-content/entities/savedqueries-template/v1
Scope NGSIEM Saved Queries: WRITE
PEP 8 update_saved_query_from_template

Parameters

Section titled “Parameters”
search_domain body · string
name of search domain (view or repo)
Available values (3)
allfalconthird-party
ids body · string
id of the saved query
yaml_template body · file
LogScale Saved Query YAML template content, see schema at https://schemas.humio.com/
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.update_saved_query_from_template(ids=id_list,
                                                   search_domain="string",
                                                   yaml_template="string")
print(response)
Responses
[
  "string"
]

updateSavedQueryLabels

Section titled “updateSavedQueryLabels”

Replace all labels on a single saved query

Method PUT
Route /ngsiem-content/entities/savedquery-labels/v1
Scope NGSIEM Saved Queries: WRITE
PEP 8 update_saved_query_labels

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
id body · string
The unique identifier of the saved query
labels body · array
The new labels (replaces all existing labels, max 10 labels, max 60 chars each)
search_domain body · string
The search domain (view or repository) containing the saved query
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.update_saved_query_labels(id="string",
                                            labels=["string"],
                                            search_domain="string")
print(response)
Responses
[
  {
    "id": "string",
    "labels": [],
    "name": "string"
  }
]

UploadLookupV1

Section titled “UploadLookupV1”

Upload file to NGSIEM

Method POST
Route /humio/api/v1/repositories/{repository}/files
Scope NGSIEM: WRITE
PEP 8 upload_file

Parameters

Section titled “Parameters”
repository path · string
name of repository
file body · file
file to upload
lookup_file body · string
File to be uploaded. Binary data. (CSV format)
Code Examples
from falconpy import NGSIEM


falcon = NGSIEM(client_id=CLIENT_ID,
                client_secret=CLIENT_SECRET
                )


response = falcon.upload_file(lookup_file="string", repository="string")
print(response)
Responses
{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}
© 2026 CrowdStrike, Inc. All rights reserved. Privacy Notice Cookie Notice Terms of Use