Prevention Policy

The Prevention Policy service collection provides operations for managing Falcon prevention policies. Search for policies and their members, create and delete policies, update settings, perform actions such as enabling, disabling, or assigning host groups, and set policy precedence order across your environment.

Language	Last Update
Python	v1.4.6
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

Operation	Description
queryCombinedPreventionPolicyMembers `query_combined_policy_members`	Search for members of a Prevention Policy in your environment by providing a FQL filter and paging details. Returns a set of host details which match the filter criteria
queryCombinedPreventionPolicies `query_combined_policies`	Search for Prevention Policies in your environment by providing a FQL filter and paging details. Returns a set of Prevention Policies which match the filter criteria
performPreventionPoliciesAction `perform_policies_action`	Perform the specified action on the Prevention Policies specified in the request
setPreventionPoliciesPrecedence `set_policies_precedence`	Sets the precedence of Prevention Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence
getPreventionPolicies `get_policies`	Retrieve a set of Prevention Policies by specifying their IDs
createPreventionPolicies `create_policies`	Create Prevention Policies by specifying details about the policy to create
deletePreventionPolicies `delete_policies`	Delete a set of Prevention Policies by specifying their IDs
updatePreventionPolicies `update_policies`	Update Prevention Policies by specifying the ID of the policy and details to update
queryPreventionPolicyMembers `query_policy_members`	Search for members of a Prevention Policy in your environment by providing a FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria
queryPreventionPolicies `query_policies`	Search for Prevention Policies in your environment by providing a FQL filter and paging details. Returns a set of Prevention Policy IDs which match the filter criteria

queryCombinedPreventionPolicyMembers

Search for members of a Prevention Policy in your environment by providing a FQL filter and paging details. Returns a set of host details which match the filter criteria

GET /policy/combined/prevention-members/v1

Scope Prevention Policies: READ Consumes · Produces application/json

PEP 8 query_combined_policy_members

Parameters

Name	Type	Data type	Description
filter	query	string	FQL query expression that should be used to limit the results.
limit	query	integer	Maximum number of records to return. Max: 5000.
offset	query	string	Starting index of overall result set from which to return ids.
id	query	string	The ID of the Prevention Policy to search for members of.
sort	query	string	The property to sort by.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import PreventionPolicy

falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.query_combined_policy_members(id="string",
                                                filter="string",
                                                limit=integer,
                                                offset=integer,
                                                sort="string")
print(response)

from falconpy import PreventionPolicy

falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.queryCombinedPreventionPolicyMembers(id="string",
                                                       filter="string",
                                                       limit=integer,
                                                       offset=integer,
                                                       sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryCombinedPreventionPolicyMembers",
                          id="string",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

Get-FalconPreventionPolicyMember -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/prevention_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  iD := "string"
  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.PreventionPolicies.QueryCombinedPreventionPolicyMembers(
    &prevention_policies.QueryCombinedPreventionPolicyMembersParams{
      ID: &iD,
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.preventionPolicies.queryCombinedPreventionPolicyMembers(
  "string",  // id
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::prevention_policies_api::query_combined_prevention_policy_members;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_combined_prevention_policy_members(
        &falcon.cfg,  // configuration
        Some("string"),  // id
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::PreventionPolicies.new

response = api.query_combined_prevention_policy_members(id: 'string',
                                                        filter: 'string',
                                                        offset: integer,
                                                        limit: integer,
                                                        sort: 'string')

puts response

queryCombinedPreventionPolicies

Search for Prevention Policies in your environment by providing a FQL filter and paging details. Returns a set of Prevention Policies which match the filter criteria

GET /policy/combined/prevention/v1

Scope Prevention Policies: READ Consumes · Produces application/json

PEP 8 query_combined_policies

Parameters

Name	Type	Data type	Description
filter	query	string	FQL query expression that should be used to limit the results.
limit	query	integer	Maximum number of records to return. Max: 5000.
offset	query	string	Starting index of overall result set from which to return ids.
sort	query	string	The property to sort by. Available fields: created_by, modified_timestamp, created_timestamp, name, enabled, platform_name, modified_by, precedence. Example: `created_timestamp.desc`
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import PreventionPolicy

falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.query_combined_policies(filter="string",
                                          limit=integer,
                                          offset=integer,
                                          sort="string")
print(response)

from falconpy import PreventionPolicy

falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.queryCombinedPreventionPolicies(filter="string",
                                                  limit=integer,
                                                  offset=integer,
                                                  sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryCombinedPreventionPolicies",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

Get-FalconPreventionPolicy -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/prevention_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.PreventionPolicies.QueryCombinedPreventionPolicies(
    &prevention_policies.QueryCombinedPreventionPoliciesParams{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.preventionPolicies.queryCombinedPreventionPolicies(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::prevention_policies_api::query_combined_prevention_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_combined_prevention_policies(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::PreventionPolicies.new

response = api.query_combined_prevention_policies(filter: 'string',
                                                  offset: integer,
                                                  limit: integer,
                                                  sort: 'string')

puts response

performPreventionPoliciesAction

Perform the specified action on the Prevention Policies specified in the request

POST /policy/entities/prevention-actions/v1

Scope Prevention Policies: WRITE Consumes · Produces application/json

PEP 8 perform_policies_action

Parameters

Name	Type	Data type	Description
action_name	query	string	The action to perform. Allowed values: add-host-group, add-rule-group, disable, enable, remove-host-group, remove-rule-group.
action_parameters	body	list of dictionaries	List of name / value pairs in JSON format.
body	body	dictionary	Full body payload in JSON format.
group_id	body action_parameters	string	Host Group ID to apply the policy to. String. Overridden if `action_parameters` is specified.
ids	body	string or list of strings	Prevention Policy ID(s) to perform actions against.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import PreventionPolicy

falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.perform_policies_action(action_name="string",
                                          action_parameters=[{"key": "value"}],
                                          group_id="string",
                                          ids=id_list)
print(response)

from falconpy import PreventionPolicy

falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.performPreventionPoliciesAction(action_name="string",
                                                  action_parameters=[{"key": "value"}],
                                                  group_id="string",
                                                  ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "action_parameters": [
        {
            "name": "string",
            "value": "string"
        }
    ],
    "ids": ["string"]
}

response = falcon.command("performPreventionPoliciesAction",
                          action_name="string",
                          body=body_payload)
print(response)

Invoke-FalconPreventionPolicyAction -Name "string" -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/prevention_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"
  value := "string"

  response, err := client.PreventionPolicies.PerformPreventionPoliciesAction(
    &prevention_policies.PerformPreventionPoliciesActionParams{
      Body: &models.MsaEntityActionRequestV2{
        ActionParameters: []interface{}{
          {
          Name: &name,
          Value: &value,
          },
        },
        Ids: []string{"string"},
      },
      ActionName: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.preventionPolicies.performPreventionPoliciesAction(
  "string",  // actionName
  {  // body
      actionParameters: [{
          name: "string",
          value: "string"
        }],
      ids: []
  }
);

console.log(response);

use rusty_falcon::apis::prevention_policies_api::perform_prevention_policies_action;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaEntityActionRequestV2;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaEntityActionRequestV2 {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = perform_prevention_policies_action(
        &falcon.cfg,  // configuration
        "string",  // action_name
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::PreventionPolicies.new

body = Falcon::MsaEntityActionRequestV2.new(
  action_parameters: [{
      name: 'string',
      value: 'string'
    }],
  ids: []
)

response = api.perform_prevention_policies_action(body, 'string')

puts response

setPreventionPoliciesPrecedence

Sets the precedence of Prevention Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence

POST /policy/entities/prevention-precedence/v1

Scope Prevention Policies: WRITE Consumes · Produces application/json

PEP 8 set_policies_precedence

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
ids	body	string or list of strings	Prevention Policy ID(s) to adjust precedence.
platform_name	body	string	OS platform name. Linux, Mac, Windows, iOS, Android.

Code Examples

from falconpy import PreventionPolicy

falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.set_policies_precedence(ids=id_list, platform_name="string")
print(response)

from falconpy import PreventionPolicy

falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.setPreventionPoliciesPrecedence(ids=id_list,
                                                  platform_name="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "ids": ["string"],
    "platform_name": "string"
}

response = falcon.command("setPreventionPoliciesPrecedence", body=body_payload)
print(response)

Set-FalconPreventionPrecedence -PlatformName "string" -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/prevention_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  platform_name := "string"

  response, err := client.PreventionPolicies.SetPreventionPoliciesPrecedence(
    &prevention_policies.SetPreventionPoliciesPrecedenceParams{
      Body: &models.BaseSetPolicyPrecedenceReqV1{
        Ids: []string{"string"},
        PlatformName: &platform_name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.preventionPolicies.setPreventionPoliciesPrecedence(
  {
    ids: [],
    platformName: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::prevention_policies_api::set_prevention_policies_precedence;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::BaseSetPolicyPrecedenceReqV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = BaseSetPolicyPrecedenceReqV1 {
        ids: vec!["string".to_string()],
        platform_name: Some("string".to_string()),
        ..Default::default()
    };

    let response = set_prevention_policies_precedence(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::PreventionPolicies.new

body = Falcon::BaseSetPolicyPrecedenceReqV1.new(
  ids: [],
  platform_name: 'string'
)

response = api.set_prevention_policies_precedence(body)

puts response

getPreventionPolicies

Retrieve a set of Prevention Policies by specifying their IDs

GET /policy/entities/prevention/v1

Scope Prevention Policies: READ Consumes · Produces application/json

PEP 8 get_policies

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The ID(s) of the Prevention Policies to return.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import PreventionPolicy

falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_policies(ids=id_list)
print(response)

from falconpy import PreventionPolicy

falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getPreventionPolicies(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getPreventionPolicies",
                          ids=id_list)
print(response)

Get-FalconPreventionPolicy -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/prevention_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.PreventionPolicies.GetPreventionPolicies(
    &prevention_policies.GetPreventionPoliciesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.preventionPolicies.getPreventionPolicies(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::prevention_policies_api::get_prevention_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_prevention_policies(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::PreventionPolicies.new

response = api.get_prevention_policies(['ID1', 'ID2', 'ID3'])

puts response

createPreventionPolicies

Create Prevention Policies by specifying details about the policy to create

POST /policy/entities/prevention/v1

Scope Prevention Policies: WRITE Consumes · Produces application/json

PEP 8 create_policies

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
clone_id	body	string	Prevention Policy ID to clone.
description	body	string	Prevention Policy description.
name	body	string	Prevention Policy name.
platform_name	body	string	Operating system platform name. Linux, Mac, Windows, iOS, Android.
settings	body	list of dictionaries	List of policy-specific settings to apply to the newly created policy. Multiple settings can be applied by passing a list containing multiple entries.

Code Examples

from falconpy import PreventionPolicy

falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.create_policies(clone_id="string",
                                  description="string",
                                  name="string",
                                  platform_name="string",
                                  settings=[{"key": "value"}])
print(response)

from falconpy import PreventionPolicy

falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.createPreventionPolicies(clone_id="string",
                                           description="string",
                                           name="string",
                                           platform_name="string",
                                           settings=[{"key": "value"}])
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "clone_id": "string",
            "description": "string",
            "name": "string",
            "platform_name": "string",
            "settings": [
                {
                    "id": "string",
                    "value": {}
                }
            ]
        }
    ]
}

response = falcon.command("createPreventionPolicies", body=body_payload)
print(response)

New-FalconPreventionPolicy -Name "string" -PlatformName "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/prevention_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  clone_id := "string"
  description := "string"
  name := "string"
  platform_name := "string"
  id := "string"

  response, err := client.PreventionPolicies.CreatePreventionPolicies(
    &prevention_policies.CreatePreventionPoliciesParams{
      Body: &models.PreventionCreatePoliciesReqV1{
        Resources: []interface{}{
          {
          CloneID: &clone_id,
          Description: &description,
          Name: &name,
          PlatformName: &platform_name,
          Settings: []interface{}{
            {
            ID: &id,
            Value: &struct{}{},
            },
          },
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.preventionPolicies.createPreventionPolicies(
  {
    resources: [{
        cloneId: "string",
        description: "string",
        name: "string",
        platformName: "string",
        settings: [{
            id: "string",
            value: {}
          }]
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::prevention_policies_api::create_prevention_policies;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::PreventionCreatePoliciesReqV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = PreventionCreatePoliciesReqV1 {
        resources: vec![CreatePolicyReqV1 {
            name: Some("string".to_string()),
            platform_name: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = create_prevention_policies(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::PreventionPolicies.new

body = Falcon::PreventionCreatePoliciesReqV1.new(
  resources: [{
      clone_id: 'string',
      description: 'string',
      name: 'string',
      platform_name: 'string',
      settings: [{
          id: 'string',
          value: {}
        }]
    }]
)

response = api.create_prevention_policies(body)

puts response

deletePreventionPolicies

Delete a set of Prevention Policies by specifying their IDs

DELETE /policy/entities/prevention/v1

Scope Prevention Policies: WRITE Consumes · Produces application/json

PEP 8 delete_policies

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The ID(s) of the Prevention Policies to delete.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import PreventionPolicy

falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_policies(ids=id_list)
print(response)

from falconpy import PreventionPolicy

falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deletePreventionPolicies(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deletePreventionPolicies",
                          ids=id_list)
print(response)

Remove-FalconPreventionPolicy -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/prevention_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.PreventionPolicies.DeletePreventionPolicies(
    &prevention_policies.DeletePreventionPoliciesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.preventionPolicies.deletePreventionPolicies(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::prevention_policies_api::delete_prevention_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_prevention_policies(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::PreventionPolicies.new

response = api.delete_prevention_policies(['ID1', 'ID2', 'ID3'])

puts response

updatePreventionPolicies

Update Prevention Policies by specifying the ID of the policy and details to update

PATCH /policy/entities/prevention/v1

Scope Prevention Policies: WRITE Consumes · Produces application/json

PEP 8 update_policies

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
description	body	string	Prevention Policy description.
id	body	string	Prevention Policy ID to update.
name	body	string	Prevention Policy name.
settings	body	list of dictionaries	List of policy-specific settings to apply to the newly created policy. Multiple settings can be applied by passing a list containing multiple entries.

Code Examples

from falconpy import PreventionPolicy

falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.update_policies(description="string",
                                  id="string",
                                  name="string",
                                  settings=[{"key": "value"}])
print(response)

from falconpy import PreventionPolicy

falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.updatePreventionPolicies(description="string",
                                           id="string",
                                           name="string",
                                           settings=[{"key": "value"}])
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "description": "string",
            "id": "string",
            "name": "string",
            "settings": [
                {
                    "id": "string",
                    "value": {}
                }
            ]
        }
    ]
}

response = falcon.command("updatePreventionPolicies", body=body_payload)
print(response)

Edit-FalconPreventionPolicy -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/prevention_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  id := "string"
  name := "string"

  response, err := client.PreventionPolicies.UpdatePreventionPolicies(
    &prevention_policies.UpdatePreventionPoliciesParams{
      Body: &models.PreventionUpdatePoliciesReqV1{
        Resources: []interface{}{
          {
          Description: &description,
          ID: &id,
          Name: &name,
          Settings: []interface{}{
            {
            ID: &id,
            Value: &struct{}{},
            },
          },
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.preventionPolicies.updatePreventionPolicies(
  {
    resources: [{
        description: "string",
        id: "string",
        name: "string",
        settings: [{
            id: "string",
            value: {}
          }]
      }]
}  // body
);

console.log(response);

use rusty_falcon::apis::prevention_policies_api::update_prevention_policies;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::PreventionUpdatePoliciesReqV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = PreventionUpdatePoliciesReqV1 {
        resources: vec![UpdatePolicyReqV1 {
            id: Some("string".to_string()),
            settings: vec![SettingReqV1 {
                id: Some("string".to_string()),
                value: Default::default(),
                ..Default::default()
            }],
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = update_prevention_policies(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::PreventionPolicies.new

body = Falcon::PreventionUpdatePoliciesReqV1.new(
  resources: [{
      description: 'string',
      id: 'string',
      name: 'string',
      settings: [{
          id: 'string',
          value: {}
        }]
    }]
)

response = api.update_prevention_policies(body)

puts response

queryPreventionPolicyMembers

Search for members of a Prevention Policy in your environment by providing a FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria

GET /policy/queries/prevention-members/v1

Scope Prevention Policies: READ Consumes · Produces application/json

PEP 8 query_policy_members

Parameters

Name	Type	Data type	Description
filter	query	string	FQL query expression that should be used to limit the results.
limit	query	integer	Maximum number of records to return. Max: 5000.
offset	query	string	Starting index of overall result set from which to return ids.
id	query	string	The ID of the Prevention Policy to search for members of.
sort	query	string	The property to sort by.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import PreventionPolicy

falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.query_policy_members(id="string",
                                       filter="string",
                                       limit=integer,
                                       offset=integer,
                                       sort="string")
print(response)

from falconpy import PreventionPolicy

falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.queryPreventionPolicyMembers(id="string",
                                               filter="string",
                                               limit=integer,
                                               offset=integer,
                                               sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryPreventionPolicyMembers",
                          id="string",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

Get-FalconPreventionPolicyMember -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/prevention_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  iD := "string"
  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.PreventionPolicies.QueryPreventionPolicyMembers(
    &prevention_policies.QueryPreventionPolicyMembersParams{
      ID: &iD,
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.preventionPolicies.queryPreventionPolicyMembers(
  "string",  // id
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::prevention_policies_api::query_prevention_policy_members;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_prevention_policy_members(
        &falcon.cfg,  // configuration
        Some("string"),  // id
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::PreventionPolicies.new

response = api.query_prevention_policy_members(id: 'string',
                                               filter: 'string',
                                               offset: integer,
                                               limit: integer,
                                               sort: 'string')

puts response

queryPreventionPolicies

Search for Prevention Policies in your environment by providing a FQL filter and paging details. Returns a set of Prevention Policy IDs which match the filter criteria

GET /policy/queries/prevention/v1

Scope Prevention Policies: READ Consumes · Produces application/json

PEP 8 query_policies

Parameters

Name	Type	Data type	Description
filter	query	string	FQL query expression that should be used to limit the results.
limit	query	integer	Maximum number of records to return. Max: 5000.
offset	query	string	Starting index of overall result set from which to return ids.
sort	query	string	The property to sort by. Available fields: created_by, modified_timestamp, created_timestamp, name, enabled, platform_name, modified_by, precedence. Example: `created_timestamp.desc`
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import PreventionPolicy

falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.query_policies(filter="string",
                                 limit=integer,
                                 offset=integer,
                                 sort="string")
print(response)

from falconpy import PreventionPolicy

falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.queryPreventionPolicies(filter="string",
                                          limit=integer,
                                          offset=integer,
                                          sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryPreventionPolicies",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

Get-FalconPreventionPolicy -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/prevention_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.PreventionPolicies.QueryPreventionPolicies(
    &prevention_policies.QueryPreventionPoliciesParams{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.preventionPolicies.queryPreventionPolicies(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::prevention_policies_api::query_prevention_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_prevention_policies(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::PreventionPolicies.new

response = api.query_prevention_policies(filter: 'string',
                                         offset: integer,
                                         limit: integer,
                                         sort: 'string')

puts response

Prevention Policy

Table of Contents

queryCombinedPreventionPolicyMembers

Parameters

Code Examples

queryCombinedPreventionPolicies

Parameters

Code Examples

performPreventionPoliciesAction

Parameters

Code Examples

setPreventionPoliciesPrecedence

Parameters

Code Examples

getPreventionPolicies

Parameters

Code Examples

createPreventionPolicies

Parameters

Code Examples

deletePreventionPolicies

Parameters

Code Examples

updatePreventionPolicies

Parameters

Code Examples

queryPreventionPolicyMembers

Parameters

Code Examples

queryPreventionPolicies

Parameters

Code Examples