ThreatGraph

The ThreatGraph service collection provides operations for exploring threat intelligence relationships. Retrieve edges and vertex summaries for threat entities, look up indicators observed on devices in your environment, and explore available edge types.

Language	Last Update
Python	v1.4.6
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

Table of Contents

Operation	Description
combined_edges_get get_edges	Retrieve edges for a given vertex id. One edge type must be specified.
combined_ran_on_get get_ran_on	Look up instances of indicators such as hashes, domain names, and ip addresses that have been seen on devices in your environment.
combined_summary_get get_summary	Retrieve summary for a given vertex ID.
entities_vertices_get get_vertices_v1	Retrieve metadata for a given vertex ID.
entities_vertices_getv2 get_vertices	Retrieve metadata for a given vertex ID.
queries_edgetypes_get get_edge_types	Show all available edge types.

---

combined_edges_get

Retrieve edges for a given vertex id. One edge type must be specified.

GET /threatgraph/combined/edges/v1

Scope ThreatGraph: READ Consumes · Produces application/json

PEP 8 get_edges

Parameters

Name	Type	Data type	Description
ids	query	string	Vertex ID to get details for. Only one value is supported.
limit	query	integer	How many edges to return in a single request [1-100].
offset	query	string	The offset to use to retrieve the next page of results.
edge_type	query	string	The type of edges that you would like to retrieve.
direction	query	string	The direction of edges that you would like to retrieve.
scope	query	string	Scope of the request.
nano	query	boolean	Return nano-precision entity timestamps.

Code Examples

Python

PEP 8

from falconpy import ThreatGraph

falcon = ThreatGraph(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_edges(direction="string",
                            edge_type="string",
                            ids=id_list,
                            limit=integer,
                            nano=boolean,
                            offset=integer,
                            scope="string")
print(response)

Operation ID

from falconpy import ThreatGraph

falcon = ThreatGraph(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.combined_edges_get(direction="string",
                                     edge_type="string",
                                     ids=id_list,
                                     limit=integer,
                                     nano=boolean,
                                     offset=integer,
                                     scope="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("combined_edges_get",
                          ids="string",
                          limit=integer,
                          offset="string",
                          edge_type="string",
                          direction="string",
                          scope="string",
                          nano=boolean)
print(response)

PowerShell

Get-FalconThreatGraphEdge -Id "string" `
  -EdgeType "string" `
  -Limit integer `
  -Offset "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/threatgraph"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := "string"
  direction := "string"
  scope := "string"
  nano := boolean

  response, err := client.Threatgraph.CombinedEdgesGet(
    &threatgraph.CombinedEdgesGetParams{
      Ids: "string",
      Limit: &limit,
      Offset: &offset,
      EdgeType: "string",
      Direction: &direction,
      Scope: &scope,
      Nano: &nano,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.threatgraph.combinedEdgesGet(
  "string",  // ids
  "string",  // edgeType
  integer,  // limit
  "string",  // offset
  "string",  // direction
  "string",  // scope
  boolean  // nano
);

console.log(response);

Rust

use rusty_falcon::apis::threatgraph_api::combined_edges_get;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = combined_edges_get(
        &falcon.cfg,  // configuration
        "string",  // ids
        "string",  // edge_type
        Some(integer),  // limit
        Some("string"),  // offset
        Some("string"),  // direction
        Some("string"),  // scope
        Some(boolean),  // nano
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Threatgraph.new

response = api.combined_edges_get('string', 'string')

puts response

---

combined_ran_on_get

Look up instances of indicators such as hashes, domain names, and ip addresses that have been seen on devices in your environment.

GET /threatgraph/combined/ran-on/v1

Scope ThreatGraph: READ Consumes · Produces application/json

PEP 8 get_ran_on

Parameters

Name	Type	Data type	Description
value	query	string	The value of the indicator to search by.
type	query	string	The type of indicator that you would like to retrieve.
limit	query	integer	How many edges to return in a single request [1-100].
offset	query	string	The offset to use to retrieve the next page of results.
nano	query	boolean	Return nano-precision entity timestamps.

Code Examples

Python

PEP 8

from falconpy import ThreatGraph

falcon = ThreatGraph(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.get_ran_on(limit=integer,
                             nano=boolean,
                             offset=integer,
                             type="string",
                             value="string")
print(response)

Operation ID

from falconpy import ThreatGraph

falcon = ThreatGraph(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.combined_ran_on_get(limit=integer,
                                      nano=boolean,
                                      offset=integer,
                                      type="string",
                                      value="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("combined_ran_on_get",
                          value="string",
                          type="string",
                          limit=integer,
                          offset="string",
                          nano=boolean)
print(response)

PowerShell

Get-FalconThreatGraphIndicator -Type "string" `
  -Value "string" `
  -Limit integer `
  -Offset "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/threatgraph"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := "string"
  nano := boolean

  response, err := client.Threatgraph.CombinedRanOnGet(
    &threatgraph.CombinedRanOnGetParams{
      Value: "string",
      Type: "string",
      Limit: &limit,
      Offset: &offset,
      Nano: &nano,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.threatgraph.combinedRanOnGet(
  "string",  // value
  "string",  // type
  integer,  // limit
  "string",  // offset
  boolean  // nano
);

console.log(response);

Rust

use rusty_falcon::apis::threatgraph_api::combined_ran_on_get;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = combined_ran_on_get(
        &falcon.cfg,  // configuration
        "string",  // value
        Some(integer),  // limit
        Some("string"),  // offset
        Some(boolean),  // nano
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Threatgraph.new

response = api.combined_ran_on_get('string', 'string')

puts response

---

combined_summary_get

Retrieve summary for a given vertex ID.

GET /threatgraph/combined/{vertex-type}/summary/v1

Scope ThreatGraph: READ Consumes · Produces application/json

PEP 8 get_summary

Parameters

Name	Type	Data type	Description
vertex_type	path	string	Type of vertex to get properties for. Available values: accessory, accessories, actor, ad_computer, ad-computers, adfs_application, adfs-applications, ad_group, ad-groups, aggregate_indicator, aggregate-indicators, sensor, devices, mobile_app, mobile-apps, azure_application, azure-applications, azure_ad_user, azure-ad-users, containerized_app, containerized-apps, certificate, certificates, command_line, command-lines, control_graph, control-graphs, detection, detections, domain, domains, extracted_file, extracted-files, firmware, firmwares, mobile_fs_volume, mobile-fs-volumes, firewall, firewalls, firewall_rule_match, firewall_rule_matches, host_name, host-names, detection_index, detection-indices, idp_indicator, idp-indicators, idp_session, idp-sessions, incident, incidents, indicator, indicators, custom_ioa, custom_ioas, ipv4, ipv6, k8s_cluster, k8s_clusters, legacy_detection, legacy-detections, mobile_os_forensics_report, mobile_os_forensics_reports, mobile_indicator, mobile-indicators, module, modules, macro_script, macro_scripts, okta_application, okta-applications, okta_user, okta-users, process, processes, ping_fed_application, ping-fed-applications, quarantined_file, quarantined-files, script, scripts, shield, shields, sensor_self_diagnostic, sensor-self-diagnostics, kerberos_ticket, kerberos-tickets, user_id, users, user_session, user-sessions, wifi_access_point, wifi-access-points, xdr, any-vertex.
ids	query	array (string)	Vertex ID to get details for.
scope	query	string	Scope of the request.
nano	query	boolean	Return nano-precision entity timestamps.

Code Examples

Python

PEP 8

from falconpy import ThreatGraph

falcon = ThreatGraph(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_summary(ids=id_list,
                              scope="string",
                              nano=boolean,
                              vertex_type="string")
print(response)

Operation ID

from falconpy import ThreatGraph

falcon = ThreatGraph(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.combined_summary_get(ids=id_list,
                                       scope="string",
                                       nano=boolean,
                                       vertex_type="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("combined_summary_get",
                          vertex_type="string",
                          ids=id_list,
                          scope="string",
                          nano=boolean)
print(response)

PowerShell

Get-FalconThreatGraphVertex -Id @("ID1", "ID2") -IncludeEdge $boolean

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/threatgraph"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  scope := "string"
  nano := boolean

  response, err := client.Threatgraph.CombinedSummaryGet(
    &threatgraph.CombinedSummaryGetParams{
      VertexType: "string",
      Ids: []string{"ID1", "ID2", "ID3"},
      Scope: &scope,
      Nano: &nano,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.threatgraph.combinedSummaryGet(
  "string",  // vertexType
  ["ID1", "ID2", "ID3"],  // ids
  "string",  // scope
  boolean  // nano
);

console.log(response);

Rust

use rusty_falcon::apis::threatgraph_api::combined_summary_get;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = combined_summary_get(
        &falcon.cfg,  // configuration
        "string",  // vertex_type
        vec!["string".to_string()],  // ids
        Some("string"),  // scope
        Some(boolean),  // nano
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Threatgraph.new

response = api.combined_summary_get('string', ['ID1', 'ID2', 'ID3'])

puts response

---

entities_vertices_get

Retrieve metadata for a given vertex ID.

GET /threatgraph/entities/{vertex-type}/v1

Scope ThreatGraph: READ Consumes · Produces application/json

PEP 8 get_vertices_v1

Parameters

Name	Type	Data type	Description
vertex_type	path	string	Type of vertex to get properties for. Available values: accessory, accessories, actor, ad_computer, ad-computers, adfs_application, adfs-applications, ad_group, ad-groups, aggregate_indicator, aggregate-indicators, sensor, devices, mobile_app, mobile-apps, azure_application, azure-applications, azure_ad_user, azure-ad-users, containerized_app, containerized-apps, certificate, certificates, command_line, command-lines, control_graph, control-graphs, detection, detections, domain, domains, extracted_file, extracted-files, firmware, firmwares, mobile_fs_volume, mobile-fs-volumes, firewall, firewalls, firewall_rule_match, firewall_rule_matches, host_name, host-names, detection_index, detection-indices, idp_indicator, idp-indicators, idp_session, idp-sessions, incident, incidents, indicator, indicators, custom_ioa, custom_ioas, ipv4, ipv6, k8s_cluster, k8s_clusters, legacy_detection, legacy-detections, mobile_os_forensics_report, mobile_os_forensics_reports, mobile_indicator, mobile-indicators, module, modules, macro_script, macro_scripts, okta_application, okta-applications, okta_user, okta-users, process, processes, ping_fed_application, ping-fed-applications, quarantined_file, quarantined-files, script, scripts, shield, shields, sensor_self_diagnostic, sensor-self-diagnostics, kerberos_ticket, kerberos-tickets, user_id, users, user_session, user-sessions, wifi_access_point, wifi-access-points, xdr, any-vertex.
ids	query	array (string)	Vertex ID to get details for.
scope	query	string	Scope of the request.
nano	query	boolean	Return nano-precision entity timestamps.

Code Examples

Python

PEP 8

from falconpy import ThreatGraph

falcon = ThreatGraph(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_vertices_v1(ids=id_list,
                                  scope="string",
                                  nano=boolean,
                                  vertex_type="string")
print(response)

Operation ID

from falconpy import ThreatGraph

falcon = ThreatGraph(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_vertices_get(ids=id_list,
                                        scope="string",
                                        nano=boolean,
                                        vertex_type="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_vertices_get",
                          vertex_type="string",
                          ids=id_list,
                          scope="string",
                          nano=boolean)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/threatgraph"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  scope := "string"
  nano := boolean

  response, err := client.Threatgraph.EntitiesVerticesGet(
    &threatgraph.EntitiesVerticesGetParams{
      VertexType: "string",
      Ids: []string{"ID1", "ID2", "ID3"},
      Scope: &scope,
      Nano: &nano,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.threatgraph.entitiesVerticesGet(
  "string",  // vertexType
  ["ID1", "ID2", "ID3"],  // ids
  "string",  // scope
  boolean  // nano
);

console.log(response);

Rust

use rusty_falcon::apis::threatgraph_api::entities_vertices_get;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = entities_vertices_get(
        &falcon.cfg,  // configuration
        "string",  // vertex_type
        vec!["string".to_string()],  // ids
        Some("string"),  // scope
        Some(boolean),  // nano
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Threatgraph.new

response = api.entities_vertices_get('string', ['ID1', 'ID2', 'ID3'])

puts response

---

entities_vertices_getv2

Retrieve metadata for a given vertex ID.

GET /threatgraph/entities/{vertex-type}/v2

Scope ThreatGraph: READ Consumes · Produces application/json

PEP 8 get_vertices

Parameters

Name	Type	Data type	Description
vertex_type	path	string	Type of vertex to get properties for. Available values: accessory, accessories, actor, ad_computer, ad-computers, adfs_application, adfs-applications, ad_group, ad-groups, aggregate_indicator, aggregate-indicators, sensor, devices, mobile_app, mobile-apps, azure_application, azure-applications, azure_ad_user, azure-ad-users, containerized_app, containerized-apps, certificate, certificates, command_line, command-lines, control_graph, control-graphs, detection, detections, domain, domains, extracted_file, extracted-files, firmware, firmwares, mobile_fs_volume, mobile-fs-volumes, firewall, firewalls, firewall_rule_match, firewall_rule_matches, host_name, host-names, detection_index, detection-indices, idp_indicator, idp-indicators, idp_session, idp-sessions, incident, incidents, indicator, indicators, custom_ioa, custom_ioas, ipv4, ipv6, k8s_cluster, k8s_clusters, legacy_detection, legacy-detections, mobile_os_forensics_report, mobile_os_forensics_reports, mobile_indicator, mobile-indicators, module, modules, macro_script, macro_scripts, okta_application, okta-applications, okta_user, okta-users, process, processes, ping_fed_application, ping-fed-applications, quarantined_file, quarantined-files, script, scripts, shield, shields, sensor_self_diagnostic, sensor-self-diagnostics, kerberos_ticket, kerberos-tickets, user_id, users, user_session, user-sessions, wifi_access_point, wifi-access-points, xdr, any-vertex.
ids	query	array (string)	Vertex ID to get details for.
scope	query	string	Scope of the request.
nano	query	boolean	Return nano-precision entity timestamps.

Code Examples

Python

PEP 8

from falconpy import ThreatGraph

falcon = ThreatGraph(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_vertices(ids=id_list,
                               scope="string",
                               nano=boolean,
                               vertex_type="string")
print(response)

Operation ID

from falconpy import ThreatGraph

falcon = ThreatGraph(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_vertices_getv2(ids=id_list,
                                          scope="string",
                                          nano=boolean,
                                          vertex_type="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_vertices_getv2",
                          vertex_type="string",
                          ids=id_list,
                          scope="string",
                          nano=boolean)
print(response)

PowerShell

Get-FalconThreatGraphVertex -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/threatgraph"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  scope := "string"
  nano := boolean

  response, err := client.Threatgraph.EntitiesVerticesGetv2(
    &threatgraph.EntitiesVerticesGetv2Params{
      VertexType: "string",
      Ids: []string{"ID1", "ID2", "ID3"},
      Scope: &scope,
      Nano: &nano,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.threatgraph.entitiesVerticesGetv2(
  "string",  // vertexType
  ["ID1", "ID2", "ID3"],  // ids
  "string",  // scope
  boolean  // nano
);

console.log(response);

Rust

use rusty_falcon::apis::threatgraph_api::entities_vertices_getv2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = entities_vertices_getv2(
        &falcon.cfg,  // configuration
        "string",  // vertex_type
        vec!["string".to_string()],  // ids
        Some("string"),  // scope
        Some(boolean),  // nano
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Threatgraph.new

response = api.entities_vertices_getv2('string', ['ID1', 'ID2', 'ID3'])

puts response

---

queries_edgetypes_get

Show all available edge types.

GET /threatgraph/queries/edge-types/v1

Scope ThreatGraph: READ Consumes · Produces application/json

PEP 8 get_edge_types

No keywords or arguments accepted.

Code Examples

Python

PEP 8

from falconpy import ThreatGraph

falcon = ThreatGraph(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.get_edge_types()
print(response)

Operation ID

from falconpy import ThreatGraph

falcon = ThreatGraph(client_id=CLIENT_ID,
                     client_secret=CLIENT_SECRET
                     )

response = falcon.queries_edgetypes_get()
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_edgetypes_get")
print(response)

PowerShell

Get-FalconThreatGraphEdge

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/threatgraph"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Threatgraph.QueriesEdgetypesGet(
    &threatgraph.QueriesEdgetypesGetParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.threatgraph.queriesEdgetypesGet();

console.log(response);

Rust

use rusty_falcon::apis::threatgraph_api::queries_edgetypes_get;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = queries_edgetypes_get(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Threatgraph.new

response = api.queries_edgetypes_get

puts response