Sensor Update Policy
The Sensor Update Policy service collection provides operations for managing Sensor Update Policies in your CrowdStrike Falcon environment. Reveal and increment uninstall tokens, retrieve available sensor builds and kernel compatibility information, manage policy members, create and update policies with support for uninstall protection, and set policy precedence.
| Language | Last Update |
|---|---|
| Python | v1.6.5 |
| PowerShell | v2.2.9 |
| Go | v0.22.0 |
| TypeScript | v0.6.0 |
| Rust | v0.7.1 |
| Ruby | v1.4.0 |
This service collection has code examples posted to the repository.
Table of Contents
Section titled “Table of Contents”| Operation | Description |
|---|---|
createSensorUpdatePoliciescreate_policies | Create Sensor Update Policies by specifying details about the policy to create |
createSensorUpdatePoliciesV2create_policies_v2 | Create Sensor Update Policies by specifying details about the policy to create with additional support for uninstall protection |
deleteSensorUpdatePoliciesdelete_policies | Delete a set of Sensor Update Policies by specifying their IDs |
getSensorUpdatePoliciesget_policies | Retrieve a set of Sensor Update Policies by specifying their IDs |
getSensorUpdatePoliciesV2get_policies_v2 | Retrieve a set of Sensor Update Policies with additional support for uninstall protection by specifying their IDs |
incrementUninstallTokenincrement_uninstall_token | Increments a bulk maintenance token. |
performSensorUpdatePoliciesActionperform_policies_action | Perform the specified action on the Sensor Update Policies specified in the request |
queryCombinedSensorUpdateBuildsquery_combined_builds | Retrieve available builds for use with Sensor Update Policies |
queryCombinedSensorUpdateKernelsquery_combined_kernels | Retrieve kernel compatibility info for Sensor Update Builds |
queryCombinedSensorUpdatePoliciesquery_combined_policies | Search for Sensor Update Policies in your environment by providing an FQL filter and paging details. |
queryCombinedSensorUpdatePoliciesV2query_combined_policies_v2 | Search for Sensor Update Policies with additional support for uninstall protection in your environment by providing an FQL filter and paging details. |
queryCombinedSensorUpdatePolicyMembersquery_combined_policy_members | Search for members of a Sensor Update Policy in your environment by providing an FQL filter and paging details. |
querySensorUpdateKernelsDistinctquery_kernels | Retrieve kernel compatibility info for Sensor Update Builds |
querySensorUpdatePoliciesquery_policies | Search for Sensor Update Policies in your environment by providing an FQL filter and paging details. |
querySensorUpdatePolicyMembersquery_policy_members | Search for members of a Sensor Update Policy in your environment by providing an FQL filter and paging details. |
revealUninstallTokenreveal_uninstall_token | Reveals an uninstall token for a specific device. |
setSensorUpdatePoliciesPrecedenceset_policies_precedence | Sets the precedence of Sensor Update Policies based on the order of IDs specified in the request. |
updateSensorUpdatePoliciesupdate_policies | Update Sensor Update Policies by specifying the ID of the policy and details to update |
updateSensorUpdatePoliciesV2update_policies_v2 | Update Sensor Update Policies by specifying the ID of the policy and details to update with additional support for uninstall protection |
createSensorUpdatePolicies
Section titled “createSensorUpdatePolicies”Create Sensor Update Policies by specifying details about the policy to create
Method POST
Route /policy/entities/sensor-update/v1
Scope Sensor update policies: WRITE
PEP 8
create_policiesParameters
Section titled “Parameters”body body · dictionary
Full body payload as JSON formatted dictionary.
resources body · array
A collection of policies to create
build body · string
Build policy applies to.
description body · string
Sensor Update Policy description.
name body · string
Sensor Update Policy name.
platform_name body · string
Name of the operating system platform.
settings body · dictionary
Sensor update policy specific settings. OVERRIDES the value of the “build” keyword if provided.
Code Examples
from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
settings = { "build": "string"}
response = falcon.create_policies(build="string", description="string", name="string", platform_name="string", settings=settings)print(response)from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
settings = { "build": "string"}
response = falcon.createSensorUpdatePolicies(build="string", description="string", name="string", platform_name="string", settings=settings)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
body_payload = { "resources": [ { "description": "string", "name": "string", "platform_name": "string", "settings": { "build": "string" } } ]}
response = falcon.command("createSensorUpdatePolicies", body=body_payload)print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/sensor_update_policies" "github.com/crowdstrike/gofalcon/falcon/models")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
description := "string" name := "string" platform_name := "string"
response, err := client.SensorUpdatePolicies.CreateSensorUpdatePolicies( &sensor_update_policies.CreateSensorUpdatePoliciesParams{ Body: &models.SensorUpdateCreatePoliciesReqV1{ Resources: []interface{}{ { Description: &description, Name: &name, PlatformName: &platform_name, Settings: &struct{}{}, }, }, }, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.sensorUpdatePolicies.createSensorUpdatePolicies( { resources: [{ description: "string", name: "string", platformName: "string", settings: { build: "string" } }]} // body);
console.log(response);use rusty_falcon::apis::sensor_update_policies_api::create_sensor_update_policies;use rusty_falcon::easy::client::FalconHandle;use rusty_falcon::models::SensorUpdateCreatePoliciesReqV1;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let body = SensorUpdateCreatePoliciesReqV1 { resources: vec![CreatePolicyReqV1 { name: Some("string".to_string()), platform_name: Some("string".to_string()), ..Default::default() }], ..Default::default() };
let response = create_sensor_update_policies( &falcon.cfg, // configuration body, // body ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SensorUpdatePolicies.new
body = Falcon::SensorUpdateCreatePoliciesReqV1.new( resources: [{ description: 'string', name: 'string', platform_name: 'string', settings: { build: 'string' } }])
response = api.create_sensor_update_policies(body)
puts responseResponses
[ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} } ]}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} } ]}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} } ]}createSensorUpdatePoliciesV2
Section titled “createSensorUpdatePoliciesV2”Create Sensor Update Policies by specifying details about the policy to create with additional support for uninstall protection
Method POST
Route /policy/entities/sensor-update/v2
Scope Sensor update policies: WRITE
PEP 8
create_policies_v2Parameters
Section titled “Parameters”body body · dictionary
Full body payload as JSON formatted dictionary.
resources body · array
A collection of policies to create
build body · string
Build policy applies to.
description body · string
Sensor Update Policy description.
name body · string
Sensor Update Policy name.
platform_name body · string
Name of the operating system platform.
scheduler body · dictionary
Scheduler settings.
settings body · dictionary
Sensor update policy specific settings. OVERRIDES the value of the “build” and “uninstall_protection” keywords if provided.
show_early_adopter_builds body · boolean
Enable early adopter builds.
uninstall_protection body · string
Boolean indicating if uninstall protection should be enabled. Allowed values:
Available values (2)
ENABLED | DISABLED |
variants body · list of dictionaries
List of variants.
Code Examples
from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
scheduler = { "enabled": True, "schedules": [ { "days": [ 0 ], "end": "string", "start": "string" } ], "timezone": "string"}
settings = { "build": "string", "scheduler": { "enabled": True, "schedules": [ { "days": [ 0 ], "end": "string", "start": "string" } ], "timezone": "string" }, "show_early_adopter_builds": True, "uninstall_protection": "ENABLED", "variants": [ { "build": "string", "platform": "string" } ]}
variants = [ { "build": "string", "platform": "string" }]
response = falcon.create_policies_v2(build="string", description="string", name="string", platform_name="string", scheduler=scheduler, settings=settings, show_early_adopter_builds=boolean, uninstall_protection="string", variants=variants)print(response)from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
scheduler = { "enabled": True, "schedules": [ { "days": [ 0 ], "end": "string", "start": "string" } ], "timezone": "string"}
settings = { "build": "string", "scheduler": { "enabled": True, "schedules": [ { "days": [ 0 ], "end": "string", "start": "string" } ], "timezone": "string" }, "show_early_adopter_builds": True, "uninstall_protection": "ENABLED", "variants": [ { "build": "string", "platform": "string" } ]}
variants = [ { "build": "string", "platform": "string" }]
response = falcon.createSensorUpdatePoliciesV2(build="string", description="string", name="string", platform_name="string", scheduler=scheduler, settings=settings, show_early_adopter_builds=boolean, uninstall_protection="string", variants=variants)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
body_payload = { "resources": [ { "description": "string", "name": "string", "platform_name": "string", "settings": { "build": "string", "scheduler": {}, "show_early_adopter_builds": boolean, "uninstall_protection": "string", "variants": ["string"] } } ]}
response = falcon.command("createSensorUpdatePoliciesV2", body=body_payload)print(response)New-FalconSensorUpdatePolicy -Name "string" -PlatformName "string"package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/sensor_update_policies" "github.com/crowdstrike/gofalcon/falcon/models")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
description := "string" name := "string" platform_name := "string"
response, err := client.SensorUpdatePolicies.CreateSensorUpdatePoliciesV2( &sensor_update_policies.CreateSensorUpdatePoliciesV2Params{ Body: &models.SensorUpdateCreatePoliciesReqV2{ Resources: []interface{}{ { Description: &description, Name: &name, PlatformName: &platform_name, Settings: &struct{}{}, }, }, }, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.sensorUpdatePolicies.createSensorUpdatePoliciesV2( { resources: [{ description: "string", name: "string", platformName: "string", settings: { build: "string", scheduler: {}, showEarlyAdopterBuilds: boolean, uninstallProtection: "string", variants: [] } }]} // body);
console.log(response);use rusty_falcon::apis::sensor_update_policies_api::create_sensor_update_policies_v2;use rusty_falcon::easy::client::FalconHandle;use rusty_falcon::models::SensorUpdateCreatePoliciesReqV2;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let body = SensorUpdateCreatePoliciesReqV2 { resources: vec![CreatePolicyReqV2 { name: Some("string".to_string()), platform_name: Some("string".to_string()), ..Default::default() }], ..Default::default() };
let response = create_sensor_update_policies_v2( &falcon.cfg, // configuration body, // body ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SensorUpdatePolicies.new
body = Falcon::SensorUpdateCreatePoliciesReqV2.new( resources: [{ description: 'string', name: 'string', platform_name: 'string', settings: { build: 'string', scheduler: {}, show_early_adopter_builds: boolean, uninstall_protection: 'string', variants: [] } }])
response = api.create_sensor_update_policies_v2(body)
puts responseResponses
[ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} } ]}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} } ]}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} } ]}deleteSensorUpdatePolicies
Section titled “deleteSensorUpdatePolicies”Delete a set of Sensor Update Policies by specifying their IDs
Method DELETE
Route /policy/entities/sensor-update/v1
Scope Sensor update policies: WRITE
PEP 8
delete_policiesParameters
Section titled “Parameters”ids query · string or list of strings
The IDs of the Sensor Update Policies to delete
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.delete_policies(ids=id_list)print(response)from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.deleteSensorUpdatePolicies(ids=id_list)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("deleteSensorUpdatePolicies", ids=id_list)print(response)Remove-FalconSensorUpdatePolicy -Id @("ID1", "ID2")package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/sensor_update_policies")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
response, err := client.SensorUpdatePolicies.DeleteSensorUpdatePolicies( &sensor_update_policies.DeleteSensorUpdatePoliciesParams{ Ids: []string{"ID1", "ID2", "ID3"}, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.sensorUpdatePolicies.deleteSensorUpdatePolicies(["ID1", "ID2", "ID3"]); // ids
console.log(response);use rusty_falcon::apis::sensor_update_policies_api::delete_sensor_update_policies;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = delete_sensor_update_policies( &falcon.cfg, // configuration vec!["string".to_string()], // ids ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SensorUpdatePolicies.new
response = api.delete_sensor_update_policies(['ID1', 'ID2', 'ID3'])
puts responseResponses
[ "string"]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ "string" ]}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ "string" ]}getSensorUpdatePolicies
Section titled “getSensorUpdatePolicies”Retrieve a set of Sensor Update Policies by specifying their IDs
Method GET
Route /policy/entities/sensor-update/v1
Scope Sensor update policies: READ
PEP 8
get_policiesParameters
Section titled “Parameters”ids query · string or list of strings
The IDs of the Sensor Update Policies to return
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_policies(ids=id_list)print(response)from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.getSensorUpdatePolicies(ids=id_list)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("getSensorUpdatePolicies", ids=id_list)print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/sensor_update_policies")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
response, err := client.SensorUpdatePolicies.GetSensorUpdatePolicies( &sensor_update_policies.GetSensorUpdatePoliciesParams{ Ids: []string{"ID1", "ID2", "ID3"}, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.sensorUpdatePolicies.getSensorUpdatePolicies(["ID1", "ID2", "ID3"]); // ids
console.log(response);use rusty_falcon::apis::sensor_update_policies_api::get_sensor_update_policies;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = get_sensor_update_policies( &falcon.cfg, // configuration vec!["string".to_string()], // ids ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SensorUpdatePolicies.new
response = api.get_sensor_update_policies(['ID1', 'ID2', 'ID3'])
puts responseResponses
[ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} } ]}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} } ]}getSensorUpdatePoliciesV2
Section titled “getSensorUpdatePoliciesV2”Retrieve a set of Sensor Update Policies with additional support for uninstall protection by specifying their IDs
Method GET
Route /policy/entities/sensor-update/v2
Scope Sensor update policies: READ
PEP 8
get_policies_v2Parameters
Section titled “Parameters”ids query · string or list of strings
The IDs of the Sensor Update Policies to return
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_policies_v2(ids=id_list)print(response)from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.getSensorUpdatePoliciesV2(ids=id_list)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("getSensorUpdatePoliciesV2", ids=id_list)print(response)Get-FalconSensorUpdatePolicy -Id @("ID1", "ID2")package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/sensor_update_policies")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
response, err := client.SensorUpdatePolicies.GetSensorUpdatePoliciesV2( &sensor_update_policies.GetSensorUpdatePoliciesV2Params{ Ids: []string{"ID1", "ID2", "ID3"}, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.sensorUpdatePolicies.getSensorUpdatePoliciesV2(["ID1", "ID2", "ID3"]); // ids
console.log(response);use rusty_falcon::apis::sensor_update_policies_api::get_sensor_update_policies_v2;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = get_sensor_update_policies_v2( &falcon.cfg, // configuration vec!["string".to_string()], // ids ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SensorUpdatePolicies.new
response = api.get_sensor_update_policies_v2(['ID1', 'ID2', 'ID3'])
puts responseResponses
[ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} } ]}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} } ]}incrementUninstallToken
Section titled “incrementUninstallToken”Increments a bulk maintenance token.
Method POST
Route /policy/combined/increment-uninstall-token/v1
Scope Bulk uninstallation token: WRITE
PEP 8
increment_uninstall_tokenParameters
Section titled “Parameters”body body · dictionary
Full body payload as JSON formatted dictionary.
audit_message body · string
An optional message to append to the recorded audit log
Code Examples
from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.increment_uninstall_token(audit_message="string")print(response)from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.incrementUninstallToken(audit_message="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
body_payload = { "audit_message": "string"}
response = falcon.command("incrementUninstallToken", body=body_payload)print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/maintenance_token" "github.com/crowdstrike/gofalcon/falcon/models")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
audit_message := "string"
response, err := client.MaintenanceToken.IncrementUninstallToken( &maintenance_token.IncrementUninstallTokenParams{ Body: &models.UninstallTokenIncrementUninstallTokenReqV1{ AuditMessage: &audit_message, }, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.maintenanceToken.incrementUninstallToken( { auditMessage: "string"} // body);
console.log(response);Examples coming soon.
require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::MaintenanceToken.new
body = Falcon::UninstallTokenIncrementUninstallTokenReqV1.new( audit_message: 'string')
response = api.increment_uninstall_token(body)
puts responseResponses
{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}performSensorUpdatePoliciesAction
Section titled “performSensorUpdatePoliciesAction”Perform the specified action on the Sensor Update Policies specified in the request
Method POST
Route /policy/entities/sensor-update-actions/v1
Scope Sensor update policies: WRITE
PEP 8
perform_policies_actionParameters
Section titled “Parameters”body body · dictionary
Full body payload as JSON formatted dictionary.
action_parameters body · array
Action specific parameter options.
ids body · array
Sensor Update policy ID(s) to perform actions against.
action_name query · string
The action to perform
Available values (6)
add-host-group | add-rule-group | disable |
enable | remove-host-group | remove-rule-group |
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
group_id body · string
Host Group ID to apply the policy to. Overridden if action_parameters is specified.
Code Examples
from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.perform_policies_action(action_name="string", action_parameters=[{"key": "value"}], group_id="string", ids=id_list)print(response)from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.performSensorUpdatePoliciesAction(action_name="string", action_parameters=[{"key": "value"}], group_id="string", ids=id_list)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
body_payload = { "action_parameters": [ { "name": "string", "value": "string" } ], "ids": ["string"]}
response = falcon.command("performSensorUpdatePoliciesAction", action_name="string", body=body_payload)print(response)Invoke-FalconSensorUpdatePolicyAction -Name "string" -Id "string"package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/sensor_update_policies" "github.com/crowdstrike/gofalcon/falcon/models")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
name := "string" value := "string"
response, err := client.SensorUpdatePolicies.PerformSensorUpdatePoliciesAction( &sensor_update_policies.PerformSensorUpdatePoliciesActionParams{ Body: &models.MsaEntityActionRequestV2{ ActionParameters: []interface{}{ { Name: &name, Value: &value, }, }, Ids: []string{"string"}, }, ActionName: "string", Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.sensorUpdatePolicies.performSensorUpdatePoliciesAction( "string", // actionName { // body actionParameters: [{ name: "string", value: "string" }], ids: [] });
console.log(response);use rusty_falcon::apis::sensor_update_policies_api::perform_sensor_update_policies_action;use rusty_falcon::easy::client::FalconHandle;use rusty_falcon::models::MsaEntityActionRequestV2;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let body = MsaEntityActionRequestV2 { ids: vec!["string".to_string()], ..Default::default() };
let response = perform_sensor_update_policies_action( &falcon.cfg, // configuration "string", // action_name body, // body ).await.expect("API call failed");
println!("{:?}", response);}Examples coming soon.
Responses
[ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} } ]}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} } ]}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} } ]}queryCombinedSensorUpdateBuilds
Section titled “queryCombinedSensorUpdateBuilds”Retrieve available builds for use with Sensor Update Policies
Method GET
Route /policy/combined/sensor-update-builds/v1
Scope Sensor update policies: READ
PEP 8
query_combined_buildsParameters
Section titled “Parameters”platform query · string
The platform to return builds for
Available values (5)
windows | mac | linux |
linuxarm64 | zlinux |
stage query · string or list of strings
The stages to return builds for
Available values (2)
prod | early_adopter |
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.query_combined_builds(platform="string", stage=id_list)print(response)from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.queryCombinedSensorUpdateBuilds(platform="string", stage=id_list)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("queryCombinedSensorUpdateBuilds", platform="string", stage=id_list)print(response)Get-FalconBuildpackage main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/sensor_update_policies")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
platform := "string"
response, err := client.SensorUpdatePolicies.QueryCombinedSensorUpdateBuilds( &sensor_update_policies.QueryCombinedSensorUpdateBuildsParams{ Platform: &platform, Stage: []string{"ID1", "ID2", "ID3"}, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.sensorUpdatePolicies.queryCombinedSensorUpdateBuilds( "string", // platform ["ID1", "ID2", "ID3"] // stage);
console.log(response);use rusty_falcon::apis::sensor_update_policies_api::query_combined_sensor_update_builds;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = query_combined_sensor_update_builds( &falcon.cfg, // configuration Some("string"), // platform Some(vec!["string".to_string()]), // stage ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SensorUpdatePolicies.new
response = api.query_combined_sensor_update_builds(platform: 'string', stage: ['ID1', 'ID2', 'ID3'])
puts responseResponses
[ { "build": "string", "is_lts_build": false, "platform": "string", "sensor_version": "string", "stage": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "build": "string", "is_lts_build": false, "platform": "string", "sensor_version": "string", "stage": "string" } ]}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "build": "string", "is_lts_build": false, "platform": "string", "sensor_version": "string", "stage": "string" } ]}queryCombinedSensorUpdateKernels
Section titled “queryCombinedSensorUpdateKernels”Retrieve kernel compatibility info for Sensor Update Builds
Method GET
Route /policy/combined/sensor-update-kernels/v1
Scope Sensor update policies: READ
PEP 8
query_combined_kernelsParameters
Section titled “Parameters”filter query · string
The filter expression that should be used to limit the results using FQL syntax.
offset query · integer
The offset to start retrieving records from
limit query · integer
The maximum records to return. [1-500]
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.query_combined_kernels(filter="string", limit=integer, offset=integer)print(response)from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.queryCombinedSensorUpdateKernels(filter="string", limit=integer, offset=integer)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("queryCombinedSensorUpdateKernels", filter="string", offset=integer, limit=integer)print(response)Get-FalconKernel -Filter "string" ` -Limit integer ` -Offset integerpackage main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/sensor_update_policies")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
filter := "string" offset := int64(0) limit := int64(0)
response, err := client.SensorUpdatePolicies.QueryCombinedSensorUpdateKernels( &sensor_update_policies.QueryCombinedSensorUpdateKernelsParams{ Filter: &filter, Offset: &offset, Limit: &limit, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.sensorUpdatePolicies.queryCombinedSensorUpdateKernels( "string", // filter integer, // offset integer // limit);
console.log(response);use rusty_falcon::apis::sensor_update_policies_api::query_combined_sensor_update_kernels;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = query_combined_sensor_update_kernels( &falcon.cfg, // configuration Some("string"), // filter Some(integer), // offset Some(integer), // limit ).await.expect("API call failed");
println!("{:?}", response);}Examples coming soon.
Responses
[ { "architecture": "string", "base_package_supported_sensor_versions": [], "created_timestamp": "string", "distro": "string", "distro_version": "string", "flavor": "string", "id": "string", "modified_timestamp": "string", "release": "string", "vendor": "string", "version": "string", "ztl_module_supported_sensor_versions": [], "ztl_supported_sensor_versions": [] }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "architecture": "string", "base_package_supported_sensor_versions": [], "created_timestamp": "string", "distro": "string", "distro_version": "string", "flavor": "string", "id": "string", "modified_timestamp": "string", "release": "string", "vendor": "string", "version": "string", "ztl_module_supported_sensor_versions": [], "ztl_supported_sensor_versions": [] } ]}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "architecture": "string", "base_package_supported_sensor_versions": [], "created_timestamp": "string", "distro": "string", "distro_version": "string", "flavor": "string", "id": "string", "modified_timestamp": "string", "release": "string", "vendor": "string", "version": "string", "ztl_module_supported_sensor_versions": [], "ztl_supported_sensor_versions": [] } ]}queryCombinedSensorUpdatePolicies
Section titled “queryCombinedSensorUpdatePolicies”Search for Sensor Update Policies in your environment by providing an FQL filter and paging details.
Method GET
Route /policy/combined/sensor-update/v1
Scope Sensor update policies: READ
PEP 8
query_combined_policiesParameters
Section titled “Parameters”filter query · string
The filter expression that should be used to limit the results
Available values (11)
Name | created_by | created_timestamp |
description | enabled | groups |
modified_by | modified_timestamp | name |
name.raw | platform_name |
offset query · integer
The offset to start retrieving records from
limit query · integer
The maximum records to return. [1-5000]
sort query · string
The property to sort by in FQL syntax. Supports
asc or desc. Available sort options:Available values (16)
created_by.asc | created_by.desc | created_timestamp.asc |
created_timestamp.desc | enabled.asc | enabled.desc |
modified_by.asc | modified_by.desc | modified_timestamp.asc |
modified_timestamp.desc | name.asc | name.desc |
platform_name.asc | platform_name.desc | precedence.asc |
precedence.desc |
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.query_combined_policies(filter="string", limit=integer, offset=integer, sort="string")print(response)from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.queryCombinedSensorUpdatePolicies(filter="string", limit=integer, offset=integer, sort="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("queryCombinedSensorUpdatePolicies", filter="string", offset=integer, limit=integer, sort="string")print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/sensor_update_policies")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
filter := "string" offset := int64(0) limit := int64(0) sort := "string"
response, err := client.SensorUpdatePolicies.QueryCombinedSensorUpdatePolicies( &sensor_update_policies.QueryCombinedSensorUpdatePoliciesParams{ Filter: &filter, Offset: &offset, Limit: &limit, Sort: &sort, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.sensorUpdatePolicies.queryCombinedSensorUpdatePolicies( "string", // filter integer, // offset integer, // limit "string" // sort);
console.log(response);use rusty_falcon::apis::sensor_update_policies_api::query_combined_sensor_update_policies;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = query_combined_sensor_update_policies( &falcon.cfg, // configuration Some("string"), // filter Some(integer), // offset Some(integer), // limit Some("string"), // sort ).await.expect("API call failed");
println!("{:?}", response);}Examples coming soon.
Responses
[ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} } ]}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} } ]}queryCombinedSensorUpdatePoliciesV2
Section titled “queryCombinedSensorUpdatePoliciesV2”Search for Sensor Update Policies with additional support for uninstall protection in your environment by providing an FQL filter and paging details.
Method GET
Route /policy/combined/sensor-update/v2
Scope Sensor update policies: READ
PEP 8
query_combined_policies_v2Parameters
Section titled “Parameters”filter query · string
The filter expression that should be used to limit the results
Available values (11)
Name | created_by | created_timestamp |
description | enabled | groups |
modified_by | modified_timestamp | name |
name.raw | platform_name |
offset query · integer
The offset to start retrieving records from
limit query · integer
The maximum records to return. [1-5000]
sort query · string
The property to sort by in FQL syntax. Supports
asc or desc. Available sort options:Available values (16)
created_by.asc | created_by.desc | created_timestamp.asc |
created_timestamp.desc | enabled.asc | enabled.desc |
modified_by.asc | modified_by.desc | modified_timestamp.asc |
modified_timestamp.desc | name.asc | name.desc |
platform_name.asc | platform_name.desc | precedence.asc |
precedence.desc |
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.query_combined_policies_v2(filter="string", limit=integer, offset=integer, sort="string")print(response)from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.queryCombinedSensorUpdatePoliciesV2(filter="string", limit=integer, offset=integer, sort="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("queryCombinedSensorUpdatePoliciesV2", filter="string", offset=integer, limit=integer, sort="string")print(response)Get-FalconSensorUpdatePolicy -Filter "string" ` -Sort "string" ` -Limit integer ` -Offset integerpackage main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/sensor_update_policies")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
filter := "string" offset := int64(0) limit := int64(0) sort := "string"
response, err := client.SensorUpdatePolicies.QueryCombinedSensorUpdatePoliciesV2( &sensor_update_policies.QueryCombinedSensorUpdatePoliciesV2Params{ Filter: &filter, Offset: &offset, Limit: &limit, Sort: &sort, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.sensorUpdatePolicies.queryCombinedSensorUpdatePoliciesV2( "string", // filter integer, // offset integer, // limit "string" // sort);
console.log(response);use rusty_falcon::apis::sensor_update_policies_api::query_combined_sensor_update_policies_v2;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = query_combined_sensor_update_policies_v2( &falcon.cfg, // configuration Some("string"), // filter Some(integer), // offset Some(integer), // limit Some("string"), // sort ).await.expect("API call failed");
println!("{:?}", response);}Examples coming soon.
Responses
[ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} } ]}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} } ]}queryCombinedSensorUpdatePolicyMembers
Section titled “queryCombinedSensorUpdatePolicyMembers”Search for members of a Sensor Update Policy in your environment by providing an FQL filter and paging details.
Method GET
Route /policy/combined/sensor-update-members/v1
Scope Sensor update policies: READ
PEP 8
query_combined_policy_membersParameters
Section titled “Parameters”id query · string
The ID of the Sensor Update Policy to search for members of
filter query · string
The filter expression that should be used to limit the results
Available values (11)
Name | created_by | created_timestamp |
description | enabled | groups |
modified_by | modified_timestamp | name |
name.raw | platform_name |
offset query · integer
The offset to start retrieving records from
limit query · integer
The maximum records to return. [1-5000]
sort query · string
The property to sort by in FQL syntax. Supports
asc or desc. Available sort options:Available values (8)
created_by | created_timestamp | enabled |
modified_by | modified_timestamp | name |
platform_name | precedence |
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.query_combined_policy_members(id="string", filter="string", limit=integer, offset=integer, sort="string")print(response)from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.queryCombinedSensorUpdatePolicyMembers(id="string", filter="string", limit=integer, offset=integer, sort="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("queryCombinedSensorUpdatePolicyMembers", id="string", filter="string", offset=integer, limit=integer, sort="string")print(response)Get-FalconSensorUpdatePolicyMember -Filter "string" ` -Sort "string" ` -Limit integer ` -Offset integerpackage main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/sensor_update_policies")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
iD := "string" filter := "string" offset := int64(0) limit := int64(0) sort := "string"
response, err := client.SensorUpdatePolicies.QueryCombinedSensorUpdatePolicyMembers( &sensor_update_policies.QueryCombinedSensorUpdatePolicyMembersParams{ ID: &iD, Filter: &filter, Offset: &offset, Limit: &limit, Sort: &sort, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.sensorUpdatePolicies.queryCombinedSensorUpdatePolicyMembers( "string", // id "string", // filter integer, // offset integer, // limit "string" // sort);
console.log(response);use rusty_falcon::apis::sensor_update_policies_api::query_combined_sensor_update_policy_members;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = query_combined_sensor_update_policy_members( &falcon.cfg, // configuration Some("string"), // id Some("string"), // filter Some(integer), // offset Some(integer), // limit Some("string"), // sort ).await.expect("API call failed");
println!("{:?}", response);}Examples coming soon.
Responses
[ { "agent_load_flags": "string", "agent_local_time": "string", "agent_version": "string", "base_image_version": "string", "bios_manufacturer": "string", "bios_version": "string", "build_number": "string", "chassis_type": "string", "chassis_type_desc": "string", "cid": "string", "cloud_service_compartment_id": "string", "config_id_base": "string", "config_id_build": "string", "config_id_platform": "string", "connection_ip": "string", "connection_mac_address": "string", "cpu_signature": "string", "cpu_vendor": "string", "criticality": "string", "default_gateway_ip": "string", "deployment_type": "string", "detection_suppression_status": "string", "device_id": "string", "device_policies": {}, "email": "string", "external_ip": "string", "filesystem_containment_status": "string", "first_login_timestamp": "string", "first_login_user": "string", "first_seen": "string", "group_hash": "string", "groups": [], "host_deleted_status": "string", "host_hidden_status": "string", "host_utc_offset": "string", "hostname": "string", "instance_id": "string", "internet_exposure": "string", "k8s_cluster_git_version": "string", "k8s_cluster_id": "string", "k8s_cluster_version": "string", "kernel_version": "string", "last_login_timestamp": "string", "last_login_uid": "string", "last_login_user": "string", "last_login_user_sid": "string", "last_reboot": "string", "last_seen": "string", "license_activation_state": "string", "linux_sensor_mode": "string", "local_ip": "string", "mac_address": "string", "machine_domain": "string", "major_version": "string", "managed_apps": {}, "meta": {}, "migration_completed_time": "string", "minor_version": "string", "modified_timestamp": "string", "notes": [], "os_build": "string", "os_product_name": "string", "os_version": "string", "ou": [], "platform_id": "string", "platform_name": "string", "pod_annotations": [], "pod_host_ip4": "string", "pod_host_ip6": "string", "pod_hostname": "string", "pod_id": "string", "pod_ip4": "string", "pod_ip6": "string", "pod_labels": [], "pod_name": "string", "pod_namespace": "string", "pod_service_account_name": "string", "pointer_size": "string", "policies": [], "product_type": "string", "product_type_desc": "string", "provision_status": "string", "reduced_functionality_mode": "string", "release_group": "string", "rtr_state": "string", "safe_mode": "string", "serial_number": "string", "service_pack_major": "string", "service_pack_minor": "string", "service_provider": "string", "service_provider_account_id": "string", "site_name": "string", "slow_changing_modified_timestamp": "string", "status": "string", "system_manufacturer": "string", "system_product_name": "string", "tags": [], "zone_group": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "agent_load_flags": "string", "agent_local_time": "string", "agent_version": "string", "base_image_version": "string", "bios_manufacturer": "string", "bios_version": "string", "build_number": "string", "chassis_type": "string", "chassis_type_desc": "string", "cid": "string", "cloud_service_compartment_id": "string", "config_id_base": "string", "config_id_build": "string", "config_id_platform": "string", "connection_ip": "string", "connection_mac_address": "string", "cpu_signature": "string", "cpu_vendor": "string", "criticality": "string", "default_gateway_ip": "string", "deployment_type": "string", "detection_suppression_status": "string", "device_id": "string", "device_policies": {}, "email": "string", "external_ip": "string", "filesystem_containment_status": "string", "first_login_timestamp": "string", "first_login_user": "string", "first_seen": "string", "group_hash": "string", "groups": [], "host_deleted_status": "string", "host_hidden_status": "string", "host_utc_offset": "string", "hostname": "string", "instance_id": "string", "internet_exposure": "string", "k8s_cluster_git_version": "string", "k8s_cluster_id": "string", "k8s_cluster_version": "string", "kernel_version": "string", "last_login_timestamp": "string", "last_login_uid": "string", "last_login_user": "string", "last_login_user_sid": "string", "last_reboot": "string", "last_seen": "string", "license_activation_state": "string", "linux_sensor_mode": "string", "local_ip": "string", "mac_address": "string", "machine_domain": "string", "major_version": "string", "managed_apps": {}, "meta": {}, "migration_completed_time": "string", "minor_version": "string", "modified_timestamp": "string", "notes": [], "os_build": "string", "os_product_name": "string", "os_version": "string", "ou": [], "platform_id": "string", "platform_name": "string", "pod_annotations": [], "pod_host_ip4": "string", "pod_host_ip6": "string", "pod_hostname": "string", "pod_id": "string", "pod_ip4": "string", "pod_ip6": "string", "pod_labels": [], "pod_name": "string", "pod_namespace": "string", "pod_service_account_name": "string", "pointer_size": "string", "policies": [], "product_type": "string", "product_type_desc": "string", "provision_status": "string", "reduced_functionality_mode": "string", "release_group": "string", "rtr_state": "string", "safe_mode": "string", "serial_number": "string", "service_pack_major": "string", "service_pack_minor": "string", "service_provider": "string", "service_provider_account_id": "string", "site_name": "string", "slow_changing_modified_timestamp": "string", "status": "string", "system_manufacturer": "string", "system_product_name": "string", "tags": [], "zone_group": "string" } ]}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "agent_load_flags": "string", "agent_local_time": "string", "agent_version": "string", "base_image_version": "string", "bios_manufacturer": "string", "bios_version": "string", "build_number": "string", "chassis_type": "string", "chassis_type_desc": "string", "cid": "string", "cloud_service_compartment_id": "string", "config_id_base": "string", "config_id_build": "string", "config_id_platform": "string", "connection_ip": "string", "connection_mac_address": "string", "cpu_signature": "string", "cpu_vendor": "string", "criticality": "string", "default_gateway_ip": "string", "deployment_type": "string", "detection_suppression_status": "string", "device_id": "string", "device_policies": {}, "email": "string", "external_ip": "string", "filesystem_containment_status": "string", "first_login_timestamp": "string", "first_login_user": "string", "first_seen": "string", "group_hash": "string", "groups": [], "host_deleted_status": "string", "host_hidden_status": "string", "host_utc_offset": "string", "hostname": "string", "instance_id": "string", "internet_exposure": "string", "k8s_cluster_git_version": "string", "k8s_cluster_id": "string", "k8s_cluster_version": "string", "kernel_version": "string", "last_login_timestamp": "string", "last_login_uid": "string", "last_login_user": "string", "last_login_user_sid": "string", "last_reboot": "string", "last_seen": "string", "license_activation_state": "string", "linux_sensor_mode": "string", "local_ip": "string", "mac_address": "string", "machine_domain": "string", "major_version": "string", "managed_apps": {}, "meta": {}, "migration_completed_time": "string", "minor_version": "string", "modified_timestamp": "string", "notes": [], "os_build": "string", "os_product_name": "string", "os_version": "string", "ou": [], "platform_id": "string", "platform_name": "string", "pod_annotations": [], "pod_host_ip4": "string", "pod_host_ip6": "string", "pod_hostname": "string", "pod_id": "string", "pod_ip4": "string", "pod_ip6": "string", "pod_labels": [], "pod_name": "string", "pod_namespace": "string", "pod_service_account_name": "string", "pointer_size": "string", "policies": [], "product_type": "string", "product_type_desc": "string", "provision_status": "string", "reduced_functionality_mode": "string", "release_group": "string", "rtr_state": "string", "safe_mode": "string", "serial_number": "string", "service_pack_major": "string", "service_pack_minor": "string", "service_provider": "string", "service_provider_account_id": "string", "site_name": "string", "slow_changing_modified_timestamp": "string", "status": "string", "system_manufacturer": "string", "system_product_name": "string", "tags": [], "zone_group": "string" } ]}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "agent_load_flags": "string", "agent_local_time": "string", "agent_version": "string", "base_image_version": "string", "bios_manufacturer": "string", "bios_version": "string", "build_number": "string", "chassis_type": "string", "chassis_type_desc": "string", "cid": "string", "cloud_service_compartment_id": "string", "config_id_base": "string", "config_id_build": "string", "config_id_platform": "string", "connection_ip": "string", "connection_mac_address": "string", "cpu_signature": "string", "cpu_vendor": "string", "criticality": "string", "default_gateway_ip": "string", "deployment_type": "string", "detection_suppression_status": "string", "device_id": "string", "device_policies": {}, "email": "string", "external_ip": "string", "filesystem_containment_status": "string", "first_login_timestamp": "string", "first_login_user": "string", "first_seen": "string", "group_hash": "string", "groups": [], "host_deleted_status": "string", "host_hidden_status": "string", "host_utc_offset": "string", "hostname": "string", "instance_id": "string", "internet_exposure": "string", "k8s_cluster_git_version": "string", "k8s_cluster_id": "string", "k8s_cluster_version": "string", "kernel_version": "string", "last_login_timestamp": "string", "last_login_uid": "string", "last_login_user": "string", "last_login_user_sid": "string", "last_reboot": "string", "last_seen": "string", "license_activation_state": "string", "linux_sensor_mode": "string", "local_ip": "string", "mac_address": "string", "machine_domain": "string", "major_version": "string", "managed_apps": {}, "meta": {}, "migration_completed_time": "string", "minor_version": "string", "modified_timestamp": "string", "notes": [], "os_build": "string", "os_product_name": "string", "os_version": "string", "ou": [], "platform_id": "string", "platform_name": "string", "pod_annotations": [], "pod_host_ip4": "string", "pod_host_ip6": "string", "pod_hostname": "string", "pod_id": "string", "pod_ip4": "string", "pod_ip6": "string", "pod_labels": [], "pod_name": "string", "pod_namespace": "string", "pod_service_account_name": "string", "pointer_size": "string", "policies": [], "product_type": "string", "product_type_desc": "string", "provision_status": "string", "reduced_functionality_mode": "string", "release_group": "string", "rtr_state": "string", "safe_mode": "string", "serial_number": "string", "service_pack_major": "string", "service_pack_minor": "string", "service_provider": "string", "service_provider_account_id": "string", "site_name": "string", "slow_changing_modified_timestamp": "string", "status": "string", "system_manufacturer": "string", "system_product_name": "string", "tags": [], "zone_group": "string" } ]}querySensorUpdateKernelsDistinct
Section titled “querySensorUpdateKernelsDistinct”Retrieve kernel compatibility info for Sensor Update Builds
Method GET
Route /policy/queries/sensor-update-kernels/{distinct-field}/v1
Scope Sensor update policies: READ
PEP 8
query_kernelsParameters
Section titled “Parameters”distinct-field path · string
The field name to get distinct values for
filter query · string
The filter expression that should be used to limit the results using FQL syntax.
offset query · integer
The offset to start retrieving records from
limit query · integer
The maximum records to return. [1-500]
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
distinct_field body · string
The field name to get distinct values for. If you do not specify a value for this field it will default to
id.Code Examples
from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.query_kernels(distinct_field="string", filter="string", limit=integer, offset=integer)print(response)from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.querySensorUpdateKernelsDistinct(distinct_field="string", filter="string", limit=integer, offset=integer)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("querySensorUpdateKernelsDistinct", distinct_field="string", filter="string", offset=integer, limit=integer)print(response)Get-FalconKernel -Filter "string" ` -Sort "string" ` -Limit integer ` -Offset integerpackage main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/sensor_update_policies")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
filter := "string" offset := int64(0) limit := int64(0)
response, err := client.SensorUpdatePolicies.QuerySensorUpdateKernelsDistinct( &sensor_update_policies.QuerySensorUpdateKernelsDistinctParams{ DistinctField: "string", Filter: &filter, Offset: &offset, Limit: &limit, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.sensorUpdatePolicies.querySensorUpdateKernelsDistinct( "string", // distinctField "string", // filter integer, // offset integer // limit);
console.log(response);use rusty_falcon::apis::sensor_update_policies_api::query_sensor_update_kernels_distinct;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = query_sensor_update_kernels_distinct( &falcon.cfg, // configuration "string", // distinct_field Some("string"), // filter Some(integer), // offset Some(integer), // limit ).await.expect("API call failed");
println!("{:?}", response);}Examples coming soon.
Responses
[ "string"]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ "string" ]}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ "string" ]}querySensorUpdatePolicies
Section titled “querySensorUpdatePolicies”Search for Sensor Update Policies in your environment by providing an FQL filter and paging details.
Method GET
Route /policy/queries/sensor-update/v1
Scope Sensor update policies: READ
PEP 8
query_policiesParameters
Section titled “Parameters”filter query · string
The filter expression that should be used to limit the results
Available values (11)
Name | created_by | created_timestamp |
description | enabled | groups |
modified_by | modified_timestamp | name |
name.raw | platform_name |
offset query · integer
The offset to start retrieving records from
limit query · integer
The maximum records to return. [1-5000]
sort query · string
The property to sort by in FQL syntax. Supports
asc or desc. Available sort options:Available values (16)
created_by.asc | created_by.desc | created_timestamp.asc |
created_timestamp.desc | enabled.asc | enabled.desc |
modified_by.asc | modified_by.desc | modified_timestamp.asc |
modified_timestamp.desc | name.asc | name.desc |
platform_name.asc | platform_name.desc | precedence.asc |
precedence.desc |
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.query_policies(filter="string", limit=integer, offset=integer, sort="string")print(response)from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.querySensorUpdatePolicies(filter="string", limit=integer, offset=integer, sort="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("querySensorUpdatePolicies", filter="string", offset=integer, limit=integer, sort="string")print(response)Get-FalconSensorUpdatePolicy -Filter "string" ` -Sort "string" ` -Limit integer ` -Offset integerpackage main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/sensor_update_policies")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
filter := "string" offset := int64(0) limit := int64(0) sort := "string"
response, err := client.SensorUpdatePolicies.QuerySensorUpdatePolicies( &sensor_update_policies.QuerySensorUpdatePoliciesParams{ Filter: &filter, Offset: &offset, Limit: &limit, Sort: &sort, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.sensorUpdatePolicies.querySensorUpdatePolicies( "string", // filter integer, // offset integer, // limit "string" // sort);
console.log(response);use rusty_falcon::apis::sensor_update_policies_api::query_sensor_update_policies;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = query_sensor_update_policies( &falcon.cfg, // configuration Some("string"), // filter Some(integer), // offset Some(integer), // limit Some("string"), // sort ).await.expect("API call failed");
println!("{:?}", response);}Examples coming soon.
Responses
[ "string"]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ "string" ]}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ "string" ]}querySensorUpdatePolicyMembers
Section titled “querySensorUpdatePolicyMembers”Search for members of a Sensor Update Policy in your environment by providing an FQL filter and paging details.
Method GET
Route /policy/queries/sensor-update-members/v1
Scope Sensor update policies: READ
PEP 8
query_policy_membersParameters
Section titled “Parameters”id query · string
The ID of the Sensor Update Policy to search for members of
filter query · string
The filter expression that should be used to limit the results
Available values (11)
Name | created_by | created_timestamp |
description | enabled | groups |
modified_by | modified_timestamp | name |
name.raw | platform_name |
offset query · integer
The offset to start retrieving records from
limit query · integer
The maximum records to return. [1-5000]
sort query · string
The property to sort by in FQL syntax. Supports
asc or desc. Available sort options:Available values (8)
created_by | created_timestamp | enabled |
modified_by | modified_timestamp | name |
platform_name | precedence |
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.query_policy_members(id="string", filter="string", limit=integer, offset=integer, sort="string")print(response)from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.querySensorUpdatePolicyMembers(id="string", filter="string", limit=integer, offset=integer, sort="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("querySensorUpdatePolicyMembers", id="string", filter="string", offset=integer, limit=integer, sort="string")print(response)Get-FalconSensorUpdatePolicyMember -Filter "string" ` -Sort "string" ` -Limit integer ` -Offset integerpackage main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/sensor_update_policies")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
iD := "string" filter := "string" offset := int64(0) limit := int64(0) sort := "string"
response, err := client.SensorUpdatePolicies.QuerySensorUpdatePolicyMembers( &sensor_update_policies.QuerySensorUpdatePolicyMembersParams{ ID: &iD, Filter: &filter, Offset: &offset, Limit: &limit, Sort: &sort, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.sensorUpdatePolicies.querySensorUpdatePolicyMembers( "string", // id "string", // filter integer, // offset integer, // limit "string" // sort);
console.log(response);use rusty_falcon::apis::sensor_update_policies_api::query_sensor_update_policy_members;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = query_sensor_update_policy_members( &falcon.cfg, // configuration Some("string"), // id Some("string"), // filter Some(integer), // offset Some(integer), // limit Some("string"), // sort ).await.expect("API call failed");
println!("{:?}", response);}Examples coming soon.
Responses
[ "string"]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ "string" ]}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ "string" ]}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ "string" ]}revealUninstallToken
Section titled “revealUninstallToken”Reveals an uninstall token for a specific device.
Method POST
Route /policy/combined/reveal-uninstall-token/v1
Scope Sensor update policies: WRITE
PEP 8
reveal_uninstall_tokenParameters
Section titled “Parameters”body body · dictionary
Full body payload as JSON formatted dictionary.
audit_message body · string
An optional message to append to the recorded audit log
device_id body · string
The id of the device to reveal the token for
Code Examples
from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.reveal_uninstall_token(audit_message="string", device_id="string")print(response)from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.revealUninstallToken(audit_message="string", device_id="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
body_payload = { "audit_message": "string", "device_id": "string"}
response = falcon.command("revealUninstallToken", body=body_payload)print(response)Get-FalconUninstallToken -Id "string"package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/sensor_update_policies" "github.com/crowdstrike/gofalcon/falcon/models")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
audit_message := "string" device_id := "string"
response, err := client.SensorUpdatePolicies.RevealUninstallToken( &sensor_update_policies.RevealUninstallTokenParams{ Body: &models.UninstallTokenRevealUninstallTokenReqV1{ AuditMessage: &audit_message, DeviceID: &device_id, }, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.sensorUpdatePolicies.revealUninstallToken( { auditMessage: "string", deviceId: "string"} // body);
console.log(response);use rusty_falcon::apis::sensor_update_policies_api::reveal_uninstall_token;use rusty_falcon::easy::client::FalconHandle;use rusty_falcon::models::UninstallTokenRevealUninstallTokenReqV1;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let body = UninstallTokenRevealUninstallTokenReqV1 { device_id: Some("string".to_string()), ..Default::default() };
let response = reveal_uninstall_token( &falcon.cfg, // configuration body, // body ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SensorUpdatePolicies.new
body = Falcon::UninstallTokenRevealUninstallTokenReqV1.new( audit_message: 'string', device_id: 'string')
response = api.reveal_uninstall_token(body)
puts responseResponses
[ { "device_id": "string", "seed_id": 0, "uninstall_token": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "device_id": "string", "seed_id": 0, "uninstall_token": "string" } ]}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "device_id": "string", "seed_id": 0, "uninstall_token": "string" } ]}setSensorUpdatePoliciesPrecedence
Section titled “setSensorUpdatePoliciesPrecedence”Sets the precedence of Sensor Update Policies based on the order of IDs specified in the request.
Method POST
Route /policy/entities/sensor-update-precedence/v1
Scope Sensor update policies: WRITE
PEP 8
set_policies_precedenceParameters
Section titled “Parameters”body body · dictionary
Full body payload as JSON formatted dictionary.
ids body · array
The ids of all current prevention policies for the platform specified. The precedence will be set in the order the ids are specified
platform_name body · string
The name of the platform for which to set precedence
Available values (3)
Windows | Mac | Linux |
Code Examples
from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.set_policies_precedence(ids=id_list, platform_name="string")print(response)from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.setSensorUpdatePoliciesPrecedence(ids=id_list, platform_name="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
body_payload = { "ids": ["string"], "platform_name": "string"}
response = falcon.command("setSensorUpdatePoliciesPrecedence", body=body_payload)print(response)Set-FalconSensorUpdatePrecedence -PlatformName "string" -Id @("ID1", "ID2")package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/sensor_update_policies" "github.com/crowdstrike/gofalcon/falcon/models")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
platform_name := "string"
response, err := client.SensorUpdatePolicies.SetSensorUpdatePoliciesPrecedence( &sensor_update_policies.SetSensorUpdatePoliciesPrecedenceParams{ Body: &models.BaseSetPolicyPrecedenceReqV1{ Ids: []string{"string"}, PlatformName: &platform_name, }, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.sensorUpdatePolicies.setSensorUpdatePoliciesPrecedence( { ids: [], platformName: "string"} // body);
console.log(response);use rusty_falcon::apis::sensor_update_policies_api::set_sensor_update_policies_precedence;use rusty_falcon::easy::client::FalconHandle;use rusty_falcon::models::BaseSetPolicyPrecedenceReqV1;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let body = BaseSetPolicyPrecedenceReqV1 { ids: vec!["string".to_string()], platform_name: Some("string".to_string()), ..Default::default() };
let response = set_sensor_update_policies_precedence( &falcon.cfg, // configuration body, // body ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SensorUpdatePolicies.new
body = Falcon::BaseSetPolicyPrecedenceReqV1.new( ids: [], platform_name: 'string')
response = api.set_sensor_update_policies_precedence(body)
puts responseResponses
[ "string"]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ "string" ]}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ "string" ]}updateSensorUpdatePolicies
Section titled “updateSensorUpdatePolicies”Update Sensor Update Policies by specifying the ID of the policy and details to update
Method PATCH
Route /policy/entities/sensor-update/v1
Scope Sensor update policies: WRITE
PEP 8
update_policiesParameters
Section titled “Parameters”body body · dictionary
Full body payload as JSON formatted dictionary.
resources body · array
A collection of policies to update
build body · string
Build policy applies to.
description body · string
Sensor Update Policy description.
id body · string
Sensor Update Policy ID to update.
name body · string
Sensor Update Policy name.
settings body · dictionary
Sensor Update policy specific settings. OVERRIDES the value of the “build” keyword if provided.
Code Examples
from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
settings = { "build": "string"}
response = falcon.update_policies(build="string", description="string", id="string", name="string", settings=settings)print(response)from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
settings = { "build": "string"}
response = falcon.updateSensorUpdatePolicies(build="string", description="string", id="string", name="string", settings=settings)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
body_payload = { "resources": [ { "description": "string", "id": "string", "name": "string", "settings": { "build": "string" } } ]}
response = falcon.command("updateSensorUpdatePolicies", body=body_payload)print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/sensor_update_policies" "github.com/crowdstrike/gofalcon/falcon/models")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
description := "string" id := "string" name := "string"
response, err := client.SensorUpdatePolicies.UpdateSensorUpdatePolicies( &sensor_update_policies.UpdateSensorUpdatePoliciesParams{ Body: &models.SensorUpdateUpdatePoliciesReqV1{ Resources: []interface{}{ { Description: &description, ID: &id, Name: &name, Settings: &struct{}{}, }, }, }, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.sensorUpdatePolicies.updateSensorUpdatePolicies( { resources: [{ description: "string", id: "string", name: "string", settings: { build: "string" } }]} // body);
console.log(response);use rusty_falcon::apis::sensor_update_policies_api::update_sensor_update_policies;use rusty_falcon::easy::client::FalconHandle;use rusty_falcon::models::SensorUpdateUpdatePoliciesReqV1;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let body = SensorUpdateUpdatePoliciesReqV1 { resources: vec![UpdatePolicyReqV1 { id: Some("string".to_string()), ..Default::default() }], ..Default::default() };
let response = update_sensor_update_policies( &falcon.cfg, // configuration body, // body ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SensorUpdatePolicies.new
body = Falcon::SensorUpdateUpdatePoliciesReqV1.new( resources: [{ description: 'string', id: 'string', name: 'string', settings: { build: 'string' } }])
response = api.update_sensor_update_policies(body)
puts responseResponses
[ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} } ]}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} } ]}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} } ]}updateSensorUpdatePoliciesV2
Section titled “updateSensorUpdatePoliciesV2”Update Sensor Update Policies by specifying the ID of the policy and details to update with additional support for uninstall protection
Method PATCH
Route /policy/entities/sensor-update/v2
Scope Sensor update policies: WRITE
PEP 8
update_policies_v2Parameters
Section titled “Parameters”body body · dictionary
Full body payload as JSON formatted dictionary.
resources body · array
A collection of policies to update
build body · string
Build policy applies to.
description body · string
Sensor Update Policy description.
id body · string
Sensor Update Policy ID to update.
name body · string
Sensor Update Policy name.
scheduler body · dictionary
Schedule settings.
settings body · dictionary
Sensor Update policy specific settings. OVERRIDES the value of the “build” keyword if provided.
show_early_adopter_builds body · boolean
Display early adopter builds.
uninstall_protection body · string
Boolean indicating if uninstall protection should be enabled. Allowed values:
Available values (2)
ENABLED | DISABLED |
variants body · list of dictionaries
Allowed variants.
Code Examples
from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
scheduler = { "enabled": True, "schedules": [ { "days": [ 0 ], "end": "string", "start": "string" } ], "timezone": "string"}
settings = { "build": "string", "scheduler": { "enabled": True, "schedules": [ { "days": [ 0 ], "end": "string", "start": "string" } ], "timezone": "string" }, "show_early_adopter_builds": True, "uninstall_protection": "ENABLED", "variants": [ { "build": "string", "platform": "string" } ]}
variants = [ { "build": "string", "platform": "string" }]
response = falcon.update_policies_v2(build="string", description="string", id="string", name="string", scheduler=scheduler, settings=settings, show_early_adopter_builds=boolean, uninstall_protection="string", variants=variants)print(response)from falconpy import SensorUpdatePolicy
falcon = SensorUpdatePolicy(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
scheduler = { "enabled": True, "schedules": [ { "days": [ 0 ], "end": "string", "start": "string" } ], "timezone": "string"}
settings = { "build": "string", "scheduler": { "enabled": True, "schedules": [ { "days": [ 0 ], "end": "string", "start": "string" } ], "timezone": "string" }, "show_early_adopter_builds": True, "uninstall_protection": "ENABLED", "variants": [ { "build": "string", "platform": "string" } ]}
variants = [ { "build": "string", "platform": "string" }]
response = falcon.updateSensorUpdatePoliciesV2(build="string", description="string", id="string", name="string", scheduler=scheduler, settings=settings, show_early_adopter_builds=boolean, uninstall_protection="string", variants=variants)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
body_payload = { "resources": [ { "description": "string", "id": "string", "name": "string", "settings": { "build": "string", "scheduler": {}, "show_early_adopter_builds": boolean, "uninstall_protection": "string", "variants": ["string"] } } ]}
response = falcon.command("updateSensorUpdatePoliciesV2", body=body_payload)print(response)Edit-FalconSensorUpdatePolicy -Id "string"package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/sensor_update_policies" "github.com/crowdstrike/gofalcon/falcon/models")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
description := "string" id := "string" name := "string"
response, err := client.SensorUpdatePolicies.UpdateSensorUpdatePoliciesV2( &sensor_update_policies.UpdateSensorUpdatePoliciesV2Params{ Body: &models.SensorUpdateUpdatePoliciesReqV2{ Resources: []interface{}{ { Description: &description, ID: &id, Name: &name, Settings: &struct{}{}, }, }, }, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.sensorUpdatePolicies.updateSensorUpdatePoliciesV2( { resources: [{ description: "string", id: "string", name: "string", settings: { build: "string", scheduler: {}, showEarlyAdopterBuilds: boolean, uninstallProtection: "string", variants: [] } }]} // body);
console.log(response);use rusty_falcon::apis::sensor_update_policies_api::update_sensor_update_policies_v2;use rusty_falcon::easy::client::FalconHandle;use rusty_falcon::models::SensorUpdateUpdatePoliciesReqV2;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let body = SensorUpdateUpdatePoliciesReqV2 { resources: vec![UpdatePolicyReqV2 { id: Some("string".to_string()), ..Default::default() }], ..Default::default() };
let response = update_sensor_update_policies_v2( &falcon.cfg, // configuration body, // body ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::SensorUpdatePolicies.new
body = Falcon::SensorUpdateUpdatePoliciesReqV2.new( resources: [{ description: 'string', id: 'string', name: 'string', settings: { build: 'string', scheduler: {}, show_early_adopter_builds: boolean, uninstall_protection: 'string', variants: [] } }])
response = api.update_sensor_update_policies_v2(body)
puts responseResponses
[ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} } ]}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} } ]}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "cid": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "enabled": false, "groups": [], "id": "string", "modified_by": "string", "modified_timestamp": "string", "name": "string", "platform_name": "string", "settings": {} } ]}