SaaS Security
The SaaS Security service collection provides operations for monitoring and managing security across connected SaaS applications. Dismiss security checks and affected entities, retrieve activity monitors, alerts, application inventory, asset and device data, integration status, security check results, system logs, and user inventories. Manage custom integration builder transactions.
| Language | Last Update |
|---|---|
| Python | v1.6.6 |
| PowerShell | |
| Go | v0.22.0 |
| TypeScript | v0.7.0 |
| Rust | v0.7.1 |
| Ruby | v1.4.0 |
Table of Contents
Section titled “Table of Contents”| Operation | Description |
|---|---|
ConnectCheckTagV3connect_check_tag | POST Connect a Check Tag to a Security Check |
CreateAppJournalCommentV3create_app_journal_comment | POST App Journal Comment |
CreateCheckJournalCommentV3create_check_journal_comment | POST Security Check Journal Comment |
CreateUserJournalCommentV3create_user_journal_comment | POST User Journal Comment |
DisconnectCheckTagV3disconnect_check_tag | DELETE Disconnect a Check Tag from a Security Check |
DismissAffectedEntityV3dismiss_affected_entity | POST Dismiss Affected Entity |
DismissSecurityCheckV3dismiss_security_check | POST Dismiss Security Check by ID |
GetActivityMonitorV3get_activity_monitor | GET Activity Monitor |
GetAiAgentDetailsget_ai_agent_details | GET AI Agent Details |
GetAiAgentsInventoryget_ai_agents_inventory | GET AI Agents Inventory |
GetAlertsV3get_alerts | GET Alert by ID or GET Alerts |
GetAppInventoryget_application_inventory | GET Applications Inventory |
GetAppInventoryUsersget_application_users | GET Application Users |
GetAppJournalV3get_app_journal | GET App Journal |
GetAssetInventoryV3get_asset_inventory | GET Data Inventory |
GetCheckJournalV3get_check_journal | GET Security Check Journal |
GetCheckParamsV3get_check_params | GET List Security Check Params |
GetCheckTagsV3get_check_tags | GET List Check Tags |
GetDeviceInventoryV3get_device_inventory | GET Device Inventory |
GetIntegrationsV3get_integrations | GET Integrations |
GetMetricsV3get_metrics | GET Metrics |
GetSecurityCheckAffectedV3get_security_check | GET Security Check Affected |
GetSecurityCheckComplianceV3get_security_check_compliance | GET Compliance |
GetSecurityChecksV3get_security_checks | GET Security Check by ID or GET List Security Checks |
GetSupportedSaasV3get_supported_saas | GET Supported SaaS |
GetSystemLogsV3get_system_logs | GET System Logs |
GetSystemUsersV3get_system_users | GET System Users |
GetUserInventoryV3get_user_inventory | GET User Inventory |
GetUserJournalV3get_user_journal | GET User Journal |
IntegrationBuilderEndTransactionV3complete_integration_upload | POST Data Upload Transaction Completion |
IntegrationBuilderGetStatusV3get_integration_builder_status | GET Status |
IntegrationBuilderResetV3reset_integration_builder | Reset |
IntegrationBuilderUploadV3upload_integration_builder | POST Upload |
RestoreAffectedEntityV3restore_affected_entity | POST Restore Affected Entity |
RestoreSecurityCheckV3restore_security_check | POST Restore Security Check by ID |
SetCheckParamV3set_check_param | POST Set a Security Check Param |
ConnectCheckTagV3
Section titled “ConnectCheckTagV3”POST Connect a Check Tag to a Security Check
Method POST
Route /saas-security/entities/check-tags/v3
Scope SaaS Security (Falcon Shield): WRITE
PEP 8
connect_check_tagParameters
Section titled “Parameters”id query · string
Security Check ID
tag_id query · string
Check Tag ID
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.connect_check_tag(id="string", tag_id="string")print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.ConnectCheckTagV3(id="string", tag_id="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("ConnectCheckTagV3", id="string", tag_id="string")print(response)Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Responses
[ "string"]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}CreateAppJournalCommentV3
Section titled “CreateAppJournalCommentV3”POST App Journal Comment
Method POST
Route /saas-security/entities/app-journal/v3
Scope SaaS Security (Falcon Shield): WRITE
PEP 8
create_app_journal_commentParameters
Section titled “Parameters”body body · dictionary
Full body payload as JSON formatted dictionary.
id body · array
One or more item identifiers to append the comment to (up to 50)
note body · string
Comment content
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.create_app_journal_comment(id=["string"], note="string")print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.CreateAppJournalCommentV3(id=["string"], note="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
body_payload = { "id": ["string"], "note": "string"}
response = falcon.command("CreateAppJournalCommentV3", body=body_payload)print(response)Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Responses
[ { "author": "string", "error": "string", "id": "string", "note": "string", "timestamp": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}CreateCheckJournalCommentV3
Section titled “CreateCheckJournalCommentV3”POST Security Check Journal Comment
Method POST
Route /saas-security/entities/check-journal/v3
Scope SaaS Security (Falcon Shield): WRITE
PEP 8
create_check_journal_commentParameters
Section titled “Parameters”body body · dictionary
Full body payload as JSON formatted dictionary.
id body · array
One or more item identifiers to append the comment to (up to 50)
note body · string
Comment content
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.create_check_journal_comment(id=["string"], note="string")print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.CreateCheckJournalCommentV3(id=["string"], note="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
body_payload = { "id": ["string"], "note": "string"}
response = falcon.command("CreateCheckJournalCommentV3", body=body_payload)print(response)Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Responses
[ { "author": "string", "error": "string", "id": "string", "note": "string", "timestamp": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}CreateUserJournalCommentV3
Section titled “CreateUserJournalCommentV3”POST User Journal Comment
Method POST
Route /saas-security/entities/user-journal/v3
Scope SaaS Security (Falcon Shield): WRITE
PEP 8
create_user_journal_commentParameters
Section titled “Parameters”body body · dictionary
Full body payload as JSON formatted dictionary.
id body · array
One or more item identifiers to append the comment to (up to 50)
note body · string
Comment content
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.create_user_journal_comment(id=["string"], note="string")print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.CreateUserJournalCommentV3(id=["string"], note="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
body_payload = { "id": ["string"], "note": "string"}
response = falcon.command("CreateUserJournalCommentV3", body=body_payload)print(response)Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Responses
[ { "author": "string", "error": "string", "id": "string", "note": "string", "timestamp": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}DisconnectCheckTagV3
Section titled “DisconnectCheckTagV3”DELETE Disconnect a Check Tag from a Security Check
Method DELETE
Route /saas-security/entities/check-tags/v3
Scope SaaS Security (Falcon Shield): WRITE
PEP 8
disconnect_check_tagParameters
Section titled “Parameters”id query · string
Security Check ID
tag_id query · string
Check Tag ID
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.disconnect_check_tag(id="string", tag_id="string")print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.DisconnectCheckTagV3(id="string", tag_id="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("DisconnectCheckTagV3", id="string", tag_id="string")print(response)Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Responses
[ "string"]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}DismissAffectedEntityV3
Section titled “DismissAffectedEntityV3”POST Dismiss Affected Entity
Method POST
Route /saas-security/entities/check-dismiss-affected/v3
Scope SaaS Security (Falcon Shield): WRITE
PEP 8
dismiss_affected_entityParameters
Section titled “Parameters”body body · dictionary
Full body payload as JSON formatted dictionary.
duration_in_days body · integer
Snooze the dismiss for this many days (1-365). Omit to dismiss indefinitely
entities body · string
Comma separated list of entity names to dismiss
reason body · string
Dismiss reason
id query · string
Security Check ID
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.dismiss_affected_entity(entities="string", reason="string", id="string")print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.DismissAffectedEntityV3(entities="string", reason="string", id="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
body_payload = { "duration_in_days": integer, "entities": "string", "reason": "string"}
response = falcon.command("DismissAffectedEntityV3", id="string", body=body_payload)print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/saas_security")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
response, err := client.SaasSecurity.DismissAffectedEntityV3( &saas_security.DismissAffectedEntityV3Params{ Body: saas_security.DismissAffectedEntityV3Body{}, ID: "string", Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: "us-1", clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.saasSecurity.dismissAffectedEntityV3( "string", // id { // body entities: "string", reason: "string" });
console.log(response);use rusty_falcon::apis::saas_security_api::dismiss_affected_entity_v3;use rusty_falcon::easy::client::FalconHandle;use rusty_falcon::models::DismissAffectedEntityV3Request;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let body = DismissAffectedEntityV3Request { ..Default::default() };
let response = dismiss_affected_entity_v3( &falcon.cfg, // configuration "string", // id body, // body ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SaasSecurity.new
body = Falcon::DismissAffectedEntityV3Request.new( entities: 'string', reason: 'string')
response = api.dismiss_affected_entity_v3('string', body)
puts responseResponses
[ { "reason": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}DismissSecurityCheckV3
Section titled “DismissSecurityCheckV3”POST Dismiss Security Check by ID
Method POST
Route /saas-security/entities/check-dismiss/v3
Scope SaaS Security (Falcon Shield): WRITE
PEP 8
dismiss_security_checkParameters
Section titled “Parameters”body body · dictionary
Full body payload as JSON formatted dictionary.
duration_in_days body · integer
Snooze the dismiss for this many days (1-365). Omit to dismiss indefinitely
reason body · string
Dismiss reason
id query · string
Security Check ID
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.dismiss_security_check(reason="string", id="string")print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.DismissSecurityCheckV3(reason="string", id="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
body_payload = { "duration_in_days": integer, "reason": "string"}
response = falcon.command("DismissSecurityCheckV3", id="string", body=body_payload)print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/saas_security")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
response, err := client.SaasSecurity.DismissSecurityCheckV3( &saas_security.DismissSecurityCheckV3Params{ Body: saas_security.DismissSecurityCheckV3Body{}, ID: "string", Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: "us-1", clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.saasSecurity.dismissSecurityCheckV3( "string", // id { // body reason: "string" });
console.log(response);use rusty_falcon::apis::saas_security_api::dismiss_security_check_v3;use rusty_falcon::easy::client::FalconHandle;use rusty_falcon::models::DismissSecurityCheckV3Request;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let body = DismissSecurityCheckV3Request { ..Default::default() };
let response = dismiss_security_check_v3( &falcon.cfg, // configuration "string", // id body, // body ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SaasSecurity.new
body = Falcon::DismissSecurityCheckV3Request.new( reason: 'string')
response = api.dismiss_security_check_v3('string', body)
puts responseResponses
[ "string"]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}GetActivityMonitorV3
Section titled “GetActivityMonitorV3”GET Activity Monitor
Method GET
Route /saas-security/entities/monitor/v3
Scope SaaS Security (Falcon Shield): READ
PEP 8
get_activity_monitorParameters
Section titled “Parameters”integration_id query · string
Integration ID
actor query · string
Actor
category query · string
Comma separated list of categories
projection query · string
Comma separated list of projections
from_date query · string
From Date
to_date query · string
To Date
limit query · integer
Max number of logs to fetch
skip query · integer
Number of logs to skip
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.get_activity_monitor(integration_id="string", actor="string", category="string", projection="string", from_date="string", to_date="string", limit=integer, skip=integer)print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.GetActivityMonitorV3(integration_id="string", actor="string", category="string", projection="string", from_date="string", to_date="string", limit=integer, skip=integer)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("GetActivityMonitorV3", integration_id="string", actor="string", category="string", projection="string", from_date="string", to_date="string", limit=integer, skip=integer)print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/saas_security" "github.com/go-openapi/strfmt")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
integrationID := "string" actor := "string" category := "string" projection := "string" body := strfmt.DateTime{} body2 := strfmt.DateTime{} limit := int64(0) skip := int64(0)
response, err := client.SaasSecurity.GetActivityMonitorV3( &saas_security.GetActivityMonitorV3Params{ IntegrationID: &integrationID, Actor: &actor, Category: &category, Projection: &projection, FromDate: &body, ToDate: &body2, Limit: &limit, Skip: &skip, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: "us-1", clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.saasSecurity.getActivityMonitorV3( "string", // integrationId "string", // actor "string", // category "string", // projection new Date(), // fromDate new Date(), // toDate integer, // limit integer // skip);
console.log(response);use rusty_falcon::apis::saas_security_api::get_activity_monitor_v3;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = get_activity_monitor_v3( &falcon.cfg, // configuration Some("string"), // integration_id Some("string"), // actor Some("string"), // category Some("string"), // projection Some("string".to_string()), // from_date Some("string".to_string()), // to_date Some(integer), // limit Some(integer), // skip ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SaasSecurity.new
response = api.get_activity_monitor_v3(integration_id: 'string', actor: 'string', category: 'string', projection: 'string', from_date: 'string', to_date: 'string', limit: integer, skip: integer)
puts responseResponses
[ { "result": {} }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}GetAiAgentDetails
Section titled “GetAiAgentDetails”GET AI Agent Details
Method GET
Route /saas-security/entities/ai-agent-details/v3
Scope SaaS Security (Falcon Shield): READ
PEP 8
get_ai_agent_detailsParameters
Section titled “Parameters”id query · string
Agent item ID in format: ‘agent_id|||integration_id’ (id)
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_ai_agent_details(id=id_list)print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.GetAiAgentDetails(id=id_list)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("GetAiAgentDetails", id="string")print(response)Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Responses
[ { "access": "string", "account_id": "string", "agent_id": "string", "agent_type": "string", "ai_model": "string", "creation_date": "string", "creativity": "string", "description": "string", "instructions": "string", "integration_alias": "string", "integration_id": "string", "integration_name": "string", "interaction_channels": "string", "item_id": "string", "knowledge": [], "name": "string", "owner_email": "string", "tools": [], "topics": [] }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}GetAiAgentsInventory
Section titled “GetAiAgentsInventory”GET AI Agents Inventory
Method GET
Route /saas-security/entities/ai-agents/v3
Scope SaaS Security (Falcon Shield): READ
PEP 8
get_ai_agents_inventoryParameters
Section titled “Parameters”name query · string
Agent name (partial match)
limit query · integer
The maximum number of objects to return
offset query · integer
The starting index of the results
integration_id query · string
Comma separated list of integration IDs
access query · string
Filter by access value (exact match)
agent_owner query · string
Filter by agent owner email (partial match)
tool_type query · string
Filter by a single tool type contained in the agent’s tool types
knowledge_source query · string
Filter by a single knowledge source contained in the agent’s knowledge sources
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.get_ai_agents_inventory(name="string", limit=integer, offset=integer, integration_id="string", access="string", agent_owner="string", tool_type="string", knowledge_source="string")print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.GetAiAgentsInventory(name="string", limit=integer, offset=integer, integration_id="string", access="string", agent_owner="string", tool_type="string", knowledge_source="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("GetAiAgentsInventory", name="string", limit=integer, offset=integer, integration_id="string", access="string", agent_owner="string", tool_type="string", knowledge_source="string")print(response)Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Responses
[ { "access": "string", "account_id": "string", "agent_id": "string", "agent_type": "string", "creation_date": "string", "integration_alias": "string", "integration_id": "string", "integration_name": "string", "interaction_channels": "string", "item_id": "string", "knowledge_source": [], "name": "string", "owner_email": "string", "tool_types": [] }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}GetAlertsV3
Section titled “GetAlertsV3”GET Alert by ID or GET Alerts
Method GET
Route /saas-security/entities/alerts/v3
Scope SaaS Security (Falcon Shield): READ
PEP 8
get_alertsParameters
Section titled “Parameters”id query · string
Alert ID
limit query · integer
The maximum number of objects to return
offset query · integer
The starting index of the results
last_id query · string
The last id of the alert you want to get
type query · string
The type of alert you want to get
Available values (4)
configuration_drift | check_degraded | integration_failure |
threat |
integration_id query · string
Comma separated list of integration ID’s of the alert you want to get
from_date query · string
The start date of the alert you want to get (in YYYY-MM-DD format)
to_date query · string
The end date of the alert you want to get (in YYYY-MM-DD format)
ascending query · boolean
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.get_alerts(id="string", limit=integer, offset=integer, last_id="string", type="string", integration_id="string", from_date="string", to_date="string", ascending=boolean)print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.GetAlertsV3(id="string", limit=integer, offset=integer, last_id="string", type="string", integration_id="string", from_date="string", to_date="string", ascending=boolean)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("GetAlertsV3", id="string", limit=integer, offset=integer, last_id="string", type="string", integration_id="string", from_date="string", to_date="string", ascending=boolean)print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/saas_security" "github.com/go-openapi/strfmt")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
iD := "string" limit := int64(0) offset := int64(0) lastID := "string" typeVar := "string" integrationID := "string" body := strfmt.DateTime{} body2 := strfmt.DateTime{} ascending := boolean
response, err := client.SaasSecurity.GetAlertsV3( &saas_security.GetAlertsV3Params{ ID: &iD, Limit: &limit, Offset: &offset, LastID: &lastID, Type: &typeVar, IntegrationID: &integrationID, FromDate: &body, ToDate: &body2, Ascending: &ascending, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: "us-1", clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.saasSecurity.getAlertsV3( "string", // id integer, // limit integer, // offset "string", // lastId "configuration_drift", // type "string", // integrationId new Date(), // fromDate new Date(), // toDate boolean // ascending);
console.log(response);use rusty_falcon::apis::saas_security_api::get_alerts_v3;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = get_alerts_v3( &falcon.cfg, // configuration Some("string"), // id Some(integer), // limit Some(integer), // offset Some("string"), // last_id Some("string"), // type Some("string"), // integration_id Some("string".to_string()), // from_date Some("string".to_string()), // to_date Some(boolean), // ascending ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SaasSecurity.new
response = api.get_alerts_v3(id: 'string', limit: integer, offset: integer, last_id: 'string', type: 'string', integration_id: 'string', from_date: 'string', to_date: 'string', ascending: boolean)
puts responseResponses
[ { "account_id": "string", "affected_diff": [], "alert_type": "string", "description": "string", "id": "string", "integration": {}, "is_archived": false, "new_affected_count": 0, "security_check_api_link": "string", "source": "string", "source_id": "string", "threat_api_link": "string", "timestamp": "string", "user_who_archived": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}GetAppInventory
Section titled “GetAppInventory”GET Applications Inventory
Method GET
Route /saas-security/entities/apps/v3
Scope SaaS Security (Falcon Shield): READ
PEP 8
get_application_inventoryParameters
Section titled “Parameters”type query · string
Comma separated list of app types
limit query · integer
The maximum number of objects to return
offset query · integer
The starting index of the results
status query · string
Comma separated list of application statuses (approved, in review, rejected, unclassified)
Available values (4)
approved | in review | rejected |
unclassified |
access_level query · string
Comma separated list of access levels
scopes query · string
Comma separated list of scopes
users query · string
Users. Format: ‘is equal value’ or ‘contains value’ or ‘value’ (implies ‘is equal value’)
groups query · string
Comma separated list of groups
last_activity query · string
Last activity was within or was not within the last ‘value’ days. Format: ‘was value’ or ‘was not value’ or ‘value’ (implies ‘was value’). ‘value’ is an integer
integration_id query · string
Comma separated list of integration IDs
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.get_application_inventory(type="string", limit=integer, offset=integer, status="string", access_level="string", scopes="string", users="string", groups="string", last_activity="string", integration_id="string")print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.GetAppInventory(type="string", limit=integer, offset=integer, status="string", access_level="string", scopes="string", users="string", groups="string", last_activity="string", integration_id="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("GetAppInventory", type="string", limit=integer, offset=integer, status="string", access_level="string", scopes="string", users="string", groups="string", last_activity="string", integration_id="string")print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/saas_security")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
typeVar := "string" limit := int64(0) offset := int64(0) status := "string" accessLevel := "string" scopes := "string" users := "string" groups := "string" lastActivity := "string" integrationID := "string"
response, err := client.SaasSecurity.GetAppInventory( &saas_security.GetAppInventoryParams{ Type: &typeVar, Limit: &limit, Offset: &offset, Status: &status, AccessLevel: &accessLevel, Scopes: &scopes, Users: &users, Groups: &groups, LastActivity: &lastActivity, IntegrationID: &integrationID, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: "us-1", clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.saasSecurity.getAppInventory( "string", // type integer, // limit integer, // offset "approved", // status "string", // accessLevel "string", // scopes "string", // users "string", // groups "string", // lastActivity "string" // integrationId);
console.log(response);Examples coming soon.
require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SaasSecurity.new
response = api.get_app_inventory(type: 'string', limit: integer, offset: integer, status: 'string', access_level: 'string', scopes: 'string', users: 'string', groups: 'string', last_activity: 'string', integration_id: 'string')
puts responseResponses
[ { "access_level": "string", "account_id": "string", "app_id": "string", "app_name": "string", "app_type": "string", "created": "string", "integration_alias": "string", "integration_id": "string", "integration_name": "string", "item_id": "string", "last_activity": "string", "scopes": [], "status": "string", "status_expiration_date": "string", "status_reason": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}GetAppInventoryUsers
Section titled “GetAppInventoryUsers”GET Application Users
Method GET
Route /saas-security/entities/app-users/v3
Scope SaaS Security (Falcon Shield): READ
PEP 8
get_application_usersParameters
Section titled “Parameters”item_id query · string
Item ID in format: ‘integration_id|||app_id’ (item_id)
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.get_application_users(item_id="string")print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.GetAppInventoryUsers(item_id="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("GetAppInventoryUsers", item_id="string")print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/saas_security")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
response, err := client.SaasSecurity.GetAppInventoryUsers( &saas_security.GetAppInventoryUsersParams{ ItemID: "string", Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: "us-1", clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.saasSecurity.getAppInventoryUsers("string"); // itemId
console.log(response);Examples coming soon.
require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SaasSecurity.new
response = api.get_app_inventory_users('string')
puts responseResponses
[ { "account_id": "string", "item_id": "string", "users": [] }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}GetAppJournalV3
Section titled “GetAppJournalV3”GET App Journal
Method GET
Route /saas-security/entities/app-journal/v3
Scope SaaS Security (Falcon Shield): READ
PEP 8
get_app_journalParameters
Section titled “Parameters”id query · string
App item identity (app_item_id, format ‘app_id|||integration_id’)
limit query · integer
The maximum number of objects to return
offset query · integer
The starting index of the results
author query · string
Filter by entry author: a full or partial creator name, a creator email address, or an API client id
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.get_app_journal(id="string", limit=integer, offset=integer, author="string")print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.GetAppJournalV3(id="string", limit=integer, offset=integer, author="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("GetAppJournalV3", id="string", limit=integer, offset=integer, author="string")print(response)Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Responses
[ { "author": "string", "comments": [], "note": "string", "timestamp": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}GetAssetInventoryV3
Section titled “GetAssetInventoryV3”GET Data Inventory
Method GET
Route /saas-security/entities/data/v3
Scope SaaS Security (Falcon Shield): READ
PEP 8
get_asset_inventoryParameters
Section titled “Parameters”integration_id query · string
Comma separated list of integration IDs
limit query · integer
The maximum number of objects to return
offset query · integer
The starting index of the results
resource_type query · string
Comma separated list of resource types
access_level query · string
Comma separated list of access levels
last_accessed query · string
Last accessed date was within or was not within the last ‘value’ days. Format: ‘was value’ or ‘was not value’ or ‘value’ (implies ‘was value’). ‘value’ is an integer
last_modified query · string
Last modified date was within or was not within the last ‘value’ days. Format: ‘was value’ or ‘was not value’ or ‘value’ (implies ‘was value’). ‘value’ is an integer
resource_name query · string
Resource name contains ‘value’ (case insensitive)
password_protected query · boolean
Password protected
resource_owner query · string
Resource owner contains ‘value’ (case insensitive)
resource_owner_enabled query · boolean
Resource owner enabled
unmanaged_domain query · string
Comma separated list of unmanaged domains
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.get_asset_inventory(integration_id="string", limit=integer, offset=integer, resource_type="string", access_level="string", last_accessed="string", last_modified="string", resource_name="string", password_protected=boolean, resource_owner="string", resource_owner_enabled=boolean, unmanaged_domain="string")print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.GetAssetInventoryV3(integration_id="string", limit=integer, offset=integer, resource_type="string", access_level="string", last_accessed="string", last_modified="string", resource_name="string", password_protected=boolean, resource_owner="string", resource_owner_enabled=boolean, unmanaged_domain="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("GetAssetInventoryV3", integration_id="string", limit=integer, offset=integer, resource_type="string", access_level="string", last_accessed="string", last_modified="string", resource_name="string", password_protected=boolean, resource_owner="string", resource_owner_enabled=boolean, unmanaged_domain="string")print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/saas_security")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
integrationID := "string" limit := int64(0) offset := int64(0) resourceType := "string" accessLevel := "string" lastAccessed := "string" lastModified := "string" resourceName := "string" passwordProtected := boolean resourceOwner := "string" resourceOwnerEnabled := boolean unmanagedDomain := "string"
response, err := client.SaasSecurity.GetAssetInventoryV3( &saas_security.GetAssetInventoryV3Params{ IntegrationID: &integrationID, Limit: &limit, Offset: &offset, ResourceType: &resourceType, AccessLevel: &accessLevel, LastAccessed: &lastAccessed, LastModified: &lastModified, ResourceName: &resourceName, PasswordProtected: &passwordProtected, ResourceOwner: &resourceOwner, ResourceOwnerEnabled: &resourceOwnerEnabled, UnmanagedDomain: &unmanagedDomain, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: "us-1", clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.saasSecurity.getAssetInventoryV3( "string", // integrationId integer, // limit integer, // offset "string", // resourceType "string", // accessLevel "string", // lastAccessed "string", // lastModified "string", // resourceName boolean, // passwordProtected "string", // resourceOwner boolean, // resourceOwnerEnabled "string" // unmanagedDomain);
console.log(response);Examples coming soon.
require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SaasSecurity.new
response = api.get_asset_inventory_v3(integration_id: 'string', limit: integer, offset: integer, resource_type: 'string', access_level: 'string', last_accessed: 'string', last_modified: 'string', resource_name: 'string', password_protected: boolean, resource_owner: 'string', resource_owner_enabled: boolean, unmanaged_domain: 'string')
puts responseResponses
[ { "access_level": "string", "account_id": "string", "created": "string", "drive": "string", "drive_id": "string", "integration_alias": "string", "integration_id": "string", "integration_name": "string", "last_accessed": "string", "last_modified": "string", "parent": "string", "password_protected": false, "permission_id": "string", "resource_id": "string", "resource_name": "string", "resource_owner": "string", "resource_owner_department": "string", "resource_owner_enabled": false, "resource_type": "string", "shared_with": [] }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}GetCheckJournalV3
Section titled “GetCheckJournalV3”GET Security Check Journal
Method GET
Route /saas-security/entities/check-journal/v3
Scope SaaS Security (Falcon Shield): READ
PEP 8
get_check_journalParameters
Section titled “Parameters”id query · string
Security Check ID
limit query · integer
The maximum number of objects to return
offset query · integer
The starting index of the results
author query · string
Filter by entry author: a full or partial creator name, a creator email address, or an API client id
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.get_check_journal(id="string", limit=integer, offset=integer, author="string")print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.GetCheckJournalV3(id="string", limit=integer, offset=integer, author="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("GetCheckJournalV3", id="string", limit=integer, offset=integer, author="string")print(response)Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Responses
[ { "author": "string", "comments": [], "note": "string", "timestamp": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}GetCheckParamsV3
Section titled “GetCheckParamsV3”GET List Security Check Params
Method GET
Route /saas-security/entities/check-params/v3
Scope SaaS Security (Falcon Shield): READ
PEP 8
get_check_paramsParameters
Section titled “Parameters”id query · string
Security Check ID
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_check_params(id=id_list)print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.GetCheckParamsV3(id=id_list)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("GetCheckParamsV3", id="string")print(response)Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Responses
[ { "edited": false, "param_name": "string", "param_selection_options": [], "param_selection_type": "string", "param_type": "string", "value": {} }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}GetCheckTagsV3
Section titled “GetCheckTagsV3”GET List Check Tags
Method GET
Route /saas-security/entities/check-tags/v3
Scope SaaS Security (Falcon Shield): READ
PEP 8
get_check_tagsCode Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.get_check_tags()print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.GetCheckTagsV3()print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("GetCheckTagsV3")print(response)Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Responses
[ { "account_id": "string", "color": "string", "id": "string", "name": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}GetDeviceInventoryV3
Section titled “GetDeviceInventoryV3”GET Device Inventory
Method GET
Route /saas-security/entities/devices/v3
Scope SaaS Security (Falcon Shield): READ
PEP 8
get_device_inventoryParameters
Section titled “Parameters”integration_id query · string
Comma separated integration ID’s
limit query · integer
The maximum number of objects to return
offset query · integer
The starting index of the results
email query · string
Email
privileged_only query · boolean
Privileged Only
unassociated_devices query · boolean
Unassociated Devices
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.get_device_inventory(integration_id="string", limit=integer, offset=integer, email="string", privileged_only=boolean, unassociated_devices=boolean)print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.GetDeviceInventoryV3(integration_id="string", limit=integer, offset=integer, email="string", privileged_only=boolean, unassociated_devices=boolean)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("GetDeviceInventoryV3", integration_id="string", limit=integer, offset=integer, email="string", privileged_only=boolean, unassociated_devices=boolean)print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/saas_security")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
integrationID := "string" limit := int64(0) offset := int64(0) email := "string" privilegedOnly := boolean unassociatedDevices := boolean
response, err := client.SaasSecurity.GetDeviceInventoryV3( &saas_security.GetDeviceInventoryV3Params{ IntegrationID: &integrationID, Limit: &limit, Offset: &offset, Email: &email, PrivilegedOnly: &privilegedOnly, UnassociatedDevices: &unassociatedDevices, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: "us-1", clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.saasSecurity.getDeviceInventoryV3( "string", // integrationId integer, // limit integer, // offset "string", // email boolean, // privilegedOnly boolean // unassociatedDevices);
console.log(response);use rusty_falcon::apis::saas_security_api::get_device_inventory_v3;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = get_device_inventory_v3( &falcon.cfg, // configuration Some("string"), // integration_id Some(integer), // limit Some(integer), // offset Some("string"), // email Some(boolean), // privileged_only Some(boolean), // unassociated_devices ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SaasSecurity.new
response = api.get_device_inventory_v3(integration_id: 'string', limit: integer, offset: integer, email: 'string', privileged_only: boolean, unassociated_devices: boolean)
puts responseResponses
[ { "account_id": "string", "apps_count": 0, "device_name": "string", "globally_compliant": "string", "globally_managed": "string", "has_user_association": false, "id": "string", "last_seen": "string", "mac_address_list": [], "os": "string", "os_version": "string", "platform": "string", "privileged_roles_count": 0, "reported_apps": [], "reporters": [], "user_email": "string", "user_exists": false }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}GetIntegrationsV3
Section titled “GetIntegrationsV3”GET Integrations
Method GET
Route /saas-security/entities/integrations/v3
Scope SaaS Security (Falcon Shield): READ
PEP 8
get_integrationsParameters
Section titled “Parameters”saas_id query · string
Comma separated SaaS ID’s
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.get_integrations(saas_id="string")print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.GetIntegrationsV3(saas_id="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("GetIntegrationsV3", saas_id="string")print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/saas_security")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
saasID := "string"
response, err := client.SaasSecurity.GetIntegrationsV3( &saas_security.GetIntegrationsV3Params{ SaasID: &saasID, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: "us-1", clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.saasSecurity.getIntegrationsV3("string"); // saasId
console.log(response);use rusty_falcon::apis::saas_security_api::get_integrations_v3;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = get_integrations_v3( &falcon.cfg, // configuration Some("string"), // saas_id ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SaasSecurity.new
response = api.get_integrations_v3(saas_id: 'string')
puts responseResponses
[ { "account_id": "string", "alias": "string", "created_time": "string", "enabled": false, "id": "string", "integration_status": "string", "issues": [], "last_run": "string", "saas_id": "string", "saas_name": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}GetMetricsV3
Section titled “GetMetricsV3”GET Metrics
Method GET
Route /saas-security/aggregates/check-metrics/v3
Scope SaaS Security (Falcon Shield): READ
PEP 8
get_metricsParameters
Section titled “Parameters”status query · string
Exposure status
Available values (8)
Can’t Run | Dismissed | Failed |
Passed | Pending | Stale |
NA | Not Available |
limit query · integer
The maximum number of objects to return
offset query · integer
The starting index of the results
integration_id query · string
Comma separated list of integration IDs
impact query · string
Impact
Available values (3)
1 | 2 | 3 |
compliance query · boolean
Compliance
check_type query · string
Check Type
Available values (8)
apps | devices | users |
assets | permissions | shadow_vendors |
Falcon Shield Security Check | custom |
check_tags query · string
Comma separated list of check tags names or ids
business_owner query · string
Business owner email of the integration the check belongs to
org_domain query · string
Org domain of the integration the check belongs to
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.get_metrics(status="string", limit=integer, offset=integer, integration_id="string", impact="string", compliance=boolean, check_type="string", check_tags="string", business_owner="string", org_domain="string")print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.GetMetricsV3(status="string", limit=integer, offset=integer, integration_id="string", impact="string", compliance=boolean, check_type="string", check_tags="string", business_owner="string", org_domain="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("GetMetricsV3", status="string", limit=integer, offset=integer, integration_id="string", impact="string", compliance=boolean, check_type="string", check_tags="string", business_owner="string", org_domain="string")print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/saas_security")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
status := "string" limit := int64(0) offset := int64(0) integrationID := "string" impact := "string" compliance := boolean checkType := "string"
response, err := client.SaasSecurity.GetMetricsV3( &saas_security.GetMetricsV3Params{ Status: &status, Limit: &limit, Offset: &offset, IntegrationID: &integrationID, Impact: &impact, Compliance: &compliance, CheckType: &checkType, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: "us-1", clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.saasSecurity.getMetricsV3( "Passed", // status integer, // limit integer, // offset "string", // integrationId "1", // impact boolean, // compliance "apps" // checkType);
console.log(response);use rusty_falcon::apis::saas_security_api::get_metrics_v3;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = get_metrics_v3( &falcon.cfg, // configuration Some("string"), // status Some(integer), // limit Some(integer), // offset Some("string"), // integration_id Some("string"), // impact Some(boolean), // compliance Some("string"), // check_type ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SaasSecurity.new
response = api.get_metrics_v3(status: 'string', limit: integer, offset: integer, integration_id: 'string', impact: 'string', compliance: boolean, check_type: 'string')
puts responseResponses
[ { "account_id": "string", "integrations_count": 0, "security_domain_count": 0, "status_breakdown": {}, "total_score_percentage": 0, "total_security_checks_count": 0 }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}GetSecurityCheckAffectedV3
Section titled “GetSecurityCheckAffectedV3”GET Security Check Affected
Method GET
Route /saas-security/entities/check-affected/v3
Scope SaaS Security (Falcon Shield): READ
PEP 8
get_security_checkParameters
Section titled “Parameters”id query · string
Security Check ID
limit query · integer
The maximum number of objects to return
offset query · integer
The starting index of the results
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.get_security_check(id="string", limit=integer, offset=integer)print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.GetSecurityCheckAffectedV3(id="string", limit=integer, offset=integer)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("GetSecurityCheckAffectedV3", id="string", limit=integer, offset=integer)print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/saas_security")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
limit := int64(0) offset := int64(0)
response, err := client.SaasSecurity.GetSecurityCheckAffectedV3( &saas_security.GetSecurityCheckAffectedV3Params{ ID: "string", Limit: &limit, Offset: &offset, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: "us-1", clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.saasSecurity.getSecurityCheckAffectedV3( "string", // id integer, // limit integer // offset);
console.log(response);use rusty_falcon::apis::saas_security_api::get_security_check_affected_v3;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = get_security_check_affected_v3( &falcon.cfg, // configuration "string", // id Some(integer), // limit Some(integer), // offset ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SaasSecurity.new
response = api.get_security_check_affected_v3('string')
puts responseResponses
[ { "account_id": "string", "dismiss_expiration_date": "string", "dismissed": false, "dismissed_reason": "string", "entity_name": "string", "extra_context": [], "has_usage": false, "type": "string", "usage": {} }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}GetSecurityCheckComplianceV3
Section titled “GetSecurityCheckComplianceV3”GET Compliance
Method GET
Route /saas-security/entities/compliance/v3
Scope SaaS Security (Falcon Shield): READ
PEP 8
get_security_check_complianceParameters
Section titled “Parameters”id query · string
Security Check ID
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.get_security_check_compliance(id="string")print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.GetSecurityCheckComplianceV3(id="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("GetSecurityCheckComplianceV3", id="string")print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/saas_security")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
response, err := client.SaasSecurity.GetSecurityCheckComplianceV3( &saas_security.GetSecurityCheckComplianceV3Params{ ID: "string", Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: "us-1", clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.saasSecurity.getSecurityCheckComplianceV3("string"); // id
console.log(response);use rusty_falcon::apis::saas_security_api::get_security_check_compliance_v3;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = get_security_check_compliance_v3( &falcon.cfg, // configuration "string", // id ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SaasSecurity.new
response = api.get_security_check_compliance_v3('string')
puts responseResponses
[ { "criteria": [], "exposure_id": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}GetSecurityChecksV3
Section titled “GetSecurityChecksV3”GET Security Check by ID or GET List Security Checks
Method GET
Route /saas-security/entities/checks/v3
Scope SaaS Security (Falcon Shield): READ
PEP 8
get_security_checksParameters
Section titled “Parameters”id query · string
Security Check ID
limit query · integer
The maximum number of objects to return
offset query · integer
The starting index of the results
status query · string
Exposure status
Available values (8)
Can’t Run | Dismissed | Failed |
Passed | Pending | Stale |
NA | Not Available |
integration_id query · string
Comma separated list of integration IDs
impact query · string
Impact
Available values (3)
Low | Medium | High |
compliance query · boolean
Compliance
check_type query · string
Check Type
Available values (8)
apps | devices | users |
assets | permissions | shadow_vendors |
Falcon Shield Security Check | custom |
check_tags query · string
Comma separated list of check tags names or ids
business_owner query · string
Business owner email of the integration the check belongs to
org_domain query · string
Org domain of the integration the check belongs to
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.get_security_checks(id="string", limit=integer, offset=integer, status="string", integration_id="string", impact="string", compliance=boolean, check_type="string", check_tags="string", business_owner="string", org_domain="string")print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.GetSecurityChecksV3(id="string", limit=integer, offset=integer, status="string", integration_id="string", impact="string", compliance=boolean, check_type="string", check_tags="string", business_owner="string", org_domain="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("GetSecurityChecksV3", id="string", limit=integer, offset=integer, status="string", integration_id="string", impact="string", compliance=boolean, check_type="string", check_tags="string", business_owner="string", org_domain="string")print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/saas_security")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
iD := "string" limit := int64(0) offset := int64(0) status := "string" integrationID := "string" impact := "string" compliance := boolean checkType := "string" checkTags := "string"
response, err := client.SaasSecurity.GetSecurityChecksV3( &saas_security.GetSecurityChecksV3Params{ ID: &iD, Limit: &limit, Offset: &offset, Status: &status, IntegrationID: &integrationID, Impact: &impact, Compliance: &compliance, CheckType: &checkType, CheckTags: &checkTags, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: "us-1", clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.saasSecurity.getSecurityChecksV3( "string", // id integer, // limit integer, // offset "Passed", // status "string", // integrationId "Low", // impact boolean, // compliance "apps", // checkType "string" // checkTags);
console.log(response);use rusty_falcon::apis::saas_security_api::get_security_checks_v3;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = get_security_checks_v3( &falcon.cfg, // configuration Some("string"), // id Some(integer), // limit Some(integer), // offset Some("string"), // status Some("string"), // integration_id Some("string"), // impact Some(boolean), // compliance Some("string"), // check_type ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SaasSecurity.new
response = api.get_security_checks_v3(id: 'string', limit: integer, offset: integer, status: 'string', integration_id: 'string', impact: 'string', compliance: boolean, check_type: 'string', check_tags: 'string')
puts responseResponses
[ { "account_id": "string", "affected": 0, "affected_impact_percentage": 0, "affected_impact_total": 0, "affected_impact_type": "string", "base_check_id": "string", "business_owners": [], "check_tags": [], "compliance_data": [], "created_by": "string", "creation_date": "string", "details": "string", "dismiss_expiration_date": "string", "dismiss_reason": "string", "id": "string", "impact": "string", "integration_alias": "string", "integration_id": "string", "is_global": false, "name": "string", "org_domains": [], "remediation_plan": "string", "saas_name": "string", "security_check_type": "string", "security_domain": "string", "status": "string", "status_last_changed_date": "string", "status_reason": "string", "user_who_dismissed": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}GetSupportedSaasV3
Section titled “GetSupportedSaasV3”GET Supported SaaS
Method GET
Route /saas-security/entities/supported-saas/v3
Scope SaaS Security (Falcon Shield): READ
PEP 8
get_supported_saasCode Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.get_supported_saas()print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.GetSupportedSaasV3()print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("GetSupportedSaasV3")print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/saas_security")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
response, err := client.SaasSecurity.GetSupportedSaasV3( &saas_security.GetSupportedSaasV3Params{ Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: "us-1", clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.saasSecurity.getSupportedSaasV3();
console.log(response);use rusty_falcon::apis::saas_security_api::get_supported_saas_v3;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = get_supported_saas_v3(&falcon.cfg).await.expect("API call failed"); // configuration
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SaasSecurity.new
response = api.get_supported_saas_v3
puts responseResponses
[ { "account_id": "string", "id": "string", "name": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}GetSystemLogsV3
Section titled “GetSystemLogsV3”GET System Logs
Method GET
Route /saas-security/entities/system-logs/v3
Scope SaaS Security (Falcon Shield): READ
PEP 8
get_system_logsParameters
Section titled “Parameters”from_date query · string
From Date (in YYYY-MM-DD format)
limit query · integer
The maximum number of objects to return
offset query · integer
The starting index of the results
to_date query · string
To Date (in YYYY-MM-DD format)
total_count query · boolean
Fetch Total Count?
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.get_system_logs(from_date="string", limit=integer, offset=integer, to_date="string", total_count=boolean)print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.GetSystemLogsV3(from_date="string", limit=integer, offset=integer, to_date="string", total_count=boolean)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("GetSystemLogsV3", from_date="string", limit=integer, offset=integer, to_date="string", total_count=boolean)print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/saas_security" "github.com/go-openapi/strfmt")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
body := strfmt.DateTime{} limit := int64(0) offset := int64(0) body2 := strfmt.DateTime{} totalCount := boolean
response, err := client.SaasSecurity.GetSystemLogsV3( &saas_security.GetSystemLogsV3Params{ FromDate: &body, Limit: &limit, Offset: &offset, ToDate: &body2, TotalCount: &totalCount, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: "us-1", clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.saasSecurity.getSystemLogsV3( new Date(), // fromDate integer, // limit integer, // offset new Date(), // toDate boolean // totalCount);
console.log(response);use rusty_falcon::apis::saas_security_api::get_system_logs_v3;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = get_system_logs_v3( &falcon.cfg, // configuration Some("string".to_string()), // from_date Some(integer), // limit Some(integer), // offset Some("string".to_string()), // to_date Some(boolean), // total_count ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SaasSecurity.new
response = api.get_system_logs_v3(from_date: 'string', limit: integer, offset: integer, to_date: 'string', total_count: boolean)
puts responseResponses
[ { "account_id": "string", "action": "string", "event_time": "string", "id": "string", "integration_alias": "string", "integration_id": "string", "method": "string", "saas_name": "string", "source_ip": "string", "status": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}GetSystemUsersV3
Section titled “GetSystemUsersV3”GET System Users
Method GET
Route /saas-security/entities/system-users/v3
Scope SaaS Security (Falcon Shield): READ
PEP 8
get_system_usersCode Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.get_system_users()print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.GetSystemUsersV3()print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("GetSystemUsersV3")print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/saas_security")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
response, err := client.SaasSecurity.GetSystemUsersV3( &saas_security.GetSystemUsersV3Params{ Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: "us-1", clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.saasSecurity.getSystemUsersV3();
console.log(response);use rusty_falcon::apis::saas_security_api::get_system_users_v3;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = get_system_users_v3(&falcon.cfg).await.expect("API call failed"); // configuration
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SaasSecurity.new
response = api.get_system_users_v3
puts responseResponses
[ { "account_id": "string", "bypass_sso": false, "create_date": "string", "email": "string", "enabled": false, "first_name": "string", "id": "string", "last_login": "string", "last_name": "string", "locked_out": false, "mfa_enabled": false, "role": "string", "scoped_integration_ids": [] }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}GetUserInventoryV3
Section titled “GetUserInventoryV3”GET User Inventory
Method GET
Route /saas-security/entities/users/v3
Scope SaaS Security (Falcon Shield): READ
PEP 8
get_user_inventoryParameters
Section titled “Parameters”integration_id query · string
Comma separated integration ID’s
limit query · integer
The maximum number of objects to return
offset query · integer
The starting index of the results
email query · string
Email
privileged_only query · boolean
Privileged Only
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.get_user_inventory(integration_id="string", limit=integer, offset=integer, email="string", privileged_only=boolean)print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.GetUserInventoryV3(integration_id="string", limit=integer, offset=integer, email="string", privileged_only=boolean)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("GetUserInventoryV3", integration_id="string", limit=integer, offset=integer, email="string", privileged_only=boolean)print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/saas_security")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
integrationID := "string" limit := int64(0) offset := int64(0) email := "string" privilegedOnly := boolean
response, err := client.SaasSecurity.GetUserInventoryV3( &saas_security.GetUserInventoryV3Params{ IntegrationID: &integrationID, Limit: &limit, Offset: &offset, Email: &email, PrivilegedOnly: &privilegedOnly, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: "us-1", clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.saasSecurity.getUserInventoryV3( "string", // integrationId integer, // limit integer, // offset "string", // email boolean // privilegedOnly);
console.log(response);use rusty_falcon::apis::saas_security_api::get_user_inventory_v3;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = get_user_inventory_v3( &falcon.cfg, // configuration Some("string"), // integration_id Some(integer), // limit Some(integer), // offset Some("string"), // email Some(boolean), // privileged_only ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SaasSecurity.new
response = api.get_user_inventory_v3(integration_id: 'string', limit: integer, offset: integer, email: 'string', privileged_only: boolean)
puts responseResponses
[ { "account_id": "string", "company": "string", "country": "string", "department": "string", "domain": "string", "email": "string", "enabled": false, "exposures": [], "exposures_total": 0, "full_name": "string", "integrations": [], "integrations_total": 0, "item_id": "string", "login_names": [], "roles": 0, "title": "string", "user_item_identity": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}GetUserJournalV3
Section titled “GetUserJournalV3”GET User Journal
Method GET
Route /saas-security/entities/user-journal/v3
Scope SaaS Security (Falcon Shield): READ
PEP 8
get_user_journalParameters
Section titled “Parameters”id query · string
User item identity (email / login name)
limit query · integer
The maximum number of objects to return
offset query · integer
The starting index of the results
author query · string
Filter by entry author: a full or partial creator name, a creator email address, or an API client id
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.get_user_journal(id="string", limit=integer, offset=integer, author="string")print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.GetUserJournalV3(id="string", limit=integer, offset=integer, author="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("GetUserJournalV3", id="string", limit=integer, offset=integer, author="string")print(response)Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Responses
[ { "author": "string", "comments": [], "note": "string", "timestamp": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}IntegrationBuilderEndTransactionV3
Section titled “IntegrationBuilderEndTransactionV3”POST Data Upload Transaction Completion
Method POST
Route /saas-security/entities/custom-integration-close/v3
Scope SaaS Security (Falcon Shield): WRITE
PEP 8
complete_integration_uploadParameters
Section titled “Parameters”id query · string
Integration ID
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.complete_integration_upload(id="string")print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.IntegrationBuilderEndTransactionV3(id="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("IntegrationBuilderEndTransactionV3", id="string")print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/saas_security")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
response, err := client.SaasSecurity.IntegrationBuilderEndTransactionV3( &saas_security.IntegrationBuilderEndTransactionV3Params{ ID: "string", Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: "us-1", clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.saasSecurity.integrationBuilderEndTransactionV3("string"); // id
console.log(response);use rusty_falcon::apis::saas_security_api::integration_builder_end_transaction_v3;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = integration_builder_end_transaction_v3( &falcon.cfg, // configuration "string", // id ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SaasSecurity.new
response = api.integration_builder_end_transaction_v3('string')
puts responseResponses
[ { "account_id": "string", "account_integration_id": "string", "last_update": "string", "sources": [], "status": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}IntegrationBuilderGetStatusV3
Section titled “IntegrationBuilderGetStatusV3”GET Status
Method GET
Route /saas-security/entities/custom-integration-status/v3
Scope SaaS Security (Falcon Shield): READ
PEP 8
get_integration_builder_statusParameters
Section titled “Parameters”id query · string
Integration ID
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.get_integration_builder_status(id="string")print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.IntegrationBuilderGetStatusV3(id="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("IntegrationBuilderGetStatusV3", id="string")print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/saas_security")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
response, err := client.SaasSecurity.IntegrationBuilderGetStatusV3( &saas_security.IntegrationBuilderGetStatusV3Params{ ID: "string", Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: "us-1", clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.saasSecurity.integrationBuilderGetStatusV3("string"); // id
console.log(response);use rusty_falcon::apis::saas_security_api::integration_builder_get_status_v3;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = integration_builder_get_status_v3( &falcon.cfg, // configuration "string", // id ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SaasSecurity.new
response = api.integration_builder_get_status_v3('string')
puts responseResponses
[ { "account_id": "string", "account_integration_id": "string", "last_update": "string", "sources": [], "status": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}IntegrationBuilderResetV3
Section titled “IntegrationBuilderResetV3”Reset
Method POST
Route /saas-security/entities/custom-integration-reset/v3
Scope SaaS Security (Falcon Shield): WRITE
PEP 8
reset_integration_builderParameters
Section titled “Parameters”id query · string
Integration ID
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.reset_integration_builder(id="string")print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.IntegrationBuilderResetV3(id="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("IntegrationBuilderResetV3", id="string")print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/saas_security")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
response, err := client.SaasSecurity.IntegrationBuilderResetV3( &saas_security.IntegrationBuilderResetV3Params{ ID: "string", Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: "us-1", clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.saasSecurity.integrationBuilderResetV3("string"); // id
console.log(response);use rusty_falcon::apis::saas_security_api::integration_builder_reset_v3;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = integration_builder_reset_v3( &falcon.cfg, // configuration "string", // id ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SaasSecurity.new
response = api.integration_builder_reset_v3('string')
puts responseResponses
[ { "account_id": "string", "account_integration_id": "string", "last_update": "string", "sources": [], "status": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}IntegrationBuilderUploadV3
Section titled “IntegrationBuilderUploadV3”POST Upload
Method POST
Route /saas-security/entities/custom-integration-upload/v3
Scope SaaS Security (Falcon Shield): WRITE
PEP 8
upload_integration_builderParameters
Section titled “Parameters”body body · dictionary
Full body payload as JSON formatted dictionary.
data body · string
id query · string
Integration ID
source_id query · string
Source ID
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.upload_integration_builder(data="string", id="string", source_id="string")print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.IntegrationBuilderUploadV3(data="string", id="string", source_id="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
body_payload = { "data": "string"}
response = falcon.command("IntegrationBuilderUploadV3", id="string", source_id="string", body=body_payload)print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/saas_security" "github.com/crowdstrike/gofalcon/falcon/models")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
data := "string"
response, err := client.SaasSecurity.IntegrationBuilderUploadV3( &saas_security.IntegrationBuilderUploadV3Params{ Body: &models.UploadDataRequest{ Data: &data, }, ID: "string", SourceID: "string", Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: "us-1", clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.saasSecurity.integrationBuilderUploadV3( "string", // id "string", // sourceId { // body data: "string" });
console.log(response);use rusty_falcon::apis::saas_security_api::integration_builder_upload_v3;use rusty_falcon::easy::client::FalconHandle;use rusty_falcon::models::UploadDataRequest;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let body = UploadDataRequest { data: "string".to_string(), ..Default::default() };
let response = integration_builder_upload_v3( &falcon.cfg, // configuration "string", // id "string", // source_id body, // body ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SaasSecurity.new
body = Falcon::UploadDataRequest.new( data: 'string')
response = api.integration_builder_upload_v3('string', 'string', body)
puts responseResponses
[ { "account_id": "string", "account_integration_id": "string", "last_update": "string", "sources": [], "status": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}RestoreAffectedEntityV3
Section titled “RestoreAffectedEntityV3”POST Restore Affected Entity
Method POST
Route /saas-security/entities/check-restore-affected/v3
Scope SaaS Security (Falcon Shield): WRITE
PEP 8
restore_affected_entityParameters
Section titled “Parameters”body body · dictionary
Full body payload as JSON formatted dictionary.
entities body · string
Comma separated list of currently dismissed entity names to restore
id query · string
Security Check ID
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.restore_affected_entity(id="string", entities="string")print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.RestoreAffectedEntityV3(id="string", entities="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
body_payload = { "entities": "string"}
response = falcon.command("RestoreAffectedEntityV3", id="string", body=body_payload)print(response)Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Responses
[ "string"]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}RestoreSecurityCheckV3
Section titled “RestoreSecurityCheckV3”POST Restore Security Check by ID
Method POST
Route /saas-security/entities/check-restore/v3
Scope SaaS Security (Falcon Shield): WRITE
PEP 8
restore_security_checkParameters
Section titled “Parameters”body body · dictionary
Full body payload as JSON formatted dictionary.
id query · string
Security Check ID
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.restore_security_check(id="string")print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.RestoreSecurityCheckV3(id="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("RestoreSecurityCheckV3", id="string", body={})print(response)Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Responses
[ "string"]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}SetCheckParamV3
Section titled “SetCheckParamV3”POST Set a Security Check Param
Method POST
Route /saas-security/entities/check-params/v3
Scope SaaS Security (Falcon Shield): WRITE
PEP 8
set_check_paramParameters
Section titled “Parameters”body body · dictionary
Full body payload as JSON formatted dictionary.
all_future_instances body · boolean
Also apply this value to future instances of the same SaaS
param_name body · string
Name of the param to set, as returned by the GET
reason body · string
Why the param was changed. Recorded on the check’s timeline
value body · string
The new value. Must match the param’s param_type, and for a range or enum param must be within its param_selection_options
id query · string
Security Check ID
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.set_check_param(id="string", all_future_instances=boolean, param_name="string", reason="string", value="string")print(response)from falconpy import SaasSecurity
falcon = SaasSecurity(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.SetCheckParamV3(id="string", all_future_instances=boolean, param_name="string", reason="string", value="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
body_payload = { "all_future_instances": boolean, "param_name": "string", "reason": "string", "value": "string"}
response = falcon.command("SetCheckParamV3", id="string", body=body_payload)print(response)Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Examples coming soon.
Responses
[ { "edited": false, "param_name": "string", "param_selection_options": [], "param_selection_type": "string", "param_type": "string", "value": {} }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}