Response Policies

The Response Policies service collection provides operations for managing Falcon real-time response policies. Search for policies and their members, create and delete policies, update settings, perform actions such as enabling, disabling, or assigning host groups, and set policy precedence order across your environment.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
createRTResponsePolicies create_policies	Create Response Policies by specifying details about the policy to create
deleteRTResponsePolicies delete_policies	Delete a set of Response Policies by specifying their IDs
getRTResponsePolicies get_policies	Retrieve a set of Response Policies by specifying their IDs
performRTResponsePoliciesAction perform_policies_action	Perform the specified action on the Response Policies specified in the request
queryCombinedRTResponsePolicies query_combined_policies	Search for Response Policies in your environment by providing an FQL filter and paging details.
queryCombinedRTResponsePolicyMembers query_combined_policy_members	Search for members of a Response policy in your environment by providing an FQL filter and paging details.
queryRTResponsePolicies query_policies	Search for Response Policies in your environment by providing an FQL filter with sort and/or paging details.
queryRTResponsePolicyMembers query_policy_members	Search for members of a Response policy in your environment by providing an FQL filter and paging details.
setRTResponsePoliciesPrecedence set_policies_precedence	Sets the precedence of Response Policies based on the order of IDs specified in the request.
updateRTResponsePolicies update_policies	Update Response Policies by specifying the ID of the policy and details to update

---

createRTResponsePolicies

Create Response Policies by specifying details about the policy to create

Method POST

Route /policy/entities/response/v1

Scope Response policies: WRITE

PEP 8 create_policies

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

A collection of policies to create

clone_id body · string

Response Policy ID to clone.

description body · string

Response Policy description.

name body · string

Response Policy name.

platform_name body · string

Name of the operating system platform.

settings body · list of dictionaries

Response policy specific settings.

Code Examples

Python

PEP 8

from falconpy import ResponsePolicies

falcon = ResponsePolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

settings = [
    {
        "id": "string",
        "value": {}
    }
]

response = falcon.create_policies(clone_id="string",
                                  description="string",
                                  name="string",
                                  platform_name="string",
                                  settings=settings)
print(response)

Operation ID

from falconpy import ResponsePolicies

falcon = ResponsePolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

settings = [
    {
        "id": "string",
        "value": {}
    }
]

response = falcon.createRTResponsePolicies(clone_id="string",
                                           description="string",
                                           name="string",
                                           platform_name="string",
                                           settings=settings)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "clone_id": "string",
            "description": "string",
            "name": "string",
            "platform_name": "string",
            "settings": [
                {
                    "id": "string",
                    "value": {}
                }
            ]
        }
    ]
}

response = falcon.command("createRTResponsePolicies", body=body_payload)
print(response)

PowerShell

New-FalconResponsePolicy -Name "string" -PlatformName "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/response_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  clone_id := "string"
  description := "string"
  name := "string"
  platform_name := "string"
  id := "string"

  response, err := client.ResponsePolicies.CreateRTResponsePolicies(
    &response_policies.CreateRTResponsePoliciesParams{
      Body: &models.RemoteResponseCreatePoliciesV1{
        Resources: []interface{}{
          {
          CloneID: &clone_id,
          Description: &description,
          Name: &name,
          PlatformName: &platform_name,
          Settings: []interface{}{
            {
            ID: &id,
            Value: &struct{}{},
            },
          },
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.responsePolicies.createRTResponsePolicies(
  {
    resources: [{
        cloneId: "string",
        description: "string",
        name: "string",
        platformName: "string",
        settings: [{
            id: "string",
            value: {}
          }]
      }]
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::response_policies_api::create_rt_response_policies;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RemoteResponseCreatePoliciesV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RemoteResponseCreatePoliciesV1 {
        resources: vec![CreatePolicyReqV1 {
            name: Some("string".to_string()),
            platform_name: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = create_rt_response_policies(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ResponsePolicies.new

body = Falcon::RemoteResponseCreatePoliciesV1.new(
  resources: [{
      clone_id: 'string',
      description: 'string',
      name: 'string',
      platform_name: 'string',
      settings: [{
          id: 'string',
          value: {}
        }]
    }]
)

response = api.create_rt_response_policies(body)

puts response

Responses

201 Created

[
  {
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform_name": "string",
    "settings": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": []
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": []
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": []
    }
  ]
}

---

---

deleteRTResponsePolicies

Delete a set of Response Policies by specifying their IDs

Method DELETE

Route /policy/entities/response/v1

Scope Response policies: WRITE

PEP 8 delete_policies

Parameters

ids query · string or list of strings

The IDs of the Response Policies to delete

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ResponsePolicies

falcon = ResponsePolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_policies(ids=id_list)
print(response)

Operation ID

from falconpy import ResponsePolicies

falcon = ResponsePolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteRTResponsePolicies(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deleteRTResponsePolicies",
                          ids=id_list)
print(response)

PowerShell

Remove-FalconResponsePolicy -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/response_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ResponsePolicies.DeleteRTResponsePolicies(
    &response_policies.DeleteRTResponsePoliciesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.responsePolicies.deleteRTResponsePolicies(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::response_policies_api::delete_rt_response_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_rt_response_policies(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ResponsePolicies.new

response = api.delete_rt_response_policies(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  "string"
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

---

---

getRTResponsePolicies

Retrieve a set of Response Policies by specifying their IDs

Method GET

Route /policy/entities/response/v1

Scope Response policies: READ

PEP 8 get_policies

Parameters

ids query · string or list of strings

The IDs of the RTR Policies to return

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ResponsePolicies

falcon = ResponsePolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_policies(ids=id_list)
print(response)

Operation ID

from falconpy import ResponsePolicies

falcon = ResponsePolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getRTResponsePolicies(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getRTResponsePolicies",
                          ids=id_list)
print(response)

PowerShell

Get-FalconResponsePolicy -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/response_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ResponsePolicies.GetRTResponsePolicies(
    &response_policies.GetRTResponsePoliciesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.responsePolicies.getRTResponsePolicies(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::response_policies_api::get_rt_response_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_rt_response_policies(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ResponsePolicies.new

response = api.get_rt_response_policies(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform_name": "string",
    "settings": []
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": []
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": []
    }
  ]
}

---

---

performRTResponsePoliciesAction

Perform the specified action on the Response Policies specified in the request

Method POST

Route /policy/entities/response-actions/v1

Scope Response policies: WRITE

PEP 8 perform_policies_action

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

action_parameters body · array

Action specific parameter options.

ids body · array

Response policy ID(s) to perform actions against.

action_name query · string

The action to perform

Available values (6)

add-host-group	add-rule-group	disable
enable	remove-host-group	remove-rule-group

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

group_id body · string

Host Group ID to apply the policy to. Overridden if action_parameters is provided.

Code Examples

Python

PEP 8

from falconpy import ResponsePolicies

falcon = ResponsePolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.perform_policies_action(action_name="string",
                                          action_parameters=[{"key": "value"}],
                                          group_id="string",
                                          ids=id_list)
print(response)

Operation ID

from falconpy import ResponsePolicies

falcon = ResponsePolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.performRTResponsePoliciesAction(action_name="string",
                                                  action_parameters=[{"key": "value"}],
                                                  group_id="string",
                                                  ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "action_parameters": [
        {
            "name": "string",
            "value": "string"
        }
    ],
    "ids": ["string"]
}

response = falcon.command("performRTResponsePoliciesAction",
                          action_name="string",
                          body=body_payload)
print(response)

PowerShell

Invoke-FalconResponsePolicyAction -Name "string" -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/response_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"
  value := "string"

  response, err := client.ResponsePolicies.PerformRTResponsePoliciesAction(
    &response_policies.PerformRTResponsePoliciesActionParams{
      Body: &models.MsaEntityActionRequestV2{
        ActionParameters: []interface{}{
          {
          Name: &name,
          Value: &value,
          },
        },
        Ids: []string{"string"},
      },
      ActionName: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.responsePolicies.performRTResponsePoliciesAction(
  "string",  // actionName
  {  // body
      actionParameters: [{
          name: "string",
          value: "string"
        }],
      ids: []
  }
);

console.log(response);

Rust

use rusty_falcon::apis::response_policies_api::perform_rt_response_policies_action;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaEntityActionRequestV2;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaEntityActionRequestV2 {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = perform_rt_response_policies_action(
        &falcon.cfg,  // configuration
        "string",  // action_name
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ResponsePolicies.new

body = Falcon::MsaEntityActionRequestV2.new(
  action_parameters: [{
      name: 'string',
      value: 'string'
    }],
  ids: []
)

response = api.perform_rt_response_policies_action(body, 'string')

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform_name": "string",
    "settings": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": []
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": []
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": []
    }
  ]
}

---

---

queryCombinedRTResponsePolicies

Search for Response Policies in your environment by providing an FQL filter and paging details.

Method GET

Route /policy/combined/response/v1

Scope Response policies: READ

PEP 8 query_combined_policies

Parameters

filter query · string

The filter expression that should be used to limit the results.

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return. [1-5000]

sort query · string

The property to sort by.

Available values (16)

created_by.asc	created_by.desc	created_timestamp.asc
created_timestamp.desc	enabled.asc	enabled.desc
modified_by.asc	modified_by.desc	modified_timestamp.asc
modified_timestamp.desc	name.asc	name.desc
platform_name.asc	platform_name.desc	precedence.asc
precedence.desc

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ResponsePolicies

falcon = ResponsePolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.query_combined_policies(filter="string",
                                          limit=integer,
                                          offset=integer,
                                          sort="string")
print(response)

Operation ID

from falconpy import ResponsePolicies

falcon = ResponsePolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.queryCombinedRTResponsePolicies(filter="string",
                                                  limit=integer,
                                                  offset=integer,
                                                  sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryCombinedRTResponsePolicies",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

PowerShell

Get-FalconResponsePolicy -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/response_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.ResponsePolicies.QueryCombinedRTResponsePolicies(
    &response_policies.QueryCombinedRTResponsePoliciesParams{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.responsePolicies.queryCombinedRTResponsePolicies(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

Rust

use rusty_falcon::apis::response_policies_api::query_combined_rt_response_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_combined_rt_response_policies(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ResponsePolicies.new

response = api.query_combined_rt_response_policies(filter: 'string',
                                                   offset: integer,
                                                   limit: integer,
                                                   sort: 'string')

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform_name": "string",
    "settings": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": []
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": []
    }
  ]
}

---

---

queryCombinedRTResponsePolicyMembers

Search for members of a Response policy in your environment by providing an FQL filter and paging details.

Method GET

Route /policy/combined/response-members/v1

Scope Response policies: READ

PEP 8 query_combined_policy_members

Parameters

id query · string

The ID of the Response policy to search for members of

filter query · string

The filter expression that should be used to limit the results.

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return. [1-5000]

sort query · string

The property to sort by.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ResponsePolicies

falcon = ResponsePolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.query_combined_policy_members(id="string",
                                                filter="string",
                                                limit=integer,
                                                offset=integer,
                                                sort="string")
print(response)

Operation ID

from falconpy import ResponsePolicies

falcon = ResponsePolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.queryCombinedRTResponsePolicyMembers(id="string",
                                                       filter="string",
                                                       limit=integer,
                                                       offset=integer,
                                                       sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryCombinedRTResponsePolicyMembers",
                          id="string",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

PowerShell

Get-FalconResponsePolicyMember -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/response_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  iD := "string"
  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.ResponsePolicies.QueryCombinedRTResponsePolicyMembers(
    &response_policies.QueryCombinedRTResponsePolicyMembersParams{
      ID: &iD,
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.responsePolicies.queryCombinedRTResponsePolicyMembers(
  "string",  // id
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

Rust

use rusty_falcon::apis::response_policies_api::query_combined_rt_response_policy_members;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_combined_rt_response_policy_members(
        &falcon.cfg,  // configuration
        Some("string"),  // id
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ResponsePolicies.new

response = api.query_combined_rt_response_policy_members(id: 'string',
                                                         filter: 'string',
                                                         offset: integer,
                                                         limit: integer,
                                                         sort: 'string')

puts response

Responses

200 OK

[
  {
    "agent_load_flags": "string",
    "agent_local_time": "string",
    "agent_version": "string",
    "base_image_version": "string",
    "bios_manufacturer": "string",
    "bios_version": "string",
    "build_number": "string",
    "chassis_type": "string",
    "chassis_type_desc": "string",
    "cid": "string",
    "cloud_service_compartment_id": "string",
    "config_id_base": "string",
    "config_id_build": "string",
    "config_id_platform": "string",
    "connection_ip": "string",
    "connection_mac_address": "string",
    "cpu_signature": "string",
    "cpu_vendor": "string",
    "criticality": "string",
    "default_gateway_ip": "string",
    "deployment_type": "string",
    "detection_suppression_status": "string",
    "device_id": "string",
    "device_policies": {},
    "email": "string",
    "external_ip": "string",
    "filesystem_containment_status": "string",
    "first_login_timestamp": "string",
    "first_login_user": "string",
    "first_seen": "string",
    "group_hash": "string",
    "groups": [],
    "host_deleted_status": "string",
    "host_hidden_status": "string",
    "host_utc_offset": "string",
    "hostname": "string",
    "instance_id": "string",
    "internet_exposure": "string",
    "k8s_cluster_git_version": "string",
    "k8s_cluster_id": "string",
    "k8s_cluster_version": "string",
    "kernel_version": "string",
    "last_login_timestamp": "string",
    "last_login_uid": "string",
    "last_login_user": "string",
    "last_login_user_sid": "string",
    "last_reboot": "string",
    "last_seen": "string",
    "license_activation_state": "string",
    "linux_sensor_mode": "string",
    "local_ip": "string",
    "mac_address": "string",
    "machine_domain": "string",
    "major_version": "string",
    "managed_apps": {},
    "meta": {},
    "migration_completed_time": "string",
    "minor_version": "string",
    "modified_timestamp": "string",
    "notes": [],
    "os_build": "string",
    "os_product_name": "string",
    "os_version": "string",
    "ou": [],
    "platform_id": "string",
    "platform_name": "string",
    "pod_annotations": [],
    "pod_host_ip4": "string",
    "pod_host_ip6": "string",
    "pod_hostname": "string",
    "pod_id": "string",
    "pod_ip4": "string",
    "pod_ip6": "string",
    "pod_labels": [],
    "pod_name": "string",
    "pod_namespace": "string",
    "pod_service_account_name": "string",
    "pointer_size": "string",
    "policies": [],
    "product_type": "string",
    "product_type_desc": "string",
    "provision_status": "string",
    "reduced_functionality_mode": "string",
    "release_group": "string",
    "rtr_state": "string",
    "safe_mode": "string",
    "serial_number": "string",
    "service_pack_major": "string",
    "service_pack_minor": "string",
    "service_provider": "string",
    "service_provider_account_id": "string",
    "site_name": "string",
    "slow_changing_modified_timestamp": "string",
    "status": "string",
    "system_manufacturer": "string",
    "system_product_name": "string",
    "tags": [],
    "zone_group": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "agent_load_flags": "string",
      "agent_local_time": "string",
      "agent_version": "string",
      "base_image_version": "string",
      "bios_manufacturer": "string",
      "bios_version": "string",
      "build_number": "string",
      "chassis_type": "string",
      "chassis_type_desc": "string",
      "cid": "string",
      "cloud_service_compartment_id": "string",
      "config_id_base": "string",
      "config_id_build": "string",
      "config_id_platform": "string",
      "connection_ip": "string",
      "connection_mac_address": "string",
      "cpu_signature": "string",
      "cpu_vendor": "string",
      "criticality": "string",
      "default_gateway_ip": "string",
      "deployment_type": "string",
      "detection_suppression_status": "string",
      "device_id": "string",
      "device_policies": {},
      "email": "string",
      "external_ip": "string",
      "filesystem_containment_status": "string",
      "first_login_timestamp": "string",
      "first_login_user": "string",
      "first_seen": "string",
      "group_hash": "string",
      "groups": [],
      "host_deleted_status": "string",
      "host_hidden_status": "string",
      "host_utc_offset": "string",
      "hostname": "string",
      "instance_id": "string",
      "internet_exposure": "string",
      "k8s_cluster_git_version": "string",
      "k8s_cluster_id": "string",
      "k8s_cluster_version": "string",
      "kernel_version": "string",
      "last_login_timestamp": "string",
      "last_login_uid": "string",
      "last_login_user": "string",
      "last_login_user_sid": "string",
      "last_reboot": "string",
      "last_seen": "string",
      "license_activation_state": "string",
      "linux_sensor_mode": "string",
      "local_ip": "string",
      "mac_address": "string",
      "machine_domain": "string",
      "major_version": "string",
      "managed_apps": {},
      "meta": {},
      "migration_completed_time": "string",
      "minor_version": "string",
      "modified_timestamp": "string",
      "notes": [],
      "os_build": "string",
      "os_product_name": "string",
      "os_version": "string",
      "ou": [],
      "platform_id": "string",
      "platform_name": "string",
      "pod_annotations": [],
      "pod_host_ip4": "string",
      "pod_host_ip6": "string",
      "pod_hostname": "string",
      "pod_id": "string",
      "pod_ip4": "string",
      "pod_ip6": "string",
      "pod_labels": [],
      "pod_name": "string",
      "pod_namespace": "string",
      "pod_service_account_name": "string",
      "pointer_size": "string",
      "policies": [],
      "product_type": "string",
      "product_type_desc": "string",
      "provision_status": "string",
      "reduced_functionality_mode": "string",
      "release_group": "string",
      "rtr_state": "string",
      "safe_mode": "string",
      "serial_number": "string",
      "service_pack_major": "string",
      "service_pack_minor": "string",
      "service_provider": "string",
      "service_provider_account_id": "string",
      "site_name": "string",
      "slow_changing_modified_timestamp": "string",
      "status": "string",
      "system_manufacturer": "string",
      "system_product_name": "string",
      "tags": [],
      "zone_group": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "agent_load_flags": "string",
      "agent_local_time": "string",
      "agent_version": "string",
      "base_image_version": "string",
      "bios_manufacturer": "string",
      "bios_version": "string",
      "build_number": "string",
      "chassis_type": "string",
      "chassis_type_desc": "string",
      "cid": "string",
      "cloud_service_compartment_id": "string",
      "config_id_base": "string",
      "config_id_build": "string",
      "config_id_platform": "string",
      "connection_ip": "string",
      "connection_mac_address": "string",
      "cpu_signature": "string",
      "cpu_vendor": "string",
      "criticality": "string",
      "default_gateway_ip": "string",
      "deployment_type": "string",
      "detection_suppression_status": "string",
      "device_id": "string",
      "device_policies": {},
      "email": "string",
      "external_ip": "string",
      "filesystem_containment_status": "string",
      "first_login_timestamp": "string",
      "first_login_user": "string",
      "first_seen": "string",
      "group_hash": "string",
      "groups": [],
      "host_deleted_status": "string",
      "host_hidden_status": "string",
      "host_utc_offset": "string",
      "hostname": "string",
      "instance_id": "string",
      "internet_exposure": "string",
      "k8s_cluster_git_version": "string",
      "k8s_cluster_id": "string",
      "k8s_cluster_version": "string",
      "kernel_version": "string",
      "last_login_timestamp": "string",
      "last_login_uid": "string",
      "last_login_user": "string",
      "last_login_user_sid": "string",
      "last_reboot": "string",
      "last_seen": "string",
      "license_activation_state": "string",
      "linux_sensor_mode": "string",
      "local_ip": "string",
      "mac_address": "string",
      "machine_domain": "string",
      "major_version": "string",
      "managed_apps": {},
      "meta": {},
      "migration_completed_time": "string",
      "minor_version": "string",
      "modified_timestamp": "string",
      "notes": [],
      "os_build": "string",
      "os_product_name": "string",
      "os_version": "string",
      "ou": [],
      "platform_id": "string",
      "platform_name": "string",
      "pod_annotations": [],
      "pod_host_ip4": "string",
      "pod_host_ip6": "string",
      "pod_hostname": "string",
      "pod_id": "string",
      "pod_ip4": "string",
      "pod_ip6": "string",
      "pod_labels": [],
      "pod_name": "string",
      "pod_namespace": "string",
      "pod_service_account_name": "string",
      "pointer_size": "string",
      "policies": [],
      "product_type": "string",
      "product_type_desc": "string",
      "provision_status": "string",
      "reduced_functionality_mode": "string",
      "release_group": "string",
      "rtr_state": "string",
      "safe_mode": "string",
      "serial_number": "string",
      "service_pack_major": "string",
      "service_pack_minor": "string",
      "service_provider": "string",
      "service_provider_account_id": "string",
      "site_name": "string",
      "slow_changing_modified_timestamp": "string",
      "status": "string",
      "system_manufacturer": "string",
      "system_product_name": "string",
      "tags": [],
      "zone_group": "string"
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "agent_load_flags": "string",
      "agent_local_time": "string",
      "agent_version": "string",
      "base_image_version": "string",
      "bios_manufacturer": "string",
      "bios_version": "string",
      "build_number": "string",
      "chassis_type": "string",
      "chassis_type_desc": "string",
      "cid": "string",
      "cloud_service_compartment_id": "string",
      "config_id_base": "string",
      "config_id_build": "string",
      "config_id_platform": "string",
      "connection_ip": "string",
      "connection_mac_address": "string",
      "cpu_signature": "string",
      "cpu_vendor": "string",
      "criticality": "string",
      "default_gateway_ip": "string",
      "deployment_type": "string",
      "detection_suppression_status": "string",
      "device_id": "string",
      "device_policies": {},
      "email": "string",
      "external_ip": "string",
      "filesystem_containment_status": "string",
      "first_login_timestamp": "string",
      "first_login_user": "string",
      "first_seen": "string",
      "group_hash": "string",
      "groups": [],
      "host_deleted_status": "string",
      "host_hidden_status": "string",
      "host_utc_offset": "string",
      "hostname": "string",
      "instance_id": "string",
      "internet_exposure": "string",
      "k8s_cluster_git_version": "string",
      "k8s_cluster_id": "string",
      "k8s_cluster_version": "string",
      "kernel_version": "string",
      "last_login_timestamp": "string",
      "last_login_uid": "string",
      "last_login_user": "string",
      "last_login_user_sid": "string",
      "last_reboot": "string",
      "last_seen": "string",
      "license_activation_state": "string",
      "linux_sensor_mode": "string",
      "local_ip": "string",
      "mac_address": "string",
      "machine_domain": "string",
      "major_version": "string",
      "managed_apps": {},
      "meta": {},
      "migration_completed_time": "string",
      "minor_version": "string",
      "modified_timestamp": "string",
      "notes": [],
      "os_build": "string",
      "os_product_name": "string",
      "os_version": "string",
      "ou": [],
      "platform_id": "string",
      "platform_name": "string",
      "pod_annotations": [],
      "pod_host_ip4": "string",
      "pod_host_ip6": "string",
      "pod_hostname": "string",
      "pod_id": "string",
      "pod_ip4": "string",
      "pod_ip6": "string",
      "pod_labels": [],
      "pod_name": "string",
      "pod_namespace": "string",
      "pod_service_account_name": "string",
      "pointer_size": "string",
      "policies": [],
      "product_type": "string",
      "product_type_desc": "string",
      "provision_status": "string",
      "reduced_functionality_mode": "string",
      "release_group": "string",
      "rtr_state": "string",
      "safe_mode": "string",
      "serial_number": "string",
      "service_pack_major": "string",
      "service_pack_minor": "string",
      "service_provider": "string",
      "service_provider_account_id": "string",
      "site_name": "string",
      "slow_changing_modified_timestamp": "string",
      "status": "string",
      "system_manufacturer": "string",
      "system_product_name": "string",
      "tags": [],
      "zone_group": "string"
    }
  ]
}

---

---

queryRTResponsePolicies

Search for Response Policies in your environment by providing an FQL filter with sort and/or paging details.

Method GET

Route /policy/queries/response/v1

Scope Response policies: READ

PEP 8 query_policies

Parameters

filter query · string

FQL query expression that should be used to limit the results.

offset query · integer

The offset of the first record to retrieve from

limit query · integer

The maximum number of records to return [1-5000]

sort query · string

The property to sort by.

Available values (16)

created_by.asc	created_by.desc	created_timestamp.asc
created_timestamp.desc	enabled.asc	enabled.desc
modified_by.asc	modified_by.desc	modified_timestamp.asc
modified_timestamp.desc	name.asc	name.desc
platform_name.asc	platform_name.desc	precedence.asc
precedence.desc

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ResponsePolicies

falcon = ResponsePolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.query_policies(filter="string",
                                 limit=integer,
                                 offset=integer,
                                 sort="string")
print(response)

Operation ID

from falconpy import ResponsePolicies

falcon = ResponsePolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.queryRTResponsePolicies(filter="string",
                                          limit=integer,
                                          offset=integer,
                                          sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryRTResponsePolicies",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

PowerShell

Get-FalconResponsePolicy -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/response_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.ResponsePolicies.QueryRTResponsePolicies(
    &response_policies.QueryRTResponsePoliciesParams{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.responsePolicies.queryRTResponsePolicies(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

Rust

use rusty_falcon::apis::response_policies_api::query_rt_response_policies;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_rt_response_policies(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ResponsePolicies.new

response = api.query_rt_response_policies(filter: 'string',
                                          offset: integer,
                                          limit: integer,
                                          sort: 'string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

---

---

queryRTResponsePolicyMembers

Search for members of a Response policy in your environment by providing an FQL filter and paging details.

Method GET

Route /policy/queries/response-members/v1

Scope Response policies: READ

PEP 8 query_policy_members

Parameters

id query · string

The ID of the Response policy to search for members of

filter query · string

FQL query expression that should be used to limit the results.

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return. [1-5000]

sort query · string

The property to sort by.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ResponsePolicies

falcon = ResponsePolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.query_policy_members(id="string",
                                       filter="string",
                                       limit=integer,
                                       offset=integer,
                                       sort="string")
print(response)

Operation ID

from falconpy import ResponsePolicies

falcon = ResponsePolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.queryRTResponsePolicyMembers(id="string",
                                               filter="string",
                                               limit=integer,
                                               offset=integer,
                                               sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryRTResponsePolicyMembers",
                          id="string",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

PowerShell

Get-FalconResponsePolicyMember -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/response_policies"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  iD := "string"
  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.ResponsePolicies.QueryRTResponsePolicyMembers(
    &response_policies.QueryRTResponsePolicyMembersParams{
      ID: &iD,
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.responsePolicies.queryRTResponsePolicyMembers(
  "string",  // id
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

Rust

use rusty_falcon::apis::response_policies_api::query_rt_response_policy_members;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_rt_response_policy_members(
        &falcon.cfg,  // configuration
        Some("string"),  // id
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ResponsePolicies.new

response = api.query_rt_response_policy_members(id: 'string',
                                                filter: 'string',
                                                offset: integer,
                                                limit: integer,
                                                sort: 'string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

---

---

setRTResponsePoliciesPrecedence

Sets the precedence of Response Policies based on the order of IDs specified in the request.

Method POST

Route /policy/entities/response-precedence/v1

Scope Response policies: WRITE

PEP 8 set_policies_precedence

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

ids body · array

The ids of all current prevention policies for the platform specified. The precedence will be set in the order the ids are specified

platform_name body · string

The name of the platform for which to set precedence

Available values (3)

Windows

Mac

Linux

Code Examples

Python

PEP 8

from falconpy import ResponsePolicies

falcon = ResponsePolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.set_policies_precedence(ids=id_list, platform_name="string")
print(response)

Operation ID

from falconpy import ResponsePolicies

falcon = ResponsePolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.setRTResponsePoliciesPrecedence(ids=id_list,
                                                  platform_name="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "ids": ["string"],
    "platform_name": "string"
}

response = falcon.command("setRTResponsePoliciesPrecedence", body=body_payload)
print(response)

PowerShell

Set-FalconResponsePrecedence -PlatformName "string" -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/response_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  platform_name := "string"

  response, err := client.ResponsePolicies.SetRTResponsePoliciesPrecedence(
    &response_policies.SetRTResponsePoliciesPrecedenceParams{
      Body: &models.BaseSetPolicyPrecedenceReqV1{
        Ids: []string{"string"},
        PlatformName: &platform_name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.responsePolicies.setRTResponsePoliciesPrecedence(
  {
    ids: [],
    platformName: "string"
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::response_policies_api::set_rt_response_policies_precedence;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::BaseSetPolicyPrecedenceReqV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = BaseSetPolicyPrecedenceReqV1 {
        ids: vec!["string".to_string()],
        platform_name: Some("string".to_string()),
        ..Default::default()
    };

    let response = set_rt_response_policies_precedence(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ResponsePolicies.new

body = Falcon::BaseSetPolicyPrecedenceReqV1.new(
  ids: [],
  platform_name: 'string'
)

response = api.set_rt_response_policies_precedence(body)

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

---

---

updateRTResponsePolicies

Update Response Policies by specifying the ID of the policy and details to update

Method PATCH

Route /policy/entities/response/v1

Scope Response policies: WRITE

PEP 8 update_policies

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

A collection of policies to update

description body · string

Response Policy description.

id body · string

Response Policy ID to update.

name body · string

Response Policy name.

settings body · list of dictionaries

Response policy specific settings.

Code Examples

Python

PEP 8

from falconpy import ResponsePolicies

falcon = ResponsePolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

settings = [
    {
        "id": "string",
        "value": {}
    }
]

response = falcon.update_policies(description="string",
                                  id="string",
                                  name="string",
                                  settings=settings)
print(response)

Operation ID

from falconpy import ResponsePolicies

falcon = ResponsePolicies(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

settings = [
    {
        "id": "string",
        "value": {}
    }
]

response = falcon.updateRTResponsePolicies(description="string",
                                           id="string",
                                           name="string",
                                           settings=settings)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "description": "string",
            "id": "string",
            "name": "string",
            "settings": [
                {
                    "id": "string",
                    "value": {}
                }
            ]
        }
    ]
}

response = falcon.command("updateRTResponsePolicies", body=body_payload)
print(response)

PowerShell

Edit-FalconResponsePolicy -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/response_policies"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  id := "string"
  name := "string"

  response, err := client.ResponsePolicies.UpdateRTResponsePolicies(
    &response_policies.UpdateRTResponsePoliciesParams{
      Body: &models.RemoteResponseUpdatePoliciesReqV1{
        Resources: []interface{}{
          {
          Description: &description,
          ID: &id,
          Name: &name,
          Settings: []interface{}{
            {
            ID: &id,
            Value: &struct{}{},
            },
          },
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.responsePolicies.updateRTResponsePolicies(
  {
    resources: [{
        description: "string",
        id: "string",
        name: "string",
        settings: [{
            id: "string",
            value: {}
          }]
      }]
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::response_policies_api::update_rt_response_policies;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::RemoteResponseUpdatePoliciesReqV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = RemoteResponseUpdatePoliciesReqV1 {
        resources: vec![UpdatePolicyReqV1 {
            id: Some("string".to_string()),
            settings: vec![SettingReqV1 {
                id: Some("string".to_string()),
                value: Default::default(),
                ..Default::default()
            }],
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = update_rt_response_policies(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ResponsePolicies.new

body = Falcon::RemoteResponseUpdatePoliciesReqV1.new(
  resources: [{
      description: 'string',
      id: 'string',
      name: 'string',
      settings: [{
          id: 'string',
          value: {}
        }]
    }]
)

response = api.update_rt_response_policies(body)

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "created_by": "string",
    "created_timestamp": "string",
    "description": "string",
    "enabled": false,
    "groups": [],
    "id": "string",
    "modified_by": "string",
    "modified_timestamp": "string",
    "name": "string",
    "platform_name": "string",
    "settings": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": []
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": []
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_by": "string",
      "created_timestamp": "string",
      "description": "string",
      "enabled": false,
      "groups": [],
      "id": "string",
      "modified_by": "string",
      "modified_timestamp": "string",
      "name": "string",
      "platform_name": "string",
      "settings": []
    }
  ]
}