Sensor Usage

The Sensor Usage service collection provides operations for retrieving sensor usage statistics. Fetch hourly or weekly averages representing how many unique AIDs were active over the previous 28 days, with support for FQL filters to narrow results by date, period, and CID selection.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
GetSensorUsageHourly get_hourly_usage	Fetches hourly average.
GetSensorUsageWeekly get_weekly_usage	Fetches weekly average.

---

GetSensorUsageHourly

Fetches hourly average.

Method GET

Route /billing-dashboards-usage/aggregates/hourly-average/v1

Scope Sensor Usage: READ

PEP 8 get_hourly_usage

Parameters

filter query · string

The FQL search filter.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import SensorUsage

falcon = SensorUsage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.get_hourly_usage(filter="string")
print(response)

Operation ID

from falconpy import SensorUsage

falcon = SensorUsage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.GetSensorUsageHourly(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetSensorUsageHourly",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sensor_usage_api"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.SensorUsageApi.GetSensorUsageHourly(
    &sensor_usage_api.GetSensorUsageHourlyParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sensorUsageApi.getSensorUsageHourly("string");  // filter

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SensorUsageApi.new

response = api.get_sensor_usage_hourly(filter: 'string')

puts response

Responses

200 OK

[
  {
    "chrome_os": 0.0,
    "containers": 0.0,
    "date": "string",
    "lumos": 0.0,
    "mobile": 0.0,
    "public_cloud_with_containers": 0.0,
    "public_cloud_without_containers": 0.0,
    "servers_with_containers": 0.0,
    "servers_without_containers": 0.0,
    "workstations": 0.0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "chrome_os": 0.0,
      "containers": 0.0,
      "date": "string",
      "lumos": 0.0,
      "mobile": 0.0,
      "public_cloud_with_containers": 0.0,
      "public_cloud_without_containers": 0.0,
      "servers_with_containers": 0.0,
      "servers_without_containers": 0.0,
      "workstations": 0.0
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "chrome_os": 0.0,
      "containers": 0.0,
      "date": "string",
      "lumos": 0.0,
      "mobile": 0.0,
      "public_cloud_with_containers": 0.0,
      "public_cloud_without_containers": 0.0,
      "servers_with_containers": 0.0,
      "servers_without_containers": 0.0,
      "workstations": 0.0
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "chrome_os": 0.0,
      "containers": 0.0,
      "date": "string",
      "lumos": 0.0,
      "mobile": 0.0,
      "public_cloud_with_containers": 0.0,
      "public_cloud_without_containers": 0.0,
      "servers_with_containers": 0.0,
      "servers_without_containers": 0.0,
      "workstations": 0.0
    }
  ]
}

---

---

GetSensorUsageWeekly

Fetches weekly average.

Method GET

Route /billing-dashboards-usage/aggregates/weekly-average/v1

Scope Sensor Usage: READ

PEP 8 get_weekly_usage

Parameters

filter query · string

The FQL search filter.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import SensorUsage

falcon = SensorUsage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.get_weekly_usage(filter="string")
print(response)

Operation ID

from falconpy import SensorUsage

falcon = SensorUsage(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.GetSensorUsageWeekly(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetSensorUsageWeekly",
                          filter="string")
print(response)

PowerShell

Get-FalconHostAverage

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sensor_usage_api"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.SensorUsageApi.GetSensorUsageWeekly(
    &sensor_usage_api.GetSensorUsageWeeklyParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sensorUsageApi.getSensorUsageWeekly("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::sensor_usage_api_api::get_sensor_usage_weekly;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_sensor_usage_weekly(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SensorUsage.new

response = api.get_sensor_usage_weekly(filter: 'string')

puts response

Responses

200 OK

[
  {
    "chrome_os": 0.0,
    "containers": 0.0,
    "date": "string",
    "lumos": 0.0,
    "mobile": 0.0,
    "public_cloud_with_containers": 0.0,
    "public_cloud_without_containers": 0.0,
    "servers_with_containers": 0.0,
    "servers_without_containers": 0.0,
    "workstations": 0.0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "chrome_os": 0.0,
      "containers": 0.0,
      "date": "string",
      "lumos": 0.0,
      "mobile": 0.0,
      "public_cloud_with_containers": 0.0,
      "public_cloud_without_containers": 0.0,
      "servers_with_containers": 0.0,
      "servers_without_containers": 0.0,
      "workstations": 0.0
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "chrome_os": 0.0,
      "containers": 0.0,
      "date": "string",
      "lumos": 0.0,
      "mobile": 0.0,
      "public_cloud_with_containers": 0.0,
      "public_cloud_without_containers": 0.0,
      "servers_with_containers": 0.0,
      "servers_without_containers": 0.0,
      "workstations": 0.0
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "chrome_os": 0.0,
      "containers": 0.0,
      "date": "string",
      "lumos": 0.0,
      "mobile": 0.0,
      "public_cloud_with_containers": 0.0,
      "public_cloud_without_containers": 0.0,
      "servers_with_containers": 0.0,
      "servers_without_containers": 0.0,
      "workstations": 0.0
    }
  ]
}