Serverless Exports

The Serverless Exports service collection provides operations for managing export jobs for Lambda Security resources. Read export job entities, query available jobs, download export files, retrieve vulnerabilities in SARIF format, and launch new export jobs.

Language	Last Update
Python	v1.6.5
PowerShell
Go	v0.22.0
TypeScript	v0.6.0
Rust
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
DownloadExportFileMixin0 download_export_file	Download an export file
LaunchExportJobMixin0 launch_export_job	Launch an export job of a Lambda Security resource.
QueryExportJobsMixin0 query_export_jobs	Query export jobs entities
ReadExportJobsMixin0 read_export_jobs	Read export jobs entities

---

DownloadExportFileMixin0

Download an export file

Method GET

Route /lambdas/entities/exports/files/v1

Scope Falcon Container Image: READ

PEP 8 download_export_file

Parameters

id query · string

Export job ID.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ServerlessExports

falcon = ServerlessExports(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

with open("output_file", "wb") as save_file:
    response = falcon.download_export_file(id="string", stream=boolean)
    save_file.write(response)

Operation ID

from falconpy import ServerlessExports

falcon = ServerlessExports(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

with open("output_file", "wb") as save_file:
    response = falcon.DownloadExportFileMixin0(id="string", stream=boolean)
    save_file.write(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

with open("output_file", "wb") as save_file:
    response = falcon.command("DownloadExportFileMixin0",
                              id="string")
    save_file.write(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/serverless_exports"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ServerlessExports.DownloadExportFileMixin0(
    &serverless_exports.DownloadExportFileMixin0Params{
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.serverlessExports.downloadExportFileMixin0("string");  // id

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ServerlessExports.new

response = api.download_export_file_mixin0('string')

puts response

Responses

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

LaunchExportJobMixin0

Launch an export job of a Lambda Security resource.

Method POST

Route /lambdas/entities/exports/v1

Scope Falcon Container Image: READ

PEP 8 launch_export_job

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

expand_vulnerabilities body · boolean

When set to true for function vulnerabilities export, includes detailed vulnerability information. Currently returns same data as without expansion - full expansion to be implemented in next step

format body · string

Format of the export file. One of:

Available values (2)

csv

json

fql body · string

Falcon Query Language string to filter documents

resource body · string

Resource to export. Refer to API docs for the possible values

sort body · string

Sort value to apply to documents. Note: not all resources support sorting

Code Examples

Python

PEP 8

from falconpy import ServerlessExports

falcon = ServerlessExports(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.launch_export_job(expand_vulnerabilities=boolean,
                                    format="string",
                                    fql="string",
                                    resource="string",
                                    sort="string")
print(response)

Operation ID

from falconpy import ServerlessExports

falcon = ServerlessExports(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.LaunchExportJobMixin0(expand_vulnerabilities=boolean,
                                        format="string",
                                        fql="string",
                                        resource="string",
                                        sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "expand_vulnerabilities": boolean,
    "format": "string",
    "fql": "string",
    "resource": "string",
    "sort": "string"
}

response = falcon.command("LaunchExportJobMixin0", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/serverless_exports"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  expand_vulnerabilities := boolean
  format := "string"
  fql := "string"
  resource := "string"
  sort := "string"

  response, err := client.ServerlessExports.LaunchExportJobMixin0(
    &serverless_exports.LaunchExportJobMixin0Params{
      Body: &models.ExportsLaunchExportRequest{
        ExpandVulnerabilities: &expand_vulnerabilities,
        Format: &format,
        Fql: &fql,
        Resource: &resource,
        Sort: &sort,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.serverlessExports.launchExportJobMixin0(
  {
    expandVulnerabilities: boolean,
    format: "string",
    fql: "string",
    resource: "string",
    sort: "string"
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ServerlessExports.new

body = Falcon::ExportsLaunchExportRequest.new(
  expand_vulnerabilities: boolean,
  format: 'string',
  fql: 'string',
  resource: 'string',
  sort: 'string'
)

response = api.launch_export_job_mixin0(body)

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

QueryExportJobsMixin0

Query export jobs entities

Method GET

Route /lambdas/queries/exports/v1

Scope Falcon Container Image: READ

PEP 8 query_export_jobs

Parameters

filter query · string

Filter exports using a query in Falcon Query Language (FQL). Only the last 100 jobs are returned. Supported filter fields:

Available values (2)

resource

status

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ServerlessExports

falcon = ServerlessExports(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.query_export_jobs(filter="string")
print(response)

Operation ID

from falconpy import ServerlessExports

falcon = ServerlessExports(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.QueryExportJobsMixin0(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryExportJobsMixin0",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/serverless_exports"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ServerlessExports.QueryExportJobsMixin0(
    &serverless_exports.QueryExportJobsMixin0Params{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.serverlessExports.queryExportJobsMixin0("string");  // filter

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ServerlessExports.new

response = api.query_export_jobs_mixin0(filter: 'string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

ReadExportJobsMixin0

Read export jobs entities

Method GET

Route /lambdas/entities/exports/v1

Scope Falcon Container Image: READ

PEP 8 read_export_jobs

Parameters

ids query · string or list of strings

Export Job IDs to read. Allowed up to 100 IDs per request.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ServerlessExports

falcon = ServerlessExports(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.read_export_jobs(ids=id_list)
print(response)

Operation ID

from falconpy import ServerlessExports

falcon = ServerlessExports(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ReadExportJobsMixin0(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ReadExportJobsMixin0",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/serverless_exports"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ServerlessExports.ReadExportJobsMixin0(
    &serverless_exports.ReadExportJobsMixin0Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.serverlessExports.readExportJobsMixin0(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ServerlessExports.new

response = api.read_export_jobs_mixin0(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "created_at": "string",
    "id": "string",
    "resource": "string",
    "retries": 0,
    "status": "string",
    "updated_at": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}