Spotlight Vulnerabilities

The Spotlight Vulnerabilities service collection provides operations for querying and retrieving vulnerability data across your environment. Search for vulnerabilities using FQL filters, retrieve details on specific vulnerabilities and remediations, and use continuous pagination for large result sets.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

This service collection has code examples posted to the repository.

Operation	Description
combinedQueryVulnerabilities `query_vulnerabilities_combined`	Search for Vulnerabilities in your environment by providing an FQL filter and paging details.
getRemediations `get_remediations`	Get details on remediations by providing one or more IDs
getRemediationsV2 `get_remediations_v2`	Get details on remediation by providing one or more IDs
getVulnerabilities `get_vulnerabilities`	Get details on vulnerabilities by providing one or more IDs
queryVulnerabilities `query_vulnerabilities`	Search for Vulnerabilities in your environment by providing an FQL filter and paging details.

combinedQueryVulnerabilities

Search for Vulnerabilities in your environment by providing an FQL filter and paging details.

Method GET

Route /spotlight/combined/vulnerabilities/v1

Scope Vulnerabilities: READ

PEP 8 query_vulnerabilities_combined

Parameters

after query · string

A pagination token used with the limit parameter to manage pagination of results. On your first request, don’t provide an after token. On subsequent requests, provide the after token from the previous response to continue from that place in the results.

limit query · integer

The number of items to return in this response (default: 100, max: 5000). Use with the after parameter to manage pagination of results.

sort query · string

FQL Syntax formatted sort filter.

filter query · string

Filter items using a query in Falcon Query Language (FQL). Wildcards * and empty filter values are unsupported. Available filter fields:

Available values (24)

`cid`	`last_seen_within`	`status`
`cve.id`	`cve.is_cisa_kev`	`cve.remediation_level`
`cve.cps_rating`	`cve.exprt_rating`	`cve.exploit_status_to_include`
`cve.severity`	`cve.base_score`	`cve.types`
`host_info.asset_criticality`	`host_info.asset_roles`	`host_info.internet_exposure`
`host_info.tags`	`host_info.groups`	`host_info.product_type_desc`
`host_info.platform_name`	`suppression_info.is_suppressed`	`suppression_info.reason`
`closed_timestamp`	`updated_timestamp`	`cve.base_score`

facet query · string or list of strings

Select various details blocks to be returned for each vulnerability entity. Supported values:

Available values (4)

`host_info`	`remediation`	`cve`
`evaluation_logic`

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import SpotlightVulnerabilities

falcon = SpotlightVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.query_vulnerabilities_combined(after="string",
                                                 facet=id_list,
                                                 filter="string",
                                                 limit=integer,
                                                 sort="string")
print(response)

from falconpy import SpotlightVulnerabilities

falcon = SpotlightVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.combinedQueryVulnerabilities(after="string",
                                               facet=id_list,
                                               filter="string",
                                               limit=integer,
                                               sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("combinedQueryVulnerabilities",
                          after="string",
                          limit=integer,
                          sort="string",
                          filter="string",
                          facet=id_list)
print(response)

Get-FalconVulnerability -Filter "string" `
  -Sort "string" `
  -Limit integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/spotlight_vulnerabilities"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  after := "string"
  limit := int64(0)
  sort := "string"

  response, err := client.SpotlightVulnerabilities.CombinedQueryVulnerabilities(
    &spotlight_vulnerabilities.CombinedQueryVulnerabilitiesParams{
      After: &after,
      Limit: &limit,
      Sort: &sort,
      Filter: "string",
      Facet: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.spotlightVulnerabilities.combinedQueryVulnerabilities(
  "string",  // filter
  "string",  // after
  integer,  // limit
  "string",  // sort
  ["ID1", "ID2", "ID3"]  // facet
);

console.log(response);

use rusty_falcon::apis::spotlight_vulnerabilities_api::combined_query_vulnerabilities;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = combined_query_vulnerabilities(
        &falcon.cfg,  // configuration
        "string",  // filter
        Some("string"),  // after
        Some(integer),  // limit
        Some("string"),  // sort
        Some(vec!["string".to_string()]),  // facet
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SpotlightVulnerabilities.new

response = api.combined_query_vulnerabilities('string')

puts response

Responses

[
  {
    "aid": "string",
    "app": {},
    "apps": [],
    "cid": "string",
    "closed_timestamp": "string",
    "confidence": "string",
    "created_timestamp": "string",
    "cve": {},
    "data_providers": [],
    "exploitability": "string",
    "has_exploitability_prerequisites": "string",
    "host_info": {},
    "id": "string",
    "remediation": {},
    "risk_score": 0.0,
    "services": [],
    "status": "string",
    "suppression_info": {},
    "updated_timestamp": "string",
    "vulnerability_id": "string",
    "vulnerability_metadata_id": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "after": "string",
      "limit": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "quota": {
      "total": 0,
      "used": 0
    },
    "trace_id": "string"
  },
  "resources": [
    {
      "aid": "string",
      "app": {},
      "apps": [],
      "cid": "string",
      "closed_timestamp": "string",
      "confidence": "string",
      "created_timestamp": "string",
      "cve": {},
      "data_providers": [],
      "exploitability": "string",
      "has_exploitability_prerequisites": "string",
      "host_info": {},
      "id": "string",
      "remediation": {},
      "risk_score": 0.0,
      "services": [],
      "status": "string",
      "suppression_info": {},
      "updated_timestamp": "string",
      "vulnerability_id": "string",
      "vulnerability_metadata_id": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "after": "string",
      "limit": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "quota": {
      "total": 0,
      "used": 0
    },
    "trace_id": "string"
  },
  "resources": [
    {
      "aid": "string",
      "app": {},
      "apps": [],
      "cid": "string",
      "closed_timestamp": "string",
      "confidence": "string",
      "created_timestamp": "string",
      "cve": {},
      "data_providers": [],
      "exploitability": "string",
      "has_exploitability_prerequisites": "string",
      "host_info": {},
      "id": "string",
      "remediation": {},
      "risk_score": 0.0,
      "services": [],
      "status": "string",
      "suppression_info": {},
      "updated_timestamp": "string",
      "vulnerability_id": "string",
      "vulnerability_metadata_id": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "after": "string",
      "limit": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "quota": {
      "total": 0,
      "used": 0
    },
    "trace_id": "string"
  },
  "resources": [
    {
      "aid": "string",
      "app": {},
      "apps": [],
      "cid": "string",
      "closed_timestamp": "string",
      "confidence": "string",
      "created_timestamp": "string",
      "cve": {},
      "data_providers": [],
      "exploitability": "string",
      "has_exploitability_prerequisites": "string",
      "host_info": {},
      "id": "string",
      "remediation": {},
      "risk_score": 0.0,
      "services": [],
      "status": "string",
      "suppression_info": {},
      "updated_timestamp": "string",
      "vulnerability_id": "string",
      "vulnerability_metadata_id": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "after": "string",
      "limit": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "quota": {
      "total": 0,
      "used": 0
    },
    "trace_id": "string"
  },
  "resources": [
    {
      "aid": "string",
      "app": {},
      "apps": [],
      "cid": "string",
      "closed_timestamp": "string",
      "confidence": "string",
      "created_timestamp": "string",
      "cve": {},
      "data_providers": [],
      "exploitability": "string",
      "has_exploitability_prerequisites": "string",
      "host_info": {},
      "id": "string",
      "remediation": {},
      "risk_score": 0.0,
      "services": [],
      "status": "string",
      "suppression_info": {},
      "updated_timestamp": "string",
      "vulnerability_id": "string",
      "vulnerability_metadata_id": "string"
    }
  ]
}

getRemediations

Get details on remediations by providing one or more IDs

Method GET

Route /spotlight/entities/remediations/v2

Scope Vulnerabilities: READ

PEP 8 get_remediations

Parameters

ids query · string or list of strings

One or more remediation IDs (max: 400).

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import SpotlightVulnerabilities

falcon = SpotlightVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_remediations(ids=id_list)
print(response)

from falconpy import SpotlightVulnerabilities

falcon = SpotlightVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getRemediations(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getRemediations",
                          ids=id_list)
print(response)

Get-FalconRemediation

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/spotlight_vulnerabilities"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.SpotlightVulnerabilities.GetRemediationsV2(
    &spotlight_vulnerabilities.GetRemediationsV2Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.spotlightVulnerabilities.getRemediationsV2(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::spotlight_vulnerabilities_api::get_remediations_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_remediations_v2(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SpotlightVulnerabilities.new

response = api.get_remediations_v2(['ID1', 'ID2', 'ID3'])

puts response

getRemediationsV2

Get details on remediation by providing one or more IDs

Method GET

Route /spotlight/entities/remediations/v2

Scope Vulnerabilities: READ

PEP 8 get_remediations_v2

Parameters

ids query · string or list of strings

One or more remediation IDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import SpotlightVulnerabilities

falcon = SpotlightVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_remediations_v2(ids=id_list)
print(response)

from falconpy import SpotlightVulnerabilities

falcon = SpotlightVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getRemediationsV2(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getRemediationsV2",
                          ids=id_list)
print(response)

Get-FalconRemediation

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/spotlight_vulnerabilities"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.SpotlightVulnerabilities.GetRemediationsV2(
    &spotlight_vulnerabilities.GetRemediationsV2Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.spotlightVulnerabilities.getRemediationsV2(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::spotlight_vulnerabilities_api::get_remediations_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_remediations_v2(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SpotlightVulnerabilities.new

response = api.get_remediations_v2(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "action": "string",
    "created_timestamp": "string",
    "id": "string",
    "link": "string",
    "patch_publication_date": "string",
    "provider": "string",
    "recommendation_type": "string",
    "reference": "string",
    "title": "string",
    "type": "string",
    "updated_timestamp": "string",
    "vendor_url": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "action": "string",
      "created_timestamp": "string",
      "id": "string",
      "link": "string",
      "patch_publication_date": "string",
      "provider": "string",
      "recommendation_type": "string",
      "reference": "string",
      "title": "string",
      "type": "string",
      "updated_timestamp": "string",
      "vendor_url": "string"
    }
  ]
}

getVulnerabilities

Get details on vulnerabilities by providing one or more IDs

Method GET

Route /spotlight/entities/vulnerabilities/v2

Scope Vulnerabilities: READ

PEP 8 get_vulnerabilities

Parameters

ids query · string or list of strings

One or more vulnerability IDs (max: 400). Find vulnerability IDs with GET /spotlight/queries/vulnerabilities/v1

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import SpotlightVulnerabilities

falcon = SpotlightVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_vulnerabilities(ids=id_list)
print(response)

from falconpy import SpotlightVulnerabilities

falcon = SpotlightVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getVulnerabilities(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getVulnerabilities",
                          ids=id_list)
print(response)

Get-FalconVulnerability -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/spotlight_vulnerabilities"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.SpotlightVulnerabilities.GetVulnerabilities(
    &spotlight_vulnerabilities.GetVulnerabilitiesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.spotlightVulnerabilities.getVulnerabilities(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::intel_api::get_vulnerabilities;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaIdsRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaIdsRequest {
        ..Default::default()
    };

    let response = get_vulnerabilities(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SpotlightVulnerabilities.new

response = api.get_vulnerabilities(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "aid": "string",
    "app": {},
    "apps": [],
    "cid": "string",
    "closed_timestamp": "string",
    "confidence": "string",
    "created_timestamp": "string",
    "cve": {},
    "data_providers": [],
    "exploitability": "string",
    "has_exploitability_prerequisites": "string",
    "host_info": {},
    "id": "string",
    "network_scan": [],
    "remediation": {},
    "risk_score": 0.0,
    "services": [],
    "status": "string",
    "suppression_info": {},
    "updated_timestamp": "string",
    "vulnerability_id": "string",
    "vulnerability_metadata_id": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "quota": {
      "total": 0,
      "used": 0
    },
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "aid": "string",
      "app": {},
      "apps": [],
      "cid": "string",
      "closed_timestamp": "string",
      "confidence": "string",
      "created_timestamp": "string",
      "cve": {},
      "data_providers": [],
      "exploitability": "string",
      "has_exploitability_prerequisites": "string",
      "host_info": {},
      "id": "string",
      "network_scan": [],
      "remediation": {},
      "risk_score": 0.0,
      "services": [],
      "status": "string",
      "suppression_info": {},
      "updated_timestamp": "string",
      "vulnerability_id": "string",
      "vulnerability_metadata_id": "string"
    }
  ]
}

queryVulnerabilities

Search for Vulnerabilities in your environment by providing an FQL filter and paging details.

Method GET

Route /spotlight/queries/vulnerabilities/v1

Scope Vulnerabilities: READ

PEP 8 query_vulnerabilities

Parameters

after query · string

limit query · integer

The number of items to return in this response (default: 100, max: 400). Use with the after parameter to manage pagination of results.

sort query · string

Sort vulnerabilities by their properties.

filter query · string

Filter items using a query in Falcon Query Language (FQL). Wildcards * and empty filter values are unsupported. Available filter fields:

Available values (24)

`cid`	`last_seen_within`	`status`
`cve.id`	`cve.is_cisa_kev`	`cve.remediation_level`
`cve.cps_rating`	`cve.exprt_rating`	`cve.exploit_status_to_include`
`cve.severity`	`cve.base_score`	`cve.types`
`host_info.asset_criticality`	`host_info.asset_roles`	`host_info.internet_exposure`
`host_info.tags`	`host_info.groups`	`host_info.product_type_desc`
`host_info.platform_name`	`suppression_info.is_suppressed`	`suppression_info.reason`
`closed_timestamp`	`updated_timestamp`	`cve.base_score`

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import SpotlightVulnerabilities

falcon = SpotlightVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.query_vulnerabilities(after="string",
                                        filter="string",
                                        limit=integer,
                                        sort="string")
print(response)

from falconpy import SpotlightVulnerabilities

falcon = SpotlightVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.queryVulnerabilities(after="string",
                                       filter="string",
                                       limit=integer,
                                       sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryVulnerabilities",
                          after="string",
                          limit=integer,
                          sort="string",
                          filter="string")
print(response)

Get-FalconVulnerability -Filter "string" `
  -Sort "string" `
  -Limit integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/spotlight_vulnerabilities"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  after := "string"
  limit := int64(0)
  sort := "string"

  response, err := client.SpotlightVulnerabilities.QueryVulnerabilities(
    &spotlight_vulnerabilities.QueryVulnerabilitiesParams{
      After: &after,
      Limit: &limit,
      Sort: &sort,
      Filter: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.spotlightVulnerabilities.queryVulnerabilities(
  "string",  // filter
  "string",  // after
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::intel_api::query_vulnerabilities;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_vulnerabilities(
        &falcon.cfg,  // configuration
        Some("string"),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
        Some("string"),  // q
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SpotlightVulnerabilities.new

response = api.query_vulnerabilities('string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "after": "string",
      "limit": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "quota": {
      "total": 0,
      "used": 0
    },
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "after": "string",
      "limit": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "quota": {
      "total": 0,
      "used": 0
    },
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "after": "string",
      "limit": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "quota": {
      "total": 0,
      "used": 0
    },
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "after": "string",
      "limit": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "quota": {
      "total": 0,
      "used": 0
    },
    "trace_id": "string"
  },
  "resources": [
    "string"
  ]
}

Spotlight Vulnerabilities

Table of Contents

combinedQueryVulnerabilities

Parameters

getRemediations

Parameters

getRemediationsV2

Parameters

getVulnerabilities

Parameters

queryVulnerabilities

Parameters