Skip to content
CrowdStrike Developer Center

Recon

The Recon service collection provides operations for managing monitoring rules, notifications, and actions in the CrowdStrike Falcon Recon platform. Create and manage monitoring rules for intelligence topics, handle notification aggregates and exposed data records, export jobs, and query actions and notifications across your environment.

LanguageLast Update
Pythonv1.6.5
PowerShellv2.2.9
Gov0.22.0
TypeScriptv0.6.0
Rustv0.7.1
Rubyv1.4.0

This service collection has code examples posted to the repository.

Table of Contents

Section titled “Table of Contents”
OperationDescription
AggregateNotificationsExposedDataRecordsV1
aggregate_notifications_exposed_data_records		Get notification exposed data record aggregates as specified via JSON in request body.
AggregateNotificationsV1
aggregate_notifications		Get notification aggregates as specified via JSON in request body.
CreateActionsV1
create_actions		Create actions for a monitoring rule.
CreateExportJobsV1
create_export_jobs		Launch asynchronous export job.
CreateRulesV1
create_rules		Create monitoring rules.
DeleteActionV1
delete_action		Delete an action from a monitoring rule based on the action ID.
DeleteExportJobsV1
delete_export_jobs		Delete export jobs (and their associated file(s)) based on their IDs.
DeleteNotificationsV1
delete_notifications		Delete notifications based on IDs.
DeleteRulesV1
delete_rules		Delete monitoring rules.
GetActionsV1
get_actions		Get actions based on their IDs.
GetExportJobsV1
get_export_jobs		Get the status of export jobs based on their IDs.
GetFileContentForExportJobsV1
get_export_job_file_contents		Download the file associated with a job ID.
GetNotificationsDetailedTranslatedV1
get_notifications_detailed_translated		Get detailed notifications based on their IDs.
GetNotificationsDetailedV1
get_notifications_detailed		Get detailed notifications based on their IDs.
GetNotificationsExposedDataRecordsV1
get_notifications_exposed_data_records		Get notifications exposed data records based on their IDs.
GetNotificationsTranslatedV1
get_notifications_translated		Get notifications based on their IDs.
GetNotificationsV1
get_notifications		Get notifications based on their IDs.
GetRulesV1
get_rules		Get monitoring rules based on their IDs.
PreviewRuleV1
preview_rule		Preview rules notification count and distribution.
QueryActionsV1
query_actions		Query actions based on provided criteria.
QueryNotificationsExposedDataRecordsV1
query_notifications_exposed_data_records		Query notifications exposed data records based on provided criteria.
QueryNotificationsV1
query_notifications		Query notifications based on provided criteria.
QueryRulesV1
query_rules		Query monitoring rules based on provided criteria.
UpdateActionV1
update_action		Update an action for a monitoring rule.
UpdateNotificationsV1
update_notifications		Update notification status or assignee.
UpdateRulesV1
update_rules		Update monitoring rules.

AggregateNotificationsExposedDataRecordsV1

Section titled “AggregateNotificationsExposedDataRecordsV1”

Get notification exposed data record aggregates as specified via JSON in request body.

Method POST
Route /recon/aggregates/notifications-exposed-data-records/GET/v1
Scope Monitoring rules (Falcon Intelligence Recon): READ
PEP 8 aggregate_notifications_exposed_data_records

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
If peforming a date range query specify the from and to date ranges. These can be in common date formats like 2019-07-18 or now.
exclude body · string
Fields to exclude.
extended_bounds body · object
field body · string
Term you want to aggregate on. If doing a date_range query, this is the date field you want to apply the date ranges to.
filter body · string
Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
filters_spec body · object
from body · integer
include body · string
Fields to include.
interval body · string
Available values (6)
yearmonthweek
dayhourminute
max_doc_count body · integer
Maximum number of documents.
min_doc_count body · integer
Minimum number of documents.
missing body · string
name body · string
Scan name.
percents body · array
q body · string
FQL syntax.
ranges body · array
size body · integer
sort body · string
FQL syntax.
Available values (2)
_count
sort by document count
_term
sort by the string value alphabetically
sub_aggregates body · array
time_zone body · string
type body · string
Available values (10)
date_histogram
Aggregates counts on a specified time interval. Requires use of “interval” field.
date_range
Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
terms
Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
range
Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.
cardinality
Returns the count of distinct values in a specified field.
max
Returns the maximum value of a specified field.
min
Returns the minimum value of a specified field.
avg
Returns the average value of the specified field.
sum
Returns the total sum of all values for the specified field.
percentiles
Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.
Code Examples
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]


ranges = [
    {
        "From": 0,
        "To": 0
    }
]


response = falcon.aggregate_notifications_exposed_data_records(date_ranges=date_ranges,
                                                               exclude="string",
                                                               field="string",
                                                               filter="string",
                                                               from=integer,
                                                               include="string",
                                                               interval="string",
                                                               max_doc_count=integer,
                                                               min_doc_count=integer,
                                                               missing="string",
                                                               name="string",
                                                               q="string",
                                                               ranges=ranges,
                                                               size=integer,
                                                               sort="string",
                                                               sub_aggregates=["string"],
                                                               time_zone="string",
                                                               type="string")
print(response)
Responses
[
  {
    "buckets": [],
    "name": "string",
    "sum_other_doc_count": 0
  }
]

AggregateNotificationsV1

Section titled “AggregateNotificationsV1”

Get notification aggregates as specified via JSON in request body.

Method POST
Route /recon/aggregates/notifications/GET/v1
Scope Monitoring rules (Falcon Intelligence Recon): READ
PEP 8 aggregate_notifications

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
If peforming a date range query specify the from and to date ranges. These can be in common date formats like 2019-07-18 or now.
exclude body · string
Fields to exclude.
extended_bounds body · object
field body · string
Term you want to aggregate on. If doing a date_range query, this is the date field you want to apply the date ranges to.
filter body · string
Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
filters_spec body · object
from body · integer
include body · string
Fields to include.
interval body · string
Available values (6)
yearmonthweek
dayhourminute
max_doc_count body · integer
Maximum number of documents.
min_doc_count body · integer
Minimum number of documents.
missing body · string
name body · string
Scan name.
percents body · array
q body · string
FQL syntax.
ranges body · array
size body · integer
sort body · string
FQL syntax.
Available values (2)
_count
sort by document count
_term
sort by the string value alphabetically
sub_aggregates body · array
time_zone body · string
type body · string
Available values (10)
date_histogram
Aggregates counts on a specified time interval. Requires use of “interval” field.
date_range
Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
terms
Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
range
Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.
cardinality
Returns the count of distinct values in a specified field.
max
Returns the maximum value of a specified field.
min
Returns the minimum value of a specified field.
avg
Returns the average value of the specified field.
sum
Returns the total sum of all values for the specified field.
percentiles
Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.
Code Examples
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]


ranges = [
    {
        "From": 0,
        "To": 0
    }
]


response = falcon.aggregate_notifications(date_ranges=date_ranges,
                                          exclude="string",
                                          field="string",
                                          filter="string",
                                          from=integer,
                                          include="string",
                                          interval="string",
                                          max_doc_count=integer,
                                          min_doc_count=integer,
                                          missing="string",
                                          name="string",
                                          q="string",
                                          ranges=ranges,
                                          size=integer,
                                          sort="string",
                                          sub_aggregates=["string"],
                                          time_zone="string",
                                          type="string")
print(response)
Responses
[
  {
    "buckets": [],
    "name": "string",
    "sum_other_doc_count": 0
  }
]

CreateActionsV1

Section titled “CreateActionsV1”

Create actions for a monitoring rule.

Method POST
Route /recon/entities/actions/v1
Scope Monitoring rules (Falcon Intelligence Recon): WRITE
PEP 8 create_actions

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
actions body · array
List of actions to attach to the monitoring rule. When provided, actions overrides other passed keywords excluding body.
rule_id body · string
Rule ID to attach the action to. Always.
content_format body · string
Content format.
frequency body · string
Frequency of the action. Used when only one action is being handled.
recipients body · string
UUIDs of the recipients. Used when only one action is being handled.
trigger_matchless body · boolean
Trigger on no matches.
type body · string
Action type, used when only one action is being handled.
Code Examples
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.create_actions(actions=[{"key": "value"}],
                                 content_format="string",
                                 frequency="string",
                                 recipients="string",
                                 rule_id="string",
                                 trigger_matchless=boolean,
                                 type="string")
print(response)
Responses
[
  {
    "cid": "string",
    "content_format": "string",
    "created_timestamp": "string",
    "frequency": "string",
    "id": "string",
    "recipients": [],
    "rule_id": "string",
    "status": "string",
    "trigger_matchless": false,
    "type": "string",
    "updated_timestamp": "string",
    "user_uuid": "string"
  }
]

CreateExportJobsV1

Section titled “CreateExportJobsV1”

Launch asynchronous export job.

Method POST
Route /recon/entities/exports/v1
Scope Monitoring rules (Falcon Intelligence Recon): WRITE
PEP 8 create_export_jobs

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
entity body · string
The entity type. This can be one of:
Available values (3)
notification-exposed-data-recordhistorical-search-exposed-data-recordbulk-historical-search-exposed-data-record
export_type body · string
The file type of the export. This can be one of:
Available values (2)
jsoncsv
filter body · string
FQL query to filter entities by. Possible filter properties depend on the entity type. Examples: For ‘notification-exposed-data-record’: notification_id:‘MjAyMy0wNS0yNVQyMDoyOToyNFpfMzAwMTI3YTgtZTJjMi0yYjA0LTBhNDctOTVkODA5ZDFhYTkw’+credential_status:[‘previously_reported’] or _all:*’*’. For ‘historical-search-exposed-data-record’: event_id:‘AHsiZSI6Ik5Ub3dOR1V4TlROaU5tTmxNamxoTkRBek9USXpNekV3WkRVMFpqVTBNamRtTXpSa1pUVmtOalUzTWpJd1ptVTBOemRrTlRaaE1EQXdNakF4WldObU5tTTQiLCJmIjoiKGRvbWFpbjonY3Jvd2RzdHJpa2UuY29tJykifQ’. For ‘bulk-historical-search-exposed-data-record’: (domain:‘crowdstrike.com’)+(date_from:‘2024-01-15’)+(date_to:‘2024-12-31’)
human_readable body · boolean
If set to true (default), the field names in the exported file will resemble the table header in the UI (e.g. “Hash type”), otherwise the API level field names will be used (e.g. “hash_type”)
sort body · string
Possible order by fields:
Available values (2)
created_timestamplast_updated_timestamp
Code Examples
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.create_export_jobs(entity="string",
                                     export_type="string",
                                     filter="string",
                                     human_readable=boolean,
                                     sort="string")
print(response)
Responses
[
  {
    "id": "string",
    "status": "string"
  }
]

CreateRulesV1

Section titled “CreateRulesV1”

Create monitoring rules.

Method POST
Route /recon/entities/rules/v1
Scope Monitoring rules (Falcon Intelligence Recon): WRITE
PEP 8 create_rules

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
breach_monitor_only body · boolean
Monitor only for exposed data. Must be accompanied by breach_monitoring_enabled:true.
breach_monitoring_enabled body · boolean
Whether to monitor for exposed data. Available only for Company Domains and Email addresses rule topics.
exposed_data_match_type body · string
filter body · string
The FQL filter to be used for searching
lookback_period body · integer
The duration for which the rule will look back in the past at the first run. Time unit: nanoseconds. Possible values:
Available values (4)
604800000000000259200000000000015552000000000000
31536000000000000
match_on_tsq_result_types body · array
Which result types to monitor for. Can be set to only monitor domains or subdomains, as well as both. Only available for the Typosquatting rule topic. Possible values:
Available values (2)
basedomainssubdomains
name body · string
The name of a given rule
originating_template_id body · string
This is for internal use only. It tells the id of the template if the rule was generated based on one.
permissions body · string
The permissions for a given rule which specifies the rule’s access by other users. Possible values:
Available values (2)
publicprivate
priority body · string
The priority for a given rule. Possible values:
Available values (5)
nonelowmedium
highcritical
substring_matching_enabled body · boolean
Whether to monitor for substring matches. Only available for the Typosquatting rule topic.
topic body · string
The topic of a given rule. Possible values:
Available values (12)
SA_BRAND_PRODUCTSA_VIPSA_THIRD_PARTY
SA_IPSA_CVESA_BIN
SA_DOMAINSA_EMAILSA_ALIAS
SA_AUTHORSA_CUSTOMSA_TYPOSQUATTING
tsq_match_edit_distance body · string
The edit distance to be used with the loosely_matches() filter operator(eg: typosquatting_term:‘yourdomain’) in the context of Typosquatting topic rules. Possible values: [auto, 1, 2]. Not permitted with other rule topics and/or operators.
Available values (3)
auto12
Code Examples
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.create_rules(breach_monitoring_enabled=boolean,
                               filter="string",
                               name="string",
                               permissions="string",
                               priority="string",
                               substring_matching_enabled=boolean,
                               topic="string")
print(response)
Responses
[
  {
    "breach_monitor_only": false,
    "breach_monitoring_enabled": false,
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "exposed_data_match_type": "string",
    "filter": "string",
    "id": "string",
    "lookback_period": 0,
    "match_on_tsq_result_types": [],
    "name": "string",
    "originating_template_id": "string",
    "ownership_assets": {},
    "permissions": "string",
    "priority": "string",
    "status": "string",
    "status_message": "string",
    "substring_matching_enabled": false,
    "template_priority": 0,
    "topic": "string",
    "tsq_match_edit_distance": "string",
    "updated_timestamp": "string",
    "user_id": "string",
    "user_name": "string",
    "user_uuid": "string"
  }
]

DeleteActionV1

Section titled “DeleteActionV1”

Delete an action from a monitoring rule based on the action ID.

Method DELETE
Route /recon/entities/actions/v1
Scope Monitoring rules (Falcon Intelligence Recon): WRITE
PEP 8 delete_action

Parameters

Section titled “Parameters”
id query · string
ID of the action.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
ids body · string or list of strings
List of action IDs to delete.
Code Examples
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.delete_action(ids=id_list)
print(response)
Responses
[
  "string"
]

DeleteExportJobsV1

Section titled “DeleteExportJobsV1”

Delete export jobs (and their associated file(s)) based on their IDs.

Method DELETE
Route /recon/entities/exports/v1
Scope Monitoring rules (Falcon Intelligence Recon): WRITE
PEP 8 delete_export_jobs

Parameters

Section titled “Parameters”
ids query · string or list of strings
Export Job IDs.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.delete_export_jobs(ids=id_list)
print(response)
Responses
[
  "string"
]

DeleteNotificationsV1

Section titled “DeleteNotificationsV1”

Delete notifications based on IDs.

Method DELETE
Route /recon/entities/notifications/v1
Scope Monitoring rules (Falcon Intelligence Recon): WRITE
PEP 8 delete_notifications

Parameters

Section titled “Parameters”
ids query · string or list of strings
Notifications IDs.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.delete_notifications(ids=id_list)
print(response)
Responses
[
  "string"
]

DeleteRulesV1

Section titled “DeleteRulesV1”

Delete monitoring rules.

Method DELETE
Route /recon/entities/rules/v1
Scope Monitoring rules (Falcon Intelligence Recon): WRITE
PEP 8 delete_rules

Parameters

Section titled “Parameters”
ids query · string or list of strings
IDs of rules.
notificationsDeletionRequested query · boolean
Whether we should delete the notifications generated by this rule or not
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.delete_rules(ids=id_list,
                               notificationsDeletionRequested=boolean)
print(response)
Responses
[
  "string"
]

GetActionsV1

Section titled “GetActionsV1”

Get actions based on their IDs.

Method GET
Route /recon/entities/actions/v1
Scope Monitoring rules (Falcon Intelligence Recon): READ
PEP 8 get_actions

Parameters

Section titled “Parameters”
ids query · string or list of strings
Action IDs.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_actions(ids=id_list)
print(response)
Responses
[
  {
    "cid": "string",
    "content_format": "string",
    "created_timestamp": "string",
    "frequency": "string",
    "id": "string",
    "recipients": [],
    "rule_id": "string",
    "status": "string",
    "trigger_matchless": false,
    "type": "string",
    "updated_timestamp": "string",
    "user_uuid": "string"
  }
]

GetExportJobsV1

Section titled “GetExportJobsV1”

Get the status of export jobs based on their IDs.

Method GET
Route /recon/entities/exports/v1
Scope Monitoring rules (Falcon Intelligence Recon): READ
PEP 8 get_export_jobs

Parameters

Section titled “Parameters”
ids query · string or list of strings
Export Job IDs.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_export_jobs(ids=id_list)
print(response)
Responses
[
  {
    "completion_percentage": 0,
    "created_date": "string",
    "entity": "string",
    "filename": "string",
    "id": "string",
    "status": "string"
  }
]

GetFileContentForExportJobsV1

Section titled “GetFileContentForExportJobsV1”

Download the file associated with a job ID.

Method GET
Route /recon/entities/export-files/v1
Scope Monitoring rules (Falcon Intelligence Recon): READ
PEP 8 get_export_job_file_contents

Parameters

Section titled “Parameters”
id query · string
Export Job ID.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
ids body · string
Export job ID to retrieve details for.
Code Examples
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


with open("output_file", "wb") as save_file:
    response = falcon.get_export_job_file_contents(ids=id_list, stream=boolean)
    save_file.write(response)
Responses
{
  "errors": [
    {
      "code": 0,
      "details": [],
      "id": "string",
      "message": "string",
      "message_key": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

GetNotificationsDetailedTranslatedV1

Section titled “GetNotificationsDetailedTranslatedV1”

Get detailed notifications based on their IDs.

Method GET
Route /recon/entities/notifications-detailed-translated/v1
Scope Monitoring rules (Falcon Intelligence Recon): READ
PEP 8 get_notifications_detailed_translated

Parameters

Section titled “Parameters”
ids query · string or list of strings
Notification IDs.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_notifications_detailed_translated(ids=id_list)
print(response)
Responses
[
  {
    "breach_details": {},
    "details": {},
    "id": "string",
    "missing_details_reason": "string",
    "notification": {}
  }
]

GetNotificationsDetailedV1

Section titled “GetNotificationsDetailedV1”

Get detailed notifications based on their IDs.

Method GET
Route /recon/entities/notifications-detailed/v1
Scope Monitoring rules (Falcon Intelligence Recon): READ
PEP 8 get_notifications_detailed

Parameters

Section titled “Parameters”
ids query · string or list of strings
Notification IDs.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_notifications_detailed(ids=id_list)
print(response)
Responses
[
  {
    "breach_details": {},
    "details": {},
    "id": "string",
    "missing_details_reason": "string",
    "notification": {}
  }
]

GetNotificationsExposedDataRecordsV1

Section titled “GetNotificationsExposedDataRecordsV1”

Get notifications exposed data records based on their IDs.

Method GET
Route /recon/entities/notifications-exposed-data-records/v1
Scope Monitoring rules (Falcon Intelligence Recon): READ
PEP 8 get_notifications_exposed_data_records

Parameters

Section titled “Parameters”
ids query · string or list of strings
Notification exposed records IDs.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_notifications_exposed_data_records(ids=id_list)
print(response)
Responses
[
  {
    "author": "string",
    "author_id": "string",
    "bot": {},
    "cid": "string",
    "company": "string",
    "created_date": "string",
    "credential_status": "string",
    "credentials_domain": "string",
    "credentials_ip": "string",
    "credentials_url": "string",
    "display_name": "string",
    "domain": "string",
    "email": "string",
    "event_date": "string",
    "exposure_date": "string",
    "file": {},
    "financial": {},
    "full_name": "string",
    "hash_type": "string",
    "id": "string",
    "job_position": "string",
    "location": {},
    "login_id": "string",
    "malware_family": "string",
    "notification_group_id": "string",
    "notification_id": "string",
    "password": "string",
    "password_hash": "string",
    "password_salt": "string",
    "phone_number": "string",
    "raw_intel_id": "string",
    "rule": {},
    "site": "string",
    "site_id": "string",
    "social": {},
    "source_category": "string",
    "user_id": "string",
    "user_ip": "string",
    "user_uuid": "string"
  }
]

GetNotificationsTranslatedV1

Section titled “GetNotificationsTranslatedV1”

Get notifications based on their IDs.

Method GET
Route /recon/entities/notifications-translated/v1
Scope Monitoring rules (Falcon Intelligence Recon): READ
PEP 8 get_notifications_translated

Parameters

Section titled “Parameters”
ids query · string or list of strings
Notification IDs.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_notifications_translated(ids=id_list)
print(response)
Responses
[
  {
    "actor_slug": "string",
    "assigned_to_uid": "string",
    "assigned_to_username": "string",
    "assigned_to_uuid": "string",
    "breach_summary": {},
    "cid": "string",
    "created_date": "string",
    "highlights": [],
    "id": "string",
    "item_author": "string",
    "item_author_id": "string",
    "item_date": "string",
    "item_id": "string",
    "item_site": "string",
    "item_site_id": "string",
    "item_type": "string",
    "logs": [],
    "notification_group_id": "string",
    "raw_intel_id": "string",
    "risk_score_label": "string",
    "risk_score_matching_criteria": [],
    "rule_creator_name": "string",
    "rule_creator_uid": "string",
    "rule_creator_uuid": "string",
    "rule_id": "string",
    "rule_name": "string",
    "rule_priority": "string",
    "rule_topic": "string",
    "source_category": "string",
    "status": "string",
    "term_matches": [],
    "typosquatting": {},
    "updated_date": "string"
  }
]

GetNotificationsV1

Section titled “GetNotificationsV1”

Get notifications based on their IDs.

Method GET
Route /recon/entities/notifications/v1
Scope Monitoring rules (Falcon Intelligence Recon): READ
PEP 8 get_notifications

Parameters

Section titled “Parameters”
ids query · string or list of strings
Notification IDs.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_notifications(ids=id_list)
print(response)
Responses
[
  {
    "actor_slug": "string",
    "assigned_to_uid": "string",
    "assigned_to_username": "string",
    "assigned_to_uuid": "string",
    "breach_summary": {},
    "cid": "string",
    "created_date": "string",
    "highlights": [],
    "id": "string",
    "item_author": "string",
    "item_author_id": "string",
    "item_date": "string",
    "item_id": "string",
    "item_site": "string",
    "item_site_id": "string",
    "item_type": "string",
    "logs": [],
    "notification_group_id": "string",
    "raw_intel_id": "string",
    "risk_score_label": "string",
    "risk_score_matching_criteria": [],
    "rule_creator_name": "string",
    "rule_creator_uid": "string",
    "rule_creator_uuid": "string",
    "rule_id": "string",
    "rule_name": "string",
    "rule_priority": "string",
    "rule_topic": "string",
    "source_category": "string",
    "status": "string",
    "term_matches": [],
    "typosquatting": {},
    "updated_date": "string"
  }
]

GetRulesV1

Section titled “GetRulesV1”

Get monitoring rules based on their IDs.

Method GET
Route /recon/entities/rules/v1
Scope Monitoring rules (Falcon Intelligence Recon): READ
PEP 8 get_rules

Parameters

Section titled “Parameters”
ids query · string or list of strings
IDs of rules.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_rules(ids=id_list)
print(response)
Responses
[
  {
    "breach_monitor_only": false,
    "breach_monitoring_enabled": false,
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "exposed_data_match_type": "string",
    "filter": "string",
    "id": "string",
    "lookback_period": 0,
    "match_on_tsq_result_types": [],
    "name": "string",
    "originating_template_id": "string",
    "ownership_assets": {},
    "permissions": "string",
    "priority": "string",
    "status": "string",
    "status_message": "string",
    "substring_matching_enabled": false,
    "template_priority": 0,
    "topic": "string",
    "tsq_match_edit_distance": "string",
    "updated_timestamp": "string",
    "user_id": "string",
    "user_name": "string",
    "user_uuid": "string"
  }
]

PreviewRuleV1

Section titled “PreviewRuleV1”

Preview rules notification count and distribution.

Method POST
Route /recon/aggregates/rules-preview/GET/v1
Scope Monitoring rules (Falcon Intelligence Recon): READ
PEP 8 preview_rule

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
filter body · string
Rule filter.
lookback_days body · integer
topic body · string
Rule topic.
Code Examples
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.preview_rule(filter="string", topic="string")
print(response)
Responses
[
  {
    "buckets": [],
    "name": "string",
    "sum_other_doc_count": 0
  }
]

QueryActionsV1

Section titled “QueryActionsV1”

Query actions based on provided criteria.

Method GET
Route /recon/queries/actions/v1
Scope Monitoring rules (Falcon Intelligence Recon): READ
PEP 8 query_actions

Parameters

Section titled “Parameters”
offset query · integer
Starting index of overall result set from which to return IDs.
limit query · integer
Number of IDs to return. Offset + limit should NOT be above 10K.
sort query · string
The property to sort by.
filter query · string
FQL query expression that should be used to limit the results.
q query · string
Free text search across all indexed fields
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.query_actions(filter="string",
                                limit=integer,
                                offset=integer,
                                q="string",
                                sort="string")
print(response)
Responses
[
  "string"
]

QueryNotificationsExposedDataRecordsV1

Section titled “QueryNotificationsExposedDataRecordsV1”

Query notifications exposed data records based on provided criteria.

Method GET
Route /recon/queries/notifications-exposed-data-records/v1
Scope Monitoring rules (Falcon Intelligence Recon): READ
PEP 8 query_notifications_exposed_data_records

Parameters

Section titled “Parameters”
offset query · integer
Starting index of overall result set from which to return ids.
limit query · integer
Number of IDs to return. Offset + limit should NOT be above 10K.
sort query · string
desc`)
filter query · string
FQL query expression that should be used to limit the results. Available filters:
Available values (55)
idciduser_uuid
created_dateexposure_daterule.id
rule.namerule.topicnotification_id
notification_group_idsource_categorysite
site_idauthorauthor_id
user_iduser_namecredentials_url
credentials_domaincredentials_ipemail
domainhash_typedisplay_name
full_nameuser_ipphone_number
companyjob_positionfile.name
file.complete_data_setfile.download_urlslocation.postal_code
location.citylocation.statelocation.federal_district
location.federal_admin_regionlocation.country_codesocial.twitter_id
social.facebook_idsocial.vk_idsocial.vk_token
social.aim_idsocial.icq_idsocial.msn_id
social.instagram_idsocial.skype_idfinancial.credit_card
financial.bank_accountfinancial.crypto_currency_addresseslogin_id
credential_status_allbot.operating_system.hardware_id
bot.bot_id
q query · string
Free text search across all indexed fields.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.query_notifications_exposed_data_records(filter="string",
                                                           limit=integer,
                                                           offset=integer,
                                                           q="string",
                                                           sort="string")
print(response)
Responses
[
  "string"
]

QueryNotificationsV1

Section titled “QueryNotificationsV1”

Query notifications based on provided criteria.

Method GET
Route /recon/queries/notifications/v1
Scope Monitoring rules (Falcon Intelligence Recon): READ
PEP 8 query_notifications

Parameters

Section titled “Parameters”
offset query · integer
Starting index of overall result set from which to return IDs.
limit query · integer
Number of IDs to return. Offset + limit should NOT be above 10K.
sort query · string
The property to sort by.
filter query · string
FQL query expression that should be used to limit the results.
q query · string
Free text search across all indexed fields.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.query_notifications(filter="string",
                                      limit=integer,
                                      offset=integer,
                                      q="string",
                                      sort="string")
print(response)
Responses
[
  "string"
]

QueryRulesV1

Section titled “QueryRulesV1”

Query monitoring rules based on provided criteria.

Method GET
Route /recon/queries/rules/v1
Scope Monitoring rules (Falcon Intelligence Recon): READ
PEP 8 query_rules

Parameters

Section titled “Parameters”
offset query · integer
Starting index of overall result set from which to return IDs.
limit query · integer
Number of IDs to return. Offset + limit should NOT be above 10K.
sort query · string
The property to sort by. Available sort fields:
Available values (3)
prioritytemplate_prioritytopic
filter query · string
FQL query expression that should be used to limit the results. Available filters include: permissions, priority, template_priority, topic
q query · string
Free text search across all indexed fields.
secondarySort query · string
Possible order by fields:
Available values (6)
created_timestamplast_updated_timestamppermissions
prioritytemplate_prioritytopic
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.query_rules(filter="string",
                              limit=integer,
                              offset=integer,
                              q="string",
                              secondary_sort="string",
                              sort="string")
print(response)
Responses
[
  "string"
]

UpdateActionV1

Section titled “UpdateActionV1”

Update an action for a monitoring rule.

Method PATCH
Route /recon/entities/actions/v1
Scope Monitoring rules (Falcon Intelligence Recon): WRITE
PEP 8 update_action

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
content_format body · string
Content format.
frequency body · string
Frequency of the action.
id body · string
Action ID.
recipients body · array
UUIDs of the recipients.
status body · string
Action status.
trigger_matchless body · boolean
Trigger on no match.
Code Examples
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.update_action(content_format="string",
                                frequency="string",
                                id="string",
                                recipients=id_list,
                                status="string",
                                trigger_matchless=boolean)
print(response)
Responses
[
  {
    "cid": "string",
    "content_format": "string",
    "created_timestamp": "string",
    "frequency": "string",
    "id": "string",
    "recipients": [],
    "rule_id": "string",
    "status": "string",
    "trigger_matchless": false,
    "type": "string",
    "updated_timestamp": "string",
    "user_uuid": "string"
  }
]

UpdateNotificationsV1

Section titled “UpdateNotificationsV1”

Update notification status or assignee.

Method PATCH
Route /recon/entities/notifications/v1
Scope Monitoring rules (Falcon Intelligence Recon): WRITE
PEP 8 update_notifications

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
assigned_to_uuid body · string
The unique ID of the user who is assigned to this notification. The value unassigned can be used to unassign a notification.
id body · string
The ID of the notifications
idp_send_status body · string
message body · string
status body · string
The notification status. This can be one of:
Available values (4)
newin-progressclosed-false-positive
closed-true-positive
Code Examples
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.update_notifications(assigned_to_uuid="string",
                                       id="string",
                                       status="string")
print(response)
Responses
[
  {
    "actor_slug": "string",
    "assigned_to_uid": "string",
    "assigned_to_username": "string",
    "assigned_to_uuid": "string",
    "breach_summary": {},
    "cid": "string",
    "created_date": "string",
    "highlights": [],
    "id": "string",
    "item_author": "string",
    "item_author_id": "string",
    "item_date": "string",
    "item_id": "string",
    "item_site": "string",
    "item_site_id": "string",
    "item_type": "string",
    "logs": [],
    "notification_group_id": "string",
    "raw_intel_id": "string",
    "risk_score_label": "string",
    "risk_score_matching_criteria": [],
    "rule_creator_name": "string",
    "rule_creator_uid": "string",
    "rule_creator_uuid": "string",
    "rule_id": "string",
    "rule_name": "string",
    "rule_priority": "string",
    "rule_topic": "string",
    "source_category": "string",
    "status": "string",
    "term_matches": [],
    "typosquatting": {},
    "updated_date": "string"
  }
]

UpdateRulesV1

Section titled “UpdateRulesV1”

Update monitoring rules.

Method PATCH
Route /recon/entities/rules/v1
Scope Monitoring rules (Falcon Intelligence Recon): WRITE
PEP 8 update_rules

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
breach_monitor_only body · boolean
Monitor only for exposed data. Must be accompanied by breach_monitoring_enabled:true.
breach_monitoring_enabled body · boolean
Whether to monitor for exposed data. Available only for Company Domains and Email addresses rule topics.
exposed_data_match_type body · string
filter body · string
The FQL filter to be used for searching
id body · string
The rule ID to be updated
match_on_tsq_result_types body · array
Which result types to monitor for. Can be set to only monitor domains or subdomains, as well as both. Only available for the Typosquatting rule topic.
name body · string
The name of a given rule
permissions body · string
The permissions for a given rule which specifies the rule’s access by other users. Possible values:
Available values (2)
publicprivate
priority body · string
The priority for a given rule. Possible values:
Available values (5)
nonelowmedium
highcritical
substring_matching_enabled body · boolean
Whether to monitor for substring matches. Only available for the Typosquatting topic.
tsq_match_edit_distance body · string
The edit distance to be used with the loosely_matches() filter operator(eg: typosquatting_term:‘yourdomain’) in the context of Typosquatting topic rules. Possible values: [auto, 1, 2]. Not permitted with other rule topics and/or operators.
Available values (3)
auto12
Code Examples
from falconpy import Recon


falcon = Recon(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.update_rules(breach_monitoring_enabled=boolean,
                               filter="string",
                               name="string",
                               permissions="string",
                               priority="string",
                               id="string",
                               substring_matching_enabled=boolean)
print(response)
Responses
[
  {
    "breach_monitor_only": false,
    "breach_monitoring_enabled": false,
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "exposed_data_match_type": "string",
    "filter": "string",
    "id": "string",
    "lookback_period": 0,
    "match_on_tsq_result_types": [],
    "name": "string",
    "originating_template_id": "string",
    "ownership_assets": {},
    "permissions": "string",
    "priority": "string",
    "status": "string",
    "status_message": "string",
    "substring_matching_enabled": false,
    "template_priority": 0,
    "topic": "string",
    "tsq_match_edit_distance": "string",
    "updated_timestamp": "string",
    "user_id": "string",
    "user_name": "string",
    "user_uuid": "string"
  }
]
© 2026 CrowdStrike, Inc. All rights reserved. Privacy Notice Cookie Notice Terms of Use