Sensor Visibility Exclusions

The Sensor Visibility Exclusions service collection provides operations for managing sensor visibility exclusions. Retrieve, create, delete, update, and query exclusions that control which processes are excluded from sensor visibility monitoring.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

This service collection has code examples posted to the repository.

---

---

Table of Contents

Operation	Description
createSVExclusionsV1 create_exclusions	Create the sensor visibility exclusions
deleteSensorVisibilityExclusionsV1 delete_exclusions	Delete the sensor visibility exclusions by id
getSensorVisibilityExclusionsV1 get_exclusions	Get a set of Sensor Visibility Exclusions by specifying their IDs
querySensorVisibilityExclusionsV1 query_exclusions	Search for sensor visibility exclusions.
updateSensorVisibilityExclusionsV1 update_exclusions	Update the sensor visibility exclusions

---

createSVExclusionsV1

Create the sensor visibility exclusions

Method POST

Route /policy/entities/sv-exclusions/v1

Scope Sensor Visibility Exclusions: WRITE

PEP 8 create_exclusions

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

comment body · string

String comment describing why the exclusion is entered.

groups body · array

Group IDs to exclude.

is_descendant_process body · boolean

value body · string

Value to exclude.

Code Examples

Python

PEP 8

from falconpy import SensorVisibilityExclusions

falcon = SensorVisibilityExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.create_exclusions(comment="string",
                                    groups=id_list,
                                    value="string")
print(response)

Operation ID

from falconpy import SensorVisibilityExclusions

falcon = SensorVisibilityExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.createSVExclusionsV1(comment="string",
                                       groups=id_list,
                                       value="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "comment": "string",
    "groups": ["string"],
    "is_descendant_process": boolean,
    "value": "string"
}

response = falcon.command("createSVExclusionsV1", body=body_payload)
print(response)

PowerShell

New-FalconSvExclusion -Value "string" -DescendantProcess $boolean

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sensor_visibility_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  is_descendant_process := boolean
  value := "string"

  response, err := client.SensorVisibilityExclusions.CreateSVExclusionsV1(
    &sensor_visibility_exclusions.CreateSVExclusionsV1Params{
      Body: &models.SvExclusionsCreateReqV1{
        Comment: &comment,
        Groups: []string{"string"},
        IsDescendantProcess: &is_descendant_process,
        Value: &value,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sensorVisibilityExclusions.createSVExclusionsV1(
  {
    comment: "string",
    groups: [],
    isDescendantProcess: boolean,
    value: "string"
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::sensor_visibility_exclusions_api::create_sv_exclusions_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::SvExclusionsCreateReqV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = SvExclusionsCreateReqV1 {
        ..Default::default()
    };

    let response = create_sv_exclusions_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SensorVisibilityExclusions.new

body = Falcon::SvExclusionsCreateReqV1.new(
  comment: 'string',
  groups: [],
  is_descendant_process: boolean,
  value: 'string'
)

response = api.create_sv_exclusions_v1(body)

puts response

Responses

200 OK

[
  {
    "applied_globally": false,
    "created_by": "string",
    "created_on": "string",
    "excluded_from": [],
    "groups": [],
    "id": "string",
    "last_modified": "string",
    "modified_by": "string",
    "regexp_value": "string",
    "value": "string",
    "value_hash": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "applied_globally": false,
      "created_by": "string",
      "created_on": "string",
      "excluded_from": [],
      "groups": [],
      "id": "string",
      "last_modified": "string",
      "modified_by": "string",
      "regexp_value": "string",
      "value": "string",
      "value_hash": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "applied_globally": false,
      "created_by": "string",
      "created_on": "string",
      "excluded_from": [],
      "groups": [],
      "id": "string",
      "last_modified": "string",
      "modified_by": "string",
      "regexp_value": "string",
      "value": "string",
      "value_hash": "string"
    }
  ]
}

---

---

deleteSensorVisibilityExclusionsV1

Delete the sensor visibility exclusions by id

Method DELETE

Route /policy/entities/sv-exclusions/v1

Scope Sensor Visibility Exclusions: WRITE

PEP 8 delete_exclusions

Parameters

ids query · string or list of strings

The ids of the exclusions to delete

comment query · string

Explains why this exclusions was deleted

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import SensorVisibilityExclusions

falcon = SensorVisibilityExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_exclusions(comment="string", ids=id_list)
print(response)

Operation ID

from falconpy import SensorVisibilityExclusions

falcon = SensorVisibilityExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteSensorVisibilityExclusionsV1(comment="string",
                                                     ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deleteSensorVisibilityExclusionsV1",
                          ids=id_list,
                          comment="string")
print(response)

PowerShell

Remove-FalconSvExclusion -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sensor_visibility_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"

  response, err := client.SensorVisibilityExclusions.DeleteSensorVisibilityExclusionsV1(
    &sensor_visibility_exclusions.DeleteSensorVisibilityExclusionsV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Comment: &comment,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sensorVisibilityExclusions.deleteSensorVisibilityExclusionsV1(
  ["ID1", "ID2", "ID3"],  // ids
  "string"  // comment
);

console.log(response);

Rust

use rusty_falcon::apis::sensor_visibility_exclusions_api::delete_sensor_visibility_exclusions_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_sensor_visibility_exclusions_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
        Some("string"),  // comment
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SensorVisibilityExclusions.new

response = api.delete_sensor_visibility_exclusions_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

---

---

getSensorVisibilityExclusionsV1

Get a set of Sensor Visibility Exclusions by specifying their IDs

Method GET

Route /policy/entities/sv-exclusions/v1

Scope Sensor Visibility Exclusions: READ

PEP 8 get_exclusions

Parameters

ids query · string or list of strings

The ids of the exclusions to retrieve

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import SensorVisibilityExclusions

falcon = SensorVisibilityExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_exclusions(ids=id_list)
print(response)

Operation ID

from falconpy import SensorVisibilityExclusions

falcon = SensorVisibilityExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getSensorVisibilityExclusionsV1(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getSensorVisibilityExclusionsV1",
                          ids=id_list)
print(response)

PowerShell

Get-FalconSvExclusion -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sensor_visibility_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.SensorVisibilityExclusions.GetSensorVisibilityExclusionsV1(
    &sensor_visibility_exclusions.GetSensorVisibilityExclusionsV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sensorVisibilityExclusions.getSensorVisibilityExclusionsV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::sensor_visibility_exclusions_api::get_sensor_visibility_exclusions_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_sensor_visibility_exclusions_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SensorVisibilityExclusions.new

response = api.get_sensor_visibility_exclusions_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "applied_globally": false,
    "created_by": "string",
    "created_on": "string",
    "groups": [],
    "id": "string",
    "is_descendant_process": false,
    "last_modified": "string",
    "modified_by": "string",
    "regexp_value": "string",
    "value": "string",
    "value_hash": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "applied_globally": false,
      "created_by": "string",
      "created_on": "string",
      "groups": [],
      "id": "string",
      "is_descendant_process": false,
      "last_modified": "string",
      "modified_by": "string",
      "regexp_value": "string",
      "value": "string",
      "value_hash": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "applied_globally": false,
      "created_by": "string",
      "created_on": "string",
      "groups": [],
      "id": "string",
      "is_descendant_process": false,
      "last_modified": "string",
      "modified_by": "string",
      "regexp_value": "string",
      "value": "string",
      "value_hash": "string"
    }
  ]
}

---

---

querySensorVisibilityExclusionsV1

Search for sensor visibility exclusions.

Method GET

Route /policy/queries/sv-exclusions/v1

Scope Sensor Visibility Exclusions: READ

PEP 8 query_exclusions

Parameters

filter query · string

The filter expression that should be used to limit the results. FQL syntax. Available filters:

Available values (6)

applied_globally	created_by	created_on
last_modified	modified_by	value

offset query · integer

The offset to start retrieving records from

limit query · integer

The maximum records to return. [1-500]

sort query · string

The property to sort by. FQL syntax. (e.g. last_behavior|asc) Available sort fields:

Available values (12)

applied_globally.asc	applied_globally.desc	created_by.asc
created_by.desc	created_on.asc	created_on.desc
last_modified.asc	last_modified.desc	modified_by.asc
modified_by.desc	value.asc	value.desc

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import SensorVisibilityExclusions

falcon = SensorVisibilityExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

response = falcon.query_exclusions(filter="string",
                                   limit=integer,
                                   offset=integer,
                                   sort="string")
print(response)

Operation ID

from falconpy import SensorVisibilityExclusions

falcon = SensorVisibilityExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

response = falcon.querySensorVisibilityExclusionsV1(filter="string",
                                                    limit=integer,
                                                    offset=integer,
                                                    sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("querySensorVisibilityExclusionsV1",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

PowerShell

Get-FalconSvExclusion -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sensor_visibility_exclusions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.SensorVisibilityExclusions.QuerySensorVisibilityExclusionsV1(
    &sensor_visibility_exclusions.QuerySensorVisibilityExclusionsV1Params{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sensorVisibilityExclusions.querySensorVisibilityExclusionsV1(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

Rust

use rusty_falcon::apis::sensor_visibility_exclusions_api::query_sensor_visibility_exclusions_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_sensor_visibility_exclusions_v1(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SensorVisibilityExclusions.new

response = api.query_sensor_visibility_exclusions_v1(filter: 'string',
                                                     offset: integer,
                                                     limit: integer,
                                                     sort: 'string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

---

---

updateSensorVisibilityExclusionsV1

Update the sensor visibility exclusions

Method PATCH

Route /policy/entities/sv-exclusions/v1

Scope Sensor Visibility Exclusions: WRITE

PEP 8 update_exclusions

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

comment body · string

String comment describing why the exclusion is entered.

groups body · array

Group IDs to exclude.

id body · string

Exclusion ID to update.

is_descendant_process body · boolean

Flag to determine if an exclusion should apply to all descendant processes.

value body · string

Value to exclude.

Code Examples

Python

PEP 8

from falconpy import SensorVisibilityExclusions

falcon = SensorVisibilityExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_exclusions(comment="string",
                                    groups=id_list,
                                    id="string",
                                    is_descendant_process=boolean,
                                    value="string")
print(response)

Operation ID

from falconpy import SensorVisibilityExclusions

falcon = SensorVisibilityExclusions(client_id=CLIENT_ID,
                                    client_secret=CLIENT_SECRET
                                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.updateSensorVisibilityExclusionsV1(comment="string",
                                                     groups=id_list,
                                                     id="string",
                                                     is_descendant_process=boolean,
                                                     value="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "comment": "string",
    "groups": ["string"],
    "id": "string",
    "is_descendant_process": boolean,
    "value": "string"
}

response = falcon.command("updateSensorVisibilityExclusionsV1", body=body_payload)
print(response)

PowerShell

Edit-FalconSvExclusion -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sensor_visibility_exclusions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  id := "string"
  is_descendant_process := boolean
  value := "string"

  response, err := client.SensorVisibilityExclusions.UpdateSensorVisibilityExclusionsV1(
    &sensor_visibility_exclusions.UpdateSensorVisibilityExclusionsV1Params{
      Body: &models.SvExclusionsUpdateReqV1{
        Comment: &comment,
        Groups: []string{"string"},
        ID: &id,
        IsDescendantProcess: &is_descendant_process,
        Value: &value,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sensorVisibilityExclusions.updateSensorVisibilityExclusionsV1(
  {
    comment: "string",
    groups: [],
    id: "string",
    isDescendantProcess: boolean,
    value: "string"
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::sensor_visibility_exclusions_api::update_sensor_visibility_exclusions_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::SvExclusionsUpdateReqV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = SvExclusionsUpdateReqV1 {
        id: Some("string".to_string()),
        ..Default::default()
    };

    let response = update_sensor_visibility_exclusions_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SensorVisibilityExclusions.new

body = Falcon::SvExclusionsUpdateReqV1.new(
  comment: 'string',
  groups: [],
  id: 'string',
  is_descendant_process: boolean,
  value: 'string'
)

response = api.update_sensor_visibility_exclusions_v1(body)

puts response

Responses

200 OK

[
  {
    "applied_globally": false,
    "created_by": "string",
    "created_on": "string",
    "groups": [],
    "id": "string",
    "is_descendant_process": false,
    "last_modified": "string",
    "modified_by": "string",
    "regexp_value": "string",
    "value": "string",
    "value_hash": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "applied_globally": false,
      "created_by": "string",
      "created_on": "string",
      "groups": [],
      "id": "string",
      "is_descendant_process": false,
      "last_modified": "string",
      "modified_by": "string",
      "regexp_value": "string",
      "value": "string",
      "value_hash": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "applied_globally": false,
      "created_by": "string",
      "created_on": "string",
      "groups": [],
      "id": "string",
      "is_descendant_process": false,
      "last_modified": "string",
      "modified_by": "string",
      "regexp_value": "string",
      "value": "string",
      "value_hash": "string"
    }
  ]
}