Skip to content
CrowdStrike Developer Center

Recon

The Recon service collection provides operations for managing monitoring rules, notifications, and actions in the CrowdStrike Falcon Recon platform. Create and manage monitoring rules for intelligence topics, handle notification aggregates and exposed data records, export jobs, and query actions and notifications across your environment.

LanguageLast Update
Pythonv1.6.1
PowerShellv2.2.9
Gov0.20.0
TypeScriptv0.6.0
Rustv0.7.0
Rubyv1.2.0

Table of Contents

Section titled “Table of Contents”
OperationDescription
AggregateNotificationsExposedDataRecordsV1
aggregate_notifications_exposed_data_records		Get notification exposed data record aggregates as specified via JSON in request body.
AggregateNotificationsV1
aggregate_notifications		Get notification aggregates as specified via JSON in request body.
PreviewRuleV1
preview_rule		Preview rules notification count and distribution. This will return aggregations on: channel, count, site.
GetActionsV1
get_actions		Get actions based on their IDs. IDs can be retrieved using the QueryActionsV1 operation.
CreateActionsV1
create_actions		Create actions for a monitoring rule. Accepts a list of actions that will be attached to the monitoring rule.
DeleteActionV1
delete_action		Delete an action from a monitoring rule based on the action ID.
UpdateActionV1
update_action		Update an action for a monitoring rule.
GetFileContentForExportJobsV1
get_export_job_file_contents		Download the file associated with a job ID.
GetExportJobsV1
get_export_jobs		Get the status of export jobs based on their IDs. Export jobs can be launched by calling CreateExportJobsV1. When a job is complete, use the job ID to download the file(s) associated with it using GetFileContentForExportJobsV1.
CreateExportJobsV1
create_export_jobs		Launch asynchronous export job. Use the job ID to poll the status of the job using GetExportJobsV1.
DeleteExportJobsV1
delete_export_jobs		Delete export jobs (and their associated file(s)) based on their IDs.
GetNotificationsDetailedTranslatedV1
get_notifications_detailed_translated		Get detailed notifications based on their IDs. These include the raw intelligence content that generated the match. This endpoint will return translated notification content. The only target language available is English. A single notification can be translated per request.
GetNotificationsDetailedV1
get_notifications_detailed		Get detailed notifications based on their IDs. These include the raw intelligence content that generated the match.
GetNotificationsExposedDataRecordsV1
get_notifications_exposed_data_records		Get notifications exposed data records based on their IDs. IDs can be retrieved using the QueryNotificationsExposedDataRecordsV1 operation. The associated notification can be fetched using the notifications operations.
GetNotificationsTranslatedV1
get_notifications_translated		Get notifications based on their IDs. IDs can be retrieved using the QueryNotificationsV1 operation. This endpoint will return translated notification content. The only target language available is English.
GetNotificationsV1
get_notifications		Get notifications based on their IDs. IDs can be retrieved using the QueryNotificationsV1 operation.
DeleteNotificationsV1
delete_notifications		Delete notifications based on IDs. Notifications cannot be recovered after they are deleted.
UpdateNotificationsV1
update_notifications		Update notification status or assignee. Accepts bulk requests.
GetRulesV1
get_rules		Get monitoring rules rules by provided IDs.
CreateRulesV1
create_rules		Create monitoring rules.
DeleteRulesV1
delete_rules		Delete monitoring rules.
UpdateRulesV1
update_rules		Update monitoring rules.
QueryActionsV1
query_actions		Query actions based on provided criteria. Use the IDs from this response to get the action entities on GetActionsV1.
QueryNotificationsExposedDataRecordsV1
query_notifications_exposed_data_records		Query notifications exposed data records based on provided criteria. Use the IDs from this response to get the notification entities on GetNotificationsExposedDataRecordsV1.
QueryNotificationsV1
query_notifications		Query notifications based on provided criteria. Use the IDs from this response to get the notification entities on GetNotificationsV1 or GetNotificationsDetailedV1.
QueryRulesV1
query_rules		Query monitoring rules based on provided criteria. Use the IDs from this response to fetch the rules on GetRulesV1.

AggregateNotificationsExposedDataRecordsV1

Section titled “AggregateNotificationsExposedDataRecordsV1”

Get notification exposed data record aggregates as specified via JSON in request body.

POST /recon/aggregates/notifications-exposed-data-records/GET/v1
Scope Monitoring Rules (Falcon Intelligence): READ Consumes · Produces application/json
PEP 8 aggregate_notifications_exposed_data_records

Parameters

Section titled “Parameters”
NameTypeData typeDescription
bodybodylist of dictionariesFull body payload in JSON format.
date_rangesbodylist of dictionariesApplies to date_range aggregations. Example: [{“from”: “2016-05-28T09:00:31Z”, “to”: “2016-05-30T09:00:31Z”}, {“from”: “2016-06-01T09:00:31Z”, “to”: “2016-06-10T09:00:31Z”}]
excludebodystringElements to exclude.
fieldbodystringThe field on which to compute the aggregation.
filterbodystringFQL syntax formatted string to use to filter the results.
frombodyintegerStarting position.
includebodystringElements to include.
intervalbodystringTime interval for date histogram aggregations. Valid values include: year, month, week, day, hour, minute.
max_doc_countbodyintegerOnly return buckets if values are less than or equal to the value here.
min_doc_countbodyintegerOnly return buckets if values are greater than or equal to the value here.
missingbodystringMissing is the value to be used when the aggregation field is missing from the object. In other words, the missing parameter defines how documents that are missing a value should be treated. By default they will be ignored, but it is also possible to treat them as if they had a value.
namebodystringName of the aggregate query, as chosen by the user. Used to identify the results returned to you.
qbodystringFull text search across all metadata fields.
rangesbodylist of dictionariesApplies to range aggregations. Ranges values will depend on field. For example, if max_severity is used, ranges might look like: [{“From”: 0, “To”: 70}, {“From”: 70, “To”: 100}]
sizebodyintegerThe max number of term buckets to be returned.
sub_aggregatesbodylist of dictionariesA nested aggregation, such as: [{“name”: “max_first_behavior”, “type”: “max”, “field”: “first_behavior”}]. There is a maximum of 3 nested aggregations per request.
sortbodystringFQL syntax string to sort bucket results. _count - sort by document count. _term - sort by the string value alphabetically. Supports asc and desc using | format. Example: _count|desc
time_zonebodystringTime zone for bucket results.
typebodystringType of aggregation. Valid values include: date_histogram, date_range, terms, range, cardinality, max, min, avg, sum, percentiles.

Code Examples

Section titled “Code Examples”
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


ranges = [
    {
        "From": 0,
        "To": 0
    }
]


response = falcon.aggregate_notifications_exposed_data_records(date_ranges="string",
                                                               exclude="string",
                                                               field="string",
                                                               filter="string",
                                                               from=integer,
                                                               include="string",
                                                               interval="string",
                                                               max_doc_count=integer,
                                                               min_doc_count=integer,
                                                               missing="string",
                                                               name="string",
                                                               q="string",
                                                               ranges=ranges,
                                                               size=integer,
                                                               sort="string",
                                                               sub_aggregates=["string"],
                                                               time_zone="string",
                                                               type="string")
print(response)

AggregateNotificationsV1

Section titled “AggregateNotificationsV1”

Get notification aggregates as specified via JSON in request body.

POST /recon/aggregates/notifications/GET/v1
Scope Monitoring Rules (Falcon Intelligence): READ Consumes · Produces application/json
PEP 8 aggregate_notifications

Parameters

Section titled “Parameters”
NameTypeData typeDescription
bodybodylist of dictionariesFull body payload in JSON format.
date_rangesbodylist of dictionariesApplies to date_range aggregations. Example: [{“from”: “2016-05-28T09:00:31Z”, “to”: “2016-05-30T09:00:31Z”}, {“from”: “2016-06-01T09:00:31Z”, “to”: “2016-06-10T09:00:31Z”}]
excludebodystringElements to exclude.
fieldbodystringThe field on which to compute the aggregation.
filterbodystringFQL syntax formatted string to use to filter the results.
frombodyintegerStarting position.
includebodystringElements to include.
intervalbodystringTime interval for date histogram aggregations. Valid values include: year, month, week, day, hour, minute.
max_doc_countbodyintegerOnly return buckets if values are less than or equal to the value here.
min_doc_countbodyintegerOnly return buckets if values are greater than or equal to the value here.
missingbodystringMissing is the value to be used when the aggregation field is missing from the object. In other words, the missing parameter defines how documents that are missing a value should be treated. By default they will be ignored, but it is also possible to treat them as if they had a value.
namebodystringName of the aggregate query, as chosen by the user. Used to identify the results returned to you.
qbodystringFull text search across all metadata fields.
rangesbodylist of dictionariesApplies to range aggregations. Ranges values will depend on field. For example, if max_severity is used, ranges might look like: [{“From”: 0, “To”: 70}, {“From”: 70, “To”: 100}]
sizebodyintegerThe max number of term buckets to be returned.
sub_aggregatesbodylist of dictionariesA nested aggregation, such as: [{“name”: “max_first_behavior”, “type”: “max”, “field”: “first_behavior”}]. There is a maximum of 3 nested aggregations per request.
sortbodystringFQL syntax string to sort bucket results. _count - sort by document count. _term - sort by the string value alphabetically. Supports asc and desc using | format. Example: _count|desc
time_zonebodystringTime zone for bucket results.
typebodystringType of aggregation. Valid values include: date_histogram, date_range, terms, range, cardinality, max, min, avg, sum, percentiles.

Code Examples

Section titled “Code Examples”
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


ranges = [
    {
        "From": 0,
        "To": 0
    }
]


response = falcon.aggregate_notifications(date_ranges="string",
                                          exclude="string",
                                          field="string",
                                          filter="string",
                                          from=integer,
                                          include="string",
                                          interval="string",
                                          max_doc_count=integer,
                                          min_doc_count=integer,
                                          missing="string",
                                          name="string",
                                          q="string",
                                          ranges=ranges,
                                          size=integer,
                                          sort="string",
                                          sub_aggregates=["string"],
                                          time_zone="string",
                                          type="string")
print(response)

PreviewRuleV1

Section titled “PreviewRuleV1”

Preview rules notification count and distribution. This will return aggregations on: channel, count, site.

POST /recon/aggregates/rules-preview/GET/v1
Scope Monitoring Rules (Falcon Intelligence): READ Consumes · Produces application/json
PEP 8 preview_rule

Parameters

Section titled “Parameters”
NameTypeData typeDescription
bodybodydictionaryFull body payload in JSON format.
filterbodystringFQL Syntax formatted string used to limit results.
topicbodystringRestricts results to the topic specified.

Code Examples

Section titled “Code Examples”
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.preview_rule(filter="string", topic="string")
print(response)

GetActionsV1

Section titled “GetActionsV1”

Get actions based on their IDs. IDs can be retrieved using the QueryActionsV1 operation.

GET /recon/entities/actions/v1
Scope Monitoring Rules (Falcon Intelligence): READ Consumes · Produces application/json
PEP 8 get_actions

Parameters

Section titled “Parameters”
NameTypeData typeDescription
idsquerystring or list of stringsAction IDs to retrieve.
parametersquerydictionaryFull query string parameters payload in JSON format.

Code Examples

Section titled “Code Examples”
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_actions(ids=id_list)
print(response)

CreateActionsV1

Section titled “CreateActionsV1”

Create actions for a monitoring rule. Accepts a list of actions that will be attached to the monitoring rule.

POST /recon/entities/actions/v1
Scope Monitoring Rules (Falcon Intelligence): WRITE Consumes · Produces application/json
PEP 8 create_actions

Parameters

Section titled “Parameters”
NameTypeData typeDescription
actionsbodylist of dictionariesList of actions to attach to the monitoring rule. When provided, actions overrides other keywords (excluding body).
bodybodydictionaryFull body payload in JSON format.
content_formatbodystringContent format.
frequencybodystringFrequency of the action. Only one action can be applied when using this keyword.
recipientsbodylist of stringsList of action recipients. Only one action can be applied when using this keyword.
rule_idbodystringRule ID to attach action(s) to.
trigger_matchlessbodybooleanTrigger matchless.
typebodystringAction type. Only one action can be applied when using this keyword.

Code Examples

Section titled “Code Examples”
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.create_actions(actions=["string"],
                                 content_format="string",
                                 recipients=["string"],
                                 rule_id="string",
                                 trigger_matchless=boolean,
                                 type="string")
print(response)

DeleteActionV1

Section titled “DeleteActionV1”

Delete an action from a monitoring rule based on the action ID.

DELETE /recon/entities/actions/v1
Scope Monitoring Rules (Falcon Intelligence): WRITE Consumes · Produces application/json
PEP 8 delete_action

Parameters

Section titled “Parameters”
NameTypeData typeDescription
idquerystringAction ID to delete.
parametersquerydictionaryFull query string parameters payload in JSON format.

Code Examples

Section titled “Code Examples”
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.delete_action(ids=id_list)
print(response)

UpdateActionV1

Section titled “UpdateActionV1”

Update an action for a monitoring rule.

PATCH /recon/entities/actions/v1
Scope Monitoring Rules (Falcon Intelligence): WRITE Consumes · Produces application/json
PEP 8 update_action

Parameters

Section titled “Parameters”
NameTypeData typeDescription
bodybodydictionaryFull body payload in JSON format.
content_formatbodystringContent format.
frequencybodystringFrequency of the action.
recipientsbodylist of stringsList of action recipients.
idbodystringAction ID to update.
statusbodystringAction status.
trigger_matchlessbodybooleanTrigger matchless.

Code Examples

Section titled “Code Examples”
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.update_action(content_format="string",
                                id="string",
                                recipients=["string"],
                                status="string",
                                trigger_matchless=boolean)
print(response)

GetFileContentForExportJobsV1

Section titled “GetFileContentForExportJobsV1”

Download the file associated with a job ID.

GET /recon/entities/export-files/v1
Scope Monitoring Rules (Falcon Intelligence): READ Consumes · Produces application/octet-stream
PEP 8 get_export_job_file_contents

Parameters

Section titled “Parameters”
NameTypeData typeDescription
idquerystringExport job ID.
parametersquerydictionaryFull query string parameters payload in JSON format.

Code Examples

Section titled “Code Examples”
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


with open("output_file", "wb") as save_file:
    response = falcon.get_export_job_file_contents(ids=id_list, stream=boolean)
    save_file.write(response)

GetExportJobsV1

Section titled “GetExportJobsV1”

Get the status of export jobs based on their IDs. Export jobs can be launched by calling CreateExportJobsV1. When a job is complete, use the job ID to download the file(s) associated with it using GetFileContentForExportJobsV1.

GET /recon/entities/exports/v1
Scope Monitoring Rules (Falcon Intelligence): READ Consumes · Produces application/json
PEP 8 get_export_jobs

Parameters

Section titled “Parameters”
NameTypeData typeDescription
idsquerystring or list of stringsExport job IDs to retrieve.
parametersquerydictionaryFull query string parameters payload in JSON format.

Code Examples

Section titled “Code Examples”
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_export_jobs(ids=id_list)
print(response)

CreateExportJobsV1

Section titled “CreateExportJobsV1”

Launch asynchronous export job. Use the job ID to poll the status of the job using GetExportJobsV1.

POST /recon/entities/exports/v1
Scope Monitoring Rules (Falcon Intelligence): WRITE Consumes · Produces application/json
PEP 8 create_export_jobs

Parameters

Section titled “Parameters”
NameTypeData typeDescription
bodybodydictionaryFull body payload in JSON format.
entitybodystringEntity to report on.
export_typebodystringType of export.
filterbodystringFQL filter used to limit report results.
human_readablebodybooleanFlag indicating if this report should be returned in human readable format.
sortbodystringSort the report results using a FQL formatted string.

Code Examples

Section titled “Code Examples”
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.create_export_jobs(entity="string",
                                     export_type="string",
                                     filter="string",
                                     human_readable="string",
                                     sort="string")
print(response)

DeleteExportJobsV1

Section titled “DeleteExportJobsV1”

Delete export jobs (and their associated file(s)) based on their IDs.

DELETE /recon/entities/exports/v1
Scope Monitoring Rules (Falcon Intelligence): WRITE Consumes · Produces application/json
PEP 8 delete_export_jobs

Parameters

Section titled “Parameters”
NameTypeData typeDescription
idsquerystring or list of stringsExport job IDs to delete.
parametersquerydictionaryFull query string parameters payload in JSON format.

Code Examples

Section titled “Code Examples”
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.delete_export_jobs(ids=id_list)
print(response)

GetNotificationsDetailedTranslatedV1

Section titled “GetNotificationsDetailedTranslatedV1”

Get detailed notifications based on their IDs. These include the raw intelligence content that generated the match. This endpoint will return translated notification content. The only target language available is English. A single notification can be translated per request.

GET /recon/entities/notifications-detailed-translated/v1
Scope Monitoring Rules (Falcon Intelligence): READ Consumes · Produces application/json
PEP 8 get_notifications_detailed_translated

Parameters

Section titled “Parameters”
NameTypeData typeDescription
idsquerystring or list of stringsNotification IDs to retrieve.
parametersquerydictionaryFull query string parameters payload in JSON format.

Code Examples

Section titled “Code Examples”
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_notifications_detailed_translated(ids=id_list)
print(response)

GetNotificationsDetailedV1

Section titled “GetNotificationsDetailedV1”

Get detailed notifications based on their IDs. These include the raw intelligence content that generated the match.

GET /recon/entities/notifications-detailed/v1
Scope Monitoring Rules (Falcon Intelligence): READ Consumes · Produces application/json
PEP 8 get_notifications_detailed

Parameters

Section titled “Parameters”
NameTypeData typeDescription
idsquerystring or list of stringsNotification IDs to retrieve.
parametersquerydictionaryFull query string parameters payload in JSON format.

Code Examples

Section titled “Code Examples”
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_notifications_detailed(ids=id_list)
print(response)

GetNotificationsExposedDataRecordsV1

Section titled “GetNotificationsExposedDataRecordsV1”

Get notifications exposed data records based on their IDs. IDs can be retrieved using the QueryNotificationsExposedDataRecordsV1 operation. The associated notification can be fetched using the notifications operations.

GET /recon/entities/notifications-exposed-data-records/v1
Scope Monitoring Rules (Falcon Intelligence): READ Consumes · Produces application/json
PEP 8 get_notifications_exposed_data_records

Parameters

Section titled “Parameters”
NameTypeData typeDescription
idsquerystring or list of stringsNotifications exposed record IDs to retrieve.
parametersquerydictionaryFull query string parameters payload in JSON format.

Code Examples

Section titled “Code Examples”
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_notifications_exposed_data_records(ids=id_list)
print(response)

GetNotificationsTranslatedV1

Section titled “GetNotificationsTranslatedV1”

Get notifications based on their IDs. IDs can be retrieved using the QueryNotificationsV1 operation. This endpoint will return translated notification content. The only target language available is English.

GET /recon/entities/notifications-translated/v1
Scope Monitoring Rules (Falcon Intelligence): READ Consumes · Produces application/json
PEP 8 get_notifications_translated

Parameters

Section titled “Parameters”
NameTypeData typeDescription
idsquerystring or list of stringsNotification IDs to retrieve.
parametersquerydictionaryFull query string parameters payload in JSON format.

Code Examples

Section titled “Code Examples”
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_notifications_translated(ids=id_list)
print(response)

GetNotificationsV1

Section titled “GetNotificationsV1”

Get notifications based on their IDs. IDs can be retrieved using the QueryNotificationsV1 operation.

GET /recon/entities/notifications/v1
Scope Monitoring Rules (Falcon Intelligence): READ Consumes · Produces application/json
PEP 8 get_notifications

Parameters

Section titled “Parameters”
NameTypeData typeDescription
idsquerystring or list of stringsNotification IDs to retrieve.
parametersquerydictionaryFull query string parameters payload in JSON format.

Code Examples

Section titled “Code Examples”
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_notifications(ids=id_list)
print(response)

DeleteNotificationsV1

Section titled “DeleteNotificationsV1”

Delete notifications based on IDs. Notifications cannot be recovered after they are deleted.

DELETE /recon/entities/notifications/v1
Scope Monitoring Rules (Falcon Intelligence): WRITE Consumes · Produces application/json
PEP 8 delete_notifications

Parameters

Section titled “Parameters”
NameTypeData typeDescription
idsquerystring or list of stringsNotification IDs to delete.
parametersquerydictionaryFull query string parameters payload in JSON format.

Code Examples

Section titled “Code Examples”
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.delete_notifications(ids=id_list)
print(response)

UpdateNotificationsV1

Section titled “UpdateNotificationsV1”

Update notification status or assignee. Accepts bulk requests.

PATCH /recon/entities/notifications/v1
Scope Monitoring Rules (Falcon Intelligence): WRITE Consumes · Produces application/json
PEP 8 update_notifications

Parameters

Section titled “Parameters”
NameTypeData typeDescription
assigned_to_uuidbodystringUUID of the assigned user.
bodybodydictionaryFull body payload in JSON format.
idbodystringNotification ID.
statusbodystringNotification status.

Code Examples

Section titled “Code Examples”
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.update_notifications(id="string", status="string")
print(response)

GetRulesV1

Section titled “GetRulesV1”

Get monitoring rules rules by provided IDs.

GET /recon/entities/rules/v1
Scope Monitoring Rules (Falcon Intelligence): READ Consumes · Produces application/json
PEP 8 get_rules

Parameters

Section titled “Parameters”
NameTypeData typeDescription
idsquerystring or list of stringsRule IDs to retrieve.
parametersquerydictionaryFull query string parameters payload in JSON format.

Code Examples

Section titled “Code Examples”
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_rules(ids=id_list)
print(response)

CreateRulesV1

Section titled “CreateRulesV1”

Create monitoring rules.

POST /recon/entities/rules/v1
Scope Monitoring Rules (Falcon Intelligence): WRITE Consumes · Produces application/json
PEP 8 create_rules

Parameters

Section titled “Parameters”
NameTypeData typeDescription
bodybodydictionaryFull body payload in JSON format.
breach_monitoring_enabledbodybooleanFlag indicating if breach monitoring should be enabled.
filterbodystringRule filter.
namebodystringRule name.
permissionsbodystringPermissions. private or public.
prioritybodystringPriority. high, medium, low
substring_matching_enabledbodybooleanFlag indicating if substring matching should be enabled.
topicbodystringRule topic.

Code Examples

Section titled “Code Examples”
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.create_rules(breach_monitoring_enabled=boolean,
                               filter="string",
                               name="string",
                               permissions="string",
                               priority="string",
                               substring_matching_enabled=boolean,
                               topic="string")
print(response)

DeleteRulesV1

Section titled “DeleteRulesV1”

Delete monitoring rules.

DELETE /recon/entities/rules/v1
Scope Monitoring Rules (Falcon Intelligence): WRITE Consumes · Produces application/json
PEP 8 delete_rules

Parameters

Section titled “Parameters”
NameTypeData typeDescription
idsquerystring or list of stringsRule IDs to delete.
notificationsDeletionRequestedquerybooleanFlag indicating if a delete notification should be generated by this rule.
parametersquerydictionaryFull query string parameters payload in JSON format.

Code Examples

Section titled “Code Examples”
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.delete_rules(ids=id_list,
                               notificationsDeletionRequested=boolean)
print(response)

UpdateRulesV1

Section titled “UpdateRulesV1”

Update monitoring rules.

PATCH /recon/entities/rules/v1
Scope Monitoring Rules (Falcon Intelligence): WRITE Consumes · Produces application/json
PEP 8 update_rules

Parameters

Section titled “Parameters”
NameTypeData typeDescription
bodybodydictionaryFull body payload in JSON format.
breach_monitoring_enabledbodybooleanFlag indicating if breach monitoring should be enabled.
filterbodystringRule filter.
namebodystringRule name.
permissionsbodystringPermissions. private or public.
prioritybodystringPriority. high, medium, low
idbodystringRule ID to update.
substring_matching_enabledbodybooleanFlag indicating if substring matching should be enabled.

Code Examples

Section titled “Code Examples”
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.update_rules(breach_monitoring_enabled=boolean,
                               filter="string",
                               name="string",
                               permissions="string",
                               priority="string",
                               id="string",
                               substring_matching_enabled=boolean)
print(response)

QueryActionsV1

Section titled “QueryActionsV1”

Query actions based on provided criteria. Use the IDs from this response to get the action entities on GetActionsV1.

GET /recon/queries/actions/v1
Scope Monitoring Rules (Falcon Intelligence): READ Consumes · Produces application/json
PEP 8 query_actions

Parameters

Section titled “Parameters”
NameTypeData typeDescription
filterquerystringFQL query expression that should be used to limit the results.
limitqueryintegerMaximum number of records to return.
offsetquerystringStarting index of overall result set from which to return ids.
qquerystringFree text search across all indexed fields.
sortquerystringThe property to sort by.
parametersquerydictionaryFull query string parameters payload in JSON format.

Code Examples

Section titled “Code Examples”
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.query_actions(filter="string",
                                limit=integer,
                                offset=integer,
                                q="string",
                                sort="string")
print(response)

QueryNotificationsExposedDataRecordsV1

Section titled “QueryNotificationsExposedDataRecordsV1”

Query notifications exposed data records based on provided criteria. Use the IDs from this response to get the notification entities on GetNotificationsExposedDataRecordsV1.

GET /recon/queries/notifications-exposed-data-records/v1
Scope Monitoring Rules (Falcon Intelligence): READ Consumes · Produces application/json
PEP 8 query_notifications_exposed_data_records

Parameters

Section titled “Parameters”
NameTypeData typeDescription
filterquerystringFQL query expression that should be used to limit the results. Available filters: id, cid, user_uuid, created_date, exposure_date, rule.id, rule.name, rule.topic, notification_id, notification_group_id, source_category, site, site_id, author, author_id, user_id, user_name, credentials_url, credentials_domain, credentials_ip, email, domain, hash_type, display_name, full_name, user_ip, phone_number, company, job_position, file.name, file.complete_data_set, file.download_urls, location.postal_code, location.city, location.state, location.federal_district, location.federal_admin_region, location.country_code, social.twitter_id, social.facebook_id, social.vk_id, social.vk_token, social.aim_id, social.icq_id, social.msn_id, social.instagram_id, social.skype_id, financial.credit_card, financial.bank_account, financial.crypto_currency_addresses, login_id, credential_status, _all, bot.operating_system.hardware_id, bot.bot_id.
limitqueryintegerMaximum number of records to return.
offsetqueryintegerStarting index of overall result set from which to return ids.
qquerystringFree text search across all indexed fields.
sortquerystringThe property to sort by. Either created_date or updated_date. (Example: updated_date|desc)
parametersquerydictionaryFull query string parameters payload in JSON format.

Code Examples

Section titled “Code Examples”
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.query_notifications_exposed_data_records(filter="string",
                                                           limit=integer,
                                                           offset=integer,
                                                           q="string",
                                                           sort="string")
print(response)

QueryNotificationsV1

Section titled “QueryNotificationsV1”

Query notifications based on provided criteria. Use the IDs from this response to get the notification entities on GetNotificationsV1 or GetNotificationsDetailedV1.

GET /recon/queries/notifications/v1
Scope Monitoring Rules (Falcon Intelligence): READ Consumes · Produces application/json
PEP 8 query_notifications

Parameters

Section titled “Parameters”
NameTypeData typeDescription
filterquerystringFQL query expression that should be used to limit the results.
limitqueryintegerMaximum number of records to return.
offsetquerystringStarting index of overall result set from which to return ids.
qquerystringFree text search across all indexed fields.
sortquerystringThe property to sort by.
parametersquerydictionaryFull query string parameters payload in JSON format.

Code Examples

Section titled “Code Examples”
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.query_notifications(filter="string",
                                      limit=integer,
                                      offset=integer,
                                      q="string",
                                      sort="string")
print(response)

QueryRulesV1

Section titled “QueryRulesV1”

Query monitoring rules based on provided criteria. Use the IDs from this response to fetch the rules on GetRulesV1.

GET /recon/queries/rules/v1
Scope Monitoring Rules (Falcon Intelligence): READ Consumes · Produces application/json
PEP 8 query_rules

Parameters

Section titled “Parameters”
NameTypeData typeDescription
filterquerystringFQL query expression that should be used to limit the results. Available filters include: permissions, priority, template_priority, topic.
limitqueryintegerMaximum number of records to return.
offsetquerystringStarting index of overall result set from which to return ids.
qquerystringFree text search across all indexed fields.
sortquerystringThe property to sort by. Available sort fields include: permissions, priority, template_priority, topic.
secondary_sortquerystringThe secondary property to sort by. secondarySort is also accepted as this keyword. Available fields: created_timestamp, last_updated_timestamp, permissions, priority, template_priority, topic.
parametersquerydictionaryFull query string parameters payload in JSON format.

Code Examples

Section titled “Code Examples”
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.query_rules(filter="string",
                              limit=integer,
                              offset=integer,
                              q="string",
                              secondary_sort="string",
                              sort="string")
print(response)
© 2026 CrowdStrike, Inc. All rights reserved. Privacy Notice Cookie Notice Terms of Use