Tailored Intelligence

The Tailored Intelligence service collection provides operations for accessing events and rules data. Retrieve event body content, fetch event and rule entities by ID, and query events or rules using FQL-formatted filter criteria.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
GetEventsBody get_event_body	Get event body for the provided event ID
GetEventsEntities get_event_entities	Get events entities for specified ids.
GetRulesEntities get_rule_entities	Get rules entities for specified ids.
QueryEvents query_events	Get events ids that match the provided filter criteria.
QueryRules query_rules	Get rules ids that match the provided filter criteria.

---

GetEventsBody

Get event body for the provided event ID

Method GET

Route /ti/events/entities/events-full-body/v2

Scope Tailored Intelligence: READ

PEP 8 get_event_body

Parameters

id query · string

Return the event body for event id.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Authorization body · string

Bearer Token.

Code Examples

Python

PEP 8

from falconpy import TailoredIntelligence

falcon = TailoredIntelligence(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

with open("output_file", "wb") as save_file:
    response = falcon.get_event_body(id="string",
                                     Authorization="string",
                                     stream=boolean)
    save_file.write(response)

Operation ID

from falconpy import TailoredIntelligence

falcon = TailoredIntelligence(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

with open("output_file", "wb") as save_file:
    response = falcon.GetEventsBody(id="string",
                                    Authorization="string",
                                    stream=boolean)
    save_file.write(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

with open("output_file", "wb") as save_file:
    response = falcon.command("GetEventsBody",
                              id="string")
    save_file.write(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/tailored_intelligence"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.TailoredIntelligence.GetEventsBody(
    &tailored_intelligence.GetEventsBodyParams{
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.tailoredIntelligence.getEventsBody(
  "string",  // id
  "string"  // authorization
);

console.log(response);

Rust

use rusty_falcon::apis::tailored_intelligence_api::get_events_body;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_events_body(
        &falcon.cfg,  // configuration
        "string",  // id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::TailoredIntelligence.new

response = api.get_events_body('string')

puts response

Responses

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

GetEventsEntities

Get events entities for specified ids.

Method POST

Route /ti/events/entities/events/GET/v2

Scope Tailored Intelligence: READ

PEP 8 get_event_entities

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

ids body · array

Event ID to retrieve.

Authorization body · string

Bearer Token.

Code Examples

Python

PEP 8

from falconpy import TailoredIntelligence

falcon = TailoredIntelligence(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_event_entities(ids=id_list, Authorization="string")
print(response)

Operation ID

from falconpy import TailoredIntelligence

falcon = TailoredIntelligence(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetEventsEntities(ids=id_list, Authorization="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "ids": ["string"]
}

response = falcon.command("GetEventsEntities", body=body_payload)
print(response)

PowerShell

Get-FalconTailoredEvent -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/tailored_intelligence"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.TailoredIntelligence.GetEventsEntities(
    &tailored_intelligence.GetEventsEntitiesParams{
      Body: &models.MsaIdsRequest{
        Ids: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.tailoredIntelligence.getEventsEntities(
  {  // body
      ids: []
  },
  "string"  // authorization
);

console.log(response);

Rust

use rusty_falcon::apis::tailored_intelligence_api::get_events_entities;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaIdsRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaIdsRequest {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = get_events_entities(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::TailoredIntelligence.new

body = Falcon::MsaIdsRequest.new(
  ids: []
)

response = api.get_events_entities(body)

puts response

Responses

200 OK

[
  {
    "body": "string",
    "body_is_truncated": false,
    "body_link": "string",
    "botnet_config_source": {},
    "created_date": "string",
    "ddos_attack_source": {},
    "event_type": "string",
    "fingerprint": "string",
    "id": "string",
    "matched_rules": [],
    "pastebin_text_source": {},
    "tags": [],
    "tweet_source": {},
    "updated_date": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "body": "string",
      "body_is_truncated": false,
      "body_link": "string",
      "botnet_config_source": {},
      "created_date": "string",
      "ddos_attack_source": {},
      "event_type": "string",
      "fingerprint": "string",
      "id": "string",
      "matched_rules": [],
      "pastebin_text_source": {},
      "tags": [],
      "tweet_source": {},
      "updated_date": "string"
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "body": "string",
      "body_is_truncated": false,
      "body_link": "string",
      "botnet_config_source": {},
      "created_date": "string",
      "ddos_attack_source": {},
      "event_type": "string",
      "fingerprint": "string",
      "id": "string",
      "matched_rules": [],
      "pastebin_text_source": {},
      "tags": [],
      "tweet_source": {},
      "updated_date": "string"
    }
  ]
}

---

---

GetRulesEntities

Get rules entities for specified ids.

Method POST

Route /ti/rules/entities/rules/GET/v2

Scope Tailored Intelligence: READ

PEP 8 get_rule_entities

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

ids body · array

Rule ID to retrieve.

Authorization body · string

Bearer Token.

Code Examples

Python

PEP 8

from falconpy import TailoredIntelligence

falcon = TailoredIntelligence(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rule_entities(ids=id_list, Authorization="string")
print(response)

Operation ID

from falconpy import TailoredIntelligence

falcon = TailoredIntelligence(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetRulesEntities(ids=id_list, Authorization="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "ids": ["string"]
}

response = falcon.command("GetRulesEntities", body=body_payload)
print(response)

PowerShell

Get-FalconTailoredRule -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/tailored_intelligence"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.TailoredIntelligence.GetRulesEntities(
    &tailored_intelligence.GetRulesEntitiesParams{
      Body: &models.MsaIdsRequest{
        Ids: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.tailoredIntelligence.getRulesEntities(
  {  // body
      ids: []
  },
  "string"  // authorization
);

console.log(response);

Rust

use rusty_falcon::apis::tailored_intelligence_api::get_rules_entities;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaIdsRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaIdsRequest {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = get_rules_entities(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::TailoredIntelligence.new

body = Falcon::MsaIdsRequest.new(
  ids: []
)

response = api.get_rules_entities(body)

puts response

Responses

200 OK

[
  {
    "created_date": 0,
    "description": "string",
    "id": 0,
    "last_modified_date": 0,
    "name": "string",
    "rich_text_description": "string",
    "short_description": "string",
    "tags": [],
    "type": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "created_date": 0,
      "description": "string",
      "id": 0,
      "last_modified_date": 0,
      "name": "string",
      "rich_text_description": "string",
      "short_description": "string",
      "tags": [],
      "type": "string"
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "created_date": 0,
      "description": "string",
      "id": 0,
      "last_modified_date": 0,
      "name": "string",
      "rich_text_description": "string",
      "short_description": "string",
      "tags": [],
      "type": "string"
    }
  ]
}

---

---

QueryEvents

Get events ids that match the provided filter criteria.

Method GET

Route /ti/events/queries/events/v2

Scope Tailored Intelligence: READ

PEP 8 query_events

Parameters

offset query · string

Starting index of overall result set from which to return ids.

limit query · integer

Number of ids to return.

sort query · string

Possible order by fields:

Available values (3)

source_type

created_date

updated_date

filter query · string

FQL query specifying the filter parameters. Wildcard character ’*’ means to not filter on anything.

q query · string

Match phrase_prefix query criteria; included fields: _all (all filter string fields indexed).

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Authorization body · string

Bearer Token.

Code Examples

Python

PEP 8

from falconpy import TailoredIntelligence

falcon = TailoredIntelligence(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.query_events(filter="string",
                               limit=integer,
                               offset="string",
                               Authorization="string",
                               q="string",
                               sort="string")
print(response)

Operation ID

from falconpy import TailoredIntelligence

falcon = TailoredIntelligence(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.QueryEvents(filter="string",
                              limit=integer,
                              offset="string",
                              Authorization="string",
                              q="string",
                              sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryEvents",
                          offset="string",
                          limit=integer,
                          sort="string",
                          filter="string",
                          q="string")
print(response)

PowerShell

Get-FalconTailoredEvent -Filter "string" `
  -Query "string" `
  -Sort "string" `
  -Limit integer `
  -Offset "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/tailored_intelligence"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := "string"
  limit := int64(0)
  sort := "string"
  filter := "string"
  q := "string"

  response, err := client.TailoredIntelligence.QueryEvents(
    &tailored_intelligence.QueryEventsParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Q: &q,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.tailoredIntelligence.queryEvents(
  "string",  // authorization
  "string",  // offset
  integer,  // limit
  "string",  // sort
  "string",  // filter
  "string"  // q
);

console.log(response);

Rust

use rusty_falcon::apis::tailored_intelligence_api::query_events;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_events(
        &falcon.cfg,  // configuration
        Some("string"),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
        Some("string"),  // q
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::TailoredIntelligence.new

response = api.query_events(offset: 'string',
                            limit: integer,
                            sort: 'string',
                            filter: 'string',
                            q: 'string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

---

---

QueryRules

Get rules ids that match the provided filter criteria.

Method GET

Route /ti/rules/queries/rules/v2

Scope Tailored Intelligence: READ

PEP 8 query_rules

Parameters

offset query · string

Starting index of overall result set from which to return ids.

limit query · integer

Number of ids to return.

sort query · string

Possible order by fields:

Available values (6)

name	value	rule_type
customer_id	created_date	updated_date

filter query · string

FQL query specifying the filter parameters. Wildcard character ’*’ means to not filter on anything.

q query · string

Match phrase_prefix query criteria; included fields: _all (all filter string fields indexed).

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Authorization body · string

Bearer Token.

Code Examples

Python

PEP 8

from falconpy import TailoredIntelligence

falcon = TailoredIntelligence(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.query_rules(filter="string",
                              limit=integer,
                              offset="string",
                              Authorization="string",
                              q="string",
                              sort="string")
print(response)

Operation ID

from falconpy import TailoredIntelligence

falcon = TailoredIntelligence(client_id=CLIENT_ID,
                              client_secret=CLIENT_SECRET
                              )

response = falcon.QueryRules(filter="string",
                             limit=integer,
                             offset="string",
                             Authorization="string",
                             q="string",
                             sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryRules",
                          offset="string",
                          limit=integer,
                          sort="string",
                          filter="string",
                          q="string")
print(response)

PowerShell

Get-FalconTailoredRule -Filter "string" `
  -Query "string" `
  -Sort "string" `
  -Limit integer `
  -Offset "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/tailored_intelligence"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := "string"
  limit := int64(0)
  sort := "string"
  filter := "string"
  q := "string"

  response, err := client.TailoredIntelligence.QueryRules(
    &tailored_intelligence.QueryRulesParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Q: &q,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.tailoredIntelligence.queryRules(
  "string",  // authorization
  "string",  // offset
  integer,  // limit
  "string",  // sort
  "string",  // filter
  "string"  // q
);

console.log(response);

Rust

use rusty_falcon::apis::tailored_intelligence_api::query_rules;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_rules(
        &falcon.cfg,  // configuration
        Some("string"),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
        Some("string"),  // q
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::TailoredIntelligence.new

response = api.query_rules(offset: 'string',
                           limit: integer,
                           sort: 'string',
                           filter: 'string',
                           q: 'string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}