Workflows

The Workflows service collection provides operations for managing and executing CrowdStrike Falcon workflows. Search for workflow activities, triggers, definitions, and executions. Execute workflows on demand, import and export definitions, manage human input actions, and configure system definitions for multi-tenant deployments.

Language	Last Update
Python	v1.6.1
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

Operation	Description
WorkflowActivitiesCombined `search_activities`	Search for activities by name. Returns all supported activities if no filter is specified.
WorkflowActivitiesContentCombined `search_activities_content`	Search for activities by name. Returns all supported activities if no filter specified.
WorkflowExecute `execute`	Executes an on-demand Workflow, the body is JSON used to trigger the execution, the response the execution ID(s)
WorkflowExecuteInternal `execute_internal`	Executes an on-demand Workflow, the body is JSON used to trigger the execution, the response the execution ID(s)
WorkflowMockExecute `mock_execute`	Executes an on-demand Workflow with mocks
WorkflowExecutionsAction `execution_action`	Allows a user to resume/retry a failed workflow execution.
WorkflowExecutionResults `execution_results`	Get execution result of a given execution
WorkflowSystemDefinitionsDeProvision `deprovision`	Deprovisions a system definition that was previously provisioned on the target CID
WorkflowSystemDefinitionsPromote `promote`	Promote a version of a system definition
WorkflowSystemDefinitionsProvision `provision`	Provisions a system definition onto the target CID by using the template and provided parameters
WorkflowDefinitionsCombined `search_definitions`	Search workflow definitions based on the provided filter
WorkflowTriggersCombined `search_triggers`	Search for triggers by namespaced identifier, i.e. `FalconAudit`, `Detection`, or `FalconAudit/Detection/Status`. Returns all triggers if no filter is specified.
WorkflowExecutionsCombined `search_executions`	Search workflow executions based on the provided filter
WorkflowDefinitionsExport `export_definition`	Exports a workflow definition for the given definition ID
WorkflowDefinitionsImport `import_definition`	Imports a workflow definition based on the provided model
WorkflowDefinitionsAction `workflow_definition_action`	Enable or disable a workflow definition, or stop all executions for a definition.
WorkflowDefinitionsUpdate `update_definition`	Updates a workflow definition based on the provided model.
WorkflowGetHumanInputV1 `get_human_input`	Gets one or more specific human inputs by their IDs.
WorkflowUpdateHumanInputV1 `update_human_input`	Provides an input in response to a human input action. Depending on action configuration, one or more of Approve, Decline, and/or Escalate are permitted.
v1_child_executions_query `query_child_executions`	Search for child executions by providing a FQL filter and paging details.

WorkflowActivitiesCombined

Search for activities by name. Returns all supported activities if no filter is specified.

GET /workflows/combined/activities/v1

Scope Workflow: READ Consumes · Produces application/json

PEP 8 search_activities

Parameters

Name	Type	Data type	Description
filter	query	string	FQL query specifying filter parameters.
offset	query	string	Starting pagination offset of records to return.
limit	query	integer	Maximum number of records to return.
sort	query	string	Sort items by providing a comma separated list of property and direction (eg name.desc, time.asc). If direction is omitted, defaults to descending.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.search_activities(filter="string",
                                    offset="string",
                                    limit=integer,
                                    sort="string")
print(response)

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.WorkflowActivitiesCombined(filter="string",
                                             offset="string",
                                             limit=integer,
                                             sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("WorkflowActivitiesCombined",
                          filter="string",
                          offset="string",
                          limit=integer,
                          sort="string")
print(response)

Get-FalconWorkflowAction -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/workflows"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := "string"
  limit := int64(0)
  sort := "string"

  response, err := client.Workflows.WorkflowActivitiesCombined(
    &workflows.WorkflowActivitiesCombinedParams{
      Filter: "string",
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.workflows.workflowActivitiesCombined(
  "string",  // filter
  "string",  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::workflows_api::workflow_activities_combined;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = workflow_activities_combined(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Workflows.new

response = api.workflow_activities_combined(filter: 'string',
                                            offset: 'string',
                                            limit: integer,
                                            sort: 'string')

puts response

WorkflowActivitiesContentCombined

Search for activities by name. Returns all supported activities if no filter specified.

GET /workflows/combined/activity-content/v1

Scope Workflow: READ Consumes · Produces application/json

PEP 8 search_activities_content

Parameters

Name	Type	Data type	Description
filter	query	string	FQL query specifying filter parameters.
limit	query	integer	Maximum number of records to return.
offset	query	string	Starting pagination offset of records to return.
sort	query	string	Sort items by providing a comma separated list of property and direction (eg name.desc,time.asc). If direction is omitted, defaults to descending.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.search_activities_content(filter="string",
                                            offset="string",
                                            limit=integer,
                                            sort="string")
print(response)

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.WorkflowActivitiesContentCombined(filter="string",
                                                    offset="string",
                                                    limit=integer,
                                                    sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("WorkflowActivitiesContentCombined",
                          filter="string",
                          offset="string",
                          limit=integer,
                          sort="string")
print(response)

Get-FalconWorkflowAction -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset "string" `
  -Library $boolean

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/workflows"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := "string"
  limit := int64(0)
  sort := "string"

  response, err := client.Workflows.WorkflowActivitiesContentCombined(
    &workflows.WorkflowActivitiesContentCombinedParams{
      Filter: "string",
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.workflows.workflowActivitiesContentCombined(
  "string",  // filter
  "string",  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::workflows_api::workflow_activities_content_combined;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = workflow_activities_content_combined(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Workflows.new

response = api.workflow_activities_content_combined(filter: 'string',
                                                    offset: 'string',
                                                    limit: integer,
                                                    sort: 'string')

puts response

WorkflowExecute

Execute an on-demand workflow. Response will contain the execution ID.

POST /workflows/entities/execute/v1

Scope Workflow: WRITE Consumes · Produces application/json

PEP 8 execute

Parameters

Name	Type	Data type	Description
definition_id	query	string or list of strings	Definition ID to execute, either a name or an ID can be specified.
execution_cid	query	string or list of strings	CID(s) to execute on.
name	query	string	Workflow name to execute, either a name or an ID can be specified.
key	query	string	Key used to help deduplicate executions, if unset a new UUID is used
depth	query	integer	Used to record the execution depth to help limit execution loops when a workflow triggers another. The maximum depth is 4.
source_event_url	query	string	Used to record a URL to the source that led to triggering this workflow
parameters	query	dictionary	Full query string parameters payload in JSON format.
body	body	dictionary	Full body payload in JSON format.

Code Examples

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.execute(definition_id="string",
                          execution_cid="string",
                          name="string",
                          key="string",
                          depth="string",
                          source_event_url="string")
print(response)

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.WorkflowExecute(definition_id="string",
                                  execution_cid="string",
                                  name="string",
                                  key="string",
                                  depth="string",
                                  source_event_url="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("WorkflowExecute",
                          execution_cid=id_list,
                          definition_id=id_list,
                          name="string",
                          key="string",
                          depth=integer,
                          source_event_url="string")
print(response)

Invoke-FalconWorkflow -Json "string" -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/workflows"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"
  key := "string"
  depth := int64(0)
  sourceEventURL := "string"

  response, err := client.Workflows.Execute(
    &workflows.ExecuteParams{
      Body: models.MapStringInterface{},
      ExecutionCid: []string{"ID1", "ID2", "ID3"},
      DefinitionID: []string{"ID1", "ID2", "ID3"},
      Name: &name,
      Key: &key,
      Depth: &depth,
      SourceEventURL: &sourceEventURL,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.workflows.execute(
  {},  // body
  ["ID1", "ID2", "ID3"],  // executionCid
  ["ID1", "ID2", "ID3"],  // definitionId
  "string",  // name
  "string",  // key
  integer,  // depth
  "string"  // sourceEventUrl
);

console.log(response);

use rusty_falcon::apis::workflows_api::workflow_execute;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = workflow_execute(
        &falcon.cfg,  // configuration
        Default::default(),  // body
        Some(vec!["string".to_string()]),  // execution_cid
        Some(vec!["string".to_string()]),  // definition_id
        Some("string"),  // name
        Some("string"),  // key
        Some(integer),  // depth
        Some("string"),  // source_event_url
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Workflows.new

response = api.workflow_execute(body)

puts response

WorkflowExecuteInternal

Execute an on-demand workflow. Response will contain the execution ID.

POST /workflows/entities/execute/internal/v1

Scope Workflow: WRITE Consumes · Produces application/json

PEP 8 execute_internal

Parameters

Name	Type	Data type	Description
batch_size	query	integer	Used to set the size of the batch.
definition_id	query	string or list of strings	Definition ID to execute, either a name or an ID can be specified.
execution_cid	query	string or list of strings	CID(s) to execute on.
name	query	string	Workflow name to execute, either a name or an ID can be specified.
key	query	string	Key used to help deduplicate executions, if unset a new UUID is used
depth	query	integer	Used to record the execution depth to help limit execution loops when a workflow triggers another. The maximum depth is 4.
source_event_url	query	string	Used to record a URL to the source that led to triggering this workflow
parameters	query	dictionary	Full query string parameters payload in JSON format.
body	body	dictionary	Full body payload in JSON format.

Code Examples

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.execute_internal(batch_size=integer,
                                   definition_id="string",
                                   execution_cid="string",
                                   name="string",
                                   key="string",
                                   depth="string",
                                   source_event_url="string")
print(response)

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.WorkflowExecuteInternal(batch_size=integer,
                                          definition_id="string",
                                          execution_cid="string",
                                          name="string",
                                          key="string",
                                          depth="string",
                                          source_event_url="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("WorkflowExecuteInternal",
                          execution_cid=id_list,
                          definition_id=id_list,
                          name="string",
                          key="string",
                          depth=integer,
                          batch_size=integer,
                          source_event_url="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/workflows"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"
  key := "string"
  depth := int64(0)
  batchSize := int64(0)
  sourceEventURL := "string"

  response, err := client.Workflows.WorkflowExecuteInternal(
    &workflows.WorkflowExecuteInternalParams{
      Body: models.MapStringInterface{},
      ExecutionCid: []string{"ID1", "ID2", "ID3"},
      DefinitionID: []string{"ID1", "ID2", "ID3"},
      Name: &name,
      Key: &key,
      Depth: &depth,
      BatchSize: &batchSize,
      SourceEventURL: &sourceEventURL,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.workflows.workflowExecuteInternal(
  {},  // body
  ["ID1", "ID2", "ID3"],  // executionCid
  ["ID1", "ID2", "ID3"],  // definitionId
  "string",  // name
  "string",  // key
  integer,  // depth
  integer,  // batchSize
  "string"  // sourceEventUrl
);

console.log(response);

use rusty_falcon::apis::workflows_api::workflow_execute_internal;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = workflow_execute_internal(
        &falcon.cfg,  // configuration
        Default::default(),  // body
        Some(vec!["string".to_string()]),  // execution_cid
        Some(vec!["string".to_string()]),  // definition_id
        Some("string"),  // name
        Some("string"),  // key
        Some(integer),  // depth
        Some(integer),  // batch_size
        Some("string"),  // source_event_url
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Workflows.new

response = api.workflow_execute_internal(body)

puts response

WorkflowMockExecute

Execute an on-demand workflow with mocks.

POST /workflows/entities/mock-executions/v1

Scope Workflow: WRITE Consumes · Produces application/json

PEP 8 mock_execute

Parameters

Name	Type	Data type	Description
definition_id	query	string or list of strings	Definition ID to execute, either a name or an ID can be specified.
execution_cid	query	string or list of strings	CID(s) to execute on.
name	query	string	Workflow name to execute, either a name or an ID can be specified.
key	query	string	Key used to help deduplicate executions, if unset a new UUID is used
depth	query	integer	Used to record the execution depth to help limit execution loops when a workflow triggers another. The maximum depth is 4.
source_event_url	query	string	Used to record a URL to the source that led to triggering this workflow
skip_validation	query	boolean	Skip validation of the workflow definition.
ignore_activity_mock_references	query	boolean	Ignore activity mock references during execution.
validate_only	query	boolean	Prevent execution after validating mocks against definition.
parameters	query	dictionary	Full query string parameters payload in JSON format.
body	body	dictionary	Full body payload in JSON format containing the schema definition, mocks, and the on demand trigger.

Code Examples

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.mock_execute(definition_id="string",
                               execution_cid="string",
                               ignore_activity_mock_references="string",
                               name="string",
                               key="string",
                               depth="string",
                               skip_validation="string",
                               source_event_url="string",
                               validate_only=boolean)
print(response)

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.WorkflowMockExecute(definition_id="string",
                                      execution_cid="string",
                                      ignore_activity_mock_references="string",
                                      name="string",
                                      key="string",
                                      depth="string",
                                      skip_validation="string",
                                      source_event_url="string",
                                      validate_only=boolean)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "definition": {
        "definition": {
            "actions": {},
            "conditions": {},
            "description": "string",
            "disconnected_nodes": ["string"],
            "labels": ["string"],
            "loops": {},
            "multi_instance": boolean,
            "name": "string",
            "node_registry": {},
            "output_fields": ["string"],
            "parameters": {},
            "parent": {},
            "provision_on_install": boolean,
            "summary": "string",
            "trigger": {},
            "type": "string",
            "uniq_node_seen": {},
            "use_cases": ["string"],
            "vendors": ["string"]
        },
        "enabled": boolean,
        "flight_control": {
            "all_cids": boolean,
            "excluded_cids": ["string"],
            "include_parent_cid": boolean,
            "selected_cids": ["string"]
        }
    },
    "mocks": "string",
    "on_demand_trigger": "string"
}

response = falcon.command("WorkflowMockExecute",
                          execution_cid=id_list,
                          definition_id="string",
                          name="string",
                          key="string",
                          depth=integer,
                          source_event_url="string",
                          validate_only=boolean,
                          skip_validation=boolean,
                          ignore_activity_mock_references=boolean,
                          body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/workflows"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  mocks := "string"
  on_demand_trigger := "string"
  definitionID := "string"
  name := "string"
  key := "string"
  depth := int64(0)
  sourceEventURL := "string"
  validateOnly := boolean
  skipValidation := boolean
  ignoreActivityMockReferences := boolean

  response, err := client.Workflows.WorkflowMockExecute(
    &workflows.WorkflowMockExecuteParams{
      Body: &models.ModelsMockExecutionCreateRequestV1{
        Definition: &struct{}{},
        Mocks: &mocks,
        OnDemandTrigger: &on_demand_trigger,
      },
      ExecutionCid: []string{"ID1", "ID2", "ID3"},
      DefinitionID: &definitionID,
      Name: &name,
      Key: &key,
      Depth: &depth,
      SourceEventURL: &sourceEventURL,
      ValidateOnly: &validateOnly,
      SkipValidation: &skipValidation,
      IgnoreActivityMockReferences: &ignoreActivityMockReferences,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.workflows.workflowMockExecute(
  {  // body
      definition: {
        Definition: {
          actions: {},
          conditions: {},
          description: "string",
          disconnectedNodes: [],
          labels: [],
          loops: {},
          multiInstance: boolean,
          name: "string",
          nodeRegistry: {},
          outputFields: [],
          parameters: {},
          parent: {},
          provisionOnInstall: boolean,
          summary: "string",
          trigger: {},
          type: "string",
          uniqNodeSeen: {},
          useCases: [],
          vendors: []
        },
        enabled: boolean,
        flightControl: {
          allCids: boolean,
          excludedCids: [],
          includeParentCid: boolean,
          selectedCids: []
        }
      },
      mocks: "string",
      onDemandTrigger: "string"
  },
  ["ID1", "ID2", "ID3"],  // executionCid
  "string",  // definitionId
  "string",  // name
  "string",  // key
  integer,  // depth
  "string",  // sourceEventUrl
  boolean,  // validateOnly
  boolean,  // skipValidation
  boolean  // ignoreActivityMockReferences
);

console.log(response);

use rusty_falcon::apis::workflows_api::workflow_mock_execute;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ModelsMockExecutionCreateRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ModelsMockExecutionCreateRequestV1 {
        mocks: Some("string".to_string()),
        ..Default::default()
    };

    let response = workflow_mock_execute(
        &falcon.cfg,  // configuration
        body,  // body
        Some(vec!["string".to_string()]),  // execution_cid
        Some("string"),  // definition_id
        Some("string"),  // name
        Some("string"),  // key
        Some(integer),  // depth
        Some("string"),  // source_event_url
        Some(boolean),  // validate_only
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Workflows.new

body = {
  definition: {
    Definition: {
      actions: {},
      conditions: {},
      description: 'string',
      disconnected_nodes: [],
      labels: [],
      loops: {},
      multi_instance: boolean,
      name: 'string',
      nodeRegistry: {},
      output_fields: [],
      parameters: {},
      parent: {},
      provision_on_install: boolean,
      summary: 'string',
      trigger: {},
      type: 'string',
      uniqNodeSeen: {},
      use_cases: [],
      vendors: []
    },
    enabled: boolean,
    flight_control: {
      all_cids: boolean,
      excluded_cids: [],
      include_parent_cid: boolean,
      selected_cids: []
    }
  },
  mocks: 'string',
  on_demand_trigger: 'string'
}

response = api.workflow_mock_execute(body)

puts response

WorkflowExecutionsAction

Allows a user to resume/retry a failed workflow execution.

POST /workflows/entities/execution-actions/v1

Scope Workflow: WRITE Consumes · Produces application/json

PEP 8 execution_action

Parameters

Name	Type	Data type	Description
action_name	query	string	Specify one of these actions: `resume` - resume/retry the workflow execution(s) specified in ids. `cancel` - cancel the workflow execution(s) specified in ids.
action_parameters	body	list of dictionaries	List of actions to perform.
ids	body	string or list of strings	Execution IDs.
body	body	dictionary	Full body payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

action_parameters = [
    {
        "name": "string",
        "value": "string"
    }
]

response = falcon.execution_action(action_name="string",
                                   action_parameters=action_parameters,
                                   ids=id_list,
                                   name="string",
                                   value="string")
print(response)

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

action_parameters = [
    {
        "name": "string",
        "value": "string"
    }
]

response = falcon.WorkflowExecutionsAction(action_name="string",
                                           action_parameters=action_parameters,
                                           ids=id_list,
                                           name="string",
                                           value="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "ids": ["string"]
}

response = falcon.command("WorkflowExecutionsAction",
                          action_name="string",
                          body=body_payload)
print(response)

Redo-FalconWorkflow -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/workflows"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Workflows.ExecutionAction(
    &workflows.ExecutionActionParams{
      Body: &models.ClientActionRequest{
        Ids: []string{"string"},
      },
      ActionName: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.workflows.executionAction(
  "string",  // actionName
  {  // body
      ids: []
  }
);

console.log(response);

use rusty_falcon::apis::workflows_api::workflow_executions_action;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ClientActionRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ClientActionRequest {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = workflow_executions_action(
        &falcon.cfg,  // configuration
        "string",  // action_name
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Workflows.new

body = Falcon::ClientActionRequest.new(
  ids: []
)

response = api.workflow_executions_action(body, 'string')

puts response

WorkflowExecutionResults

Get execution result of a given execution

GET /workflows/entities/execution-results/v1

Scope Workflow: READ Consumes · Produces application/json

PEP 8 execution_results

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	Workflow execution ID to return results for.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.execution_results(ids=id_list)
print(response)

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.WorkflowExecutionResults(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("WorkflowExecutionResults",
                          ids=id_list,
                          skip_fields=id_list)
print(response)

Get-FalconWorkflow -Id @("ID1", "ID2") -Execution $boolean

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/workflows"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Workflows.ExecutionResults(
    &workflows.ExecutionResultsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      SkipFields: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.workflows.executionResults(
  ["ID1", "ID2", "ID3"],  // ids
  ["ID1", "ID2", "ID3"]  // skipFields
);

console.log(response);

use rusty_falcon::apis::workflows_api::workflow_execution_results;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = workflow_execution_results(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Workflows.new

response = api.workflow_execution_results(['ID1', 'ID2', 'ID3'])

puts response

WorkflowSystemDefinitionsDeProvision

Deprovisions a system definition that was previously provisioned on the target CID.

POST /workflows/system-definitions/deprovision/v1

Scope Workflow: WRITE Consumes · Produces application/json

PEP 8 deprovision

Parameters

Name	Type	Data type	Description
definition_id	body	string	Workflow definition ID.
deprovision_all	body	boolean	Flag indicating if all workflows should be deprovisioned.
template_id	body	string	Template ID.
template_name	body	string	Template name.
body	body	dictionary	Full body payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.deprovision(definition_id="string",
                              deprovision_all=boolean,
                              template_id="string",
                              template_name="string")
print(response)

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.WorkflowSystemDefinitionsDeProvision(definition_id="string",
                                                       deprovision_all=boolean,
                                                       template_id="string",
                                                       template_name="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "definition_id": "string",
    "deprovision_all": boolean,
    "template_id": "string",
    "template_name": "string"
}

response = falcon.command("WorkflowSystemDefinitionsDeProvision", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/workflows"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  definition_id := "string"
  deprovision_all := boolean
  template_id := "string"
  template_name := "string"

  response, err := client.Workflows.Deprovision(
    &workflows.DeprovisionParams{
      Body: &models.ClientSystemDefinitionDeProvisionRequest{
        DefinitionID: &definition_id,
        DeprovisionAll: &deprovision_all,
        TemplateID: &template_id,
        TemplateName: &template_name,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.workflows.deprovision(
  {
    definitionId: "string",
    deprovisionAll: boolean,
    templateId: "string",
    templateName: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::workflows_api::workflow_system_definitions_de_provision;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ClientSystemDefinitionDeProvisionRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ClientSystemDefinitionDeProvisionRequest {
        definition_id: Some("string".to_string()),
        deprovision_all: Some(boolean),
        template_id: Some("string".to_string()),
        template_name: Some("string".to_string()),
        ..Default::default()
    };

    let response = workflow_system_definitions_de_provision(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Workflows.new

body = Falcon::ClientSystemDefinitionDeProvisionRequest.new(
  definition_id: 'string',
  deprovision_all: boolean,
  template_id: 'string',
  template_name: 'string'
)

response = api.workflow_system_definitions_de_provision(body)

puts response

WorkflowSystemDefinitionsPromote

Promote a version of a system definition.

Tenant must be already provisioned. This allows the caller to apply an updated template version on a CID and expects all parameters to be supplied. If the template supports multi-instance, the customer scope definition ID must be supplied to determine which customer workflow should be update.

POST /workflows/system-definitions/promote/v1

Scope Workflow: WRITE Consumes · Produces application/json

PEP 8 promote

Parameters

Name	Type	Data type	Description
activities	body	dictionary	Dictionary of workflow activities.
conditions	body	list of dictionaries	List of workflow conditions.
customer_definition_id	body	string	Customer definition ID.
name	body	string	Name of the workflow.
parameters	body	dictionary	Overrides specified activities, conditions and trigger keywords.
template_id	body	string	Template ID.
template_name	body	string	Template name.
template_version	body	string	Template version.
trigger	body	dictionary	Workflow trigger definition.
body	body	dictionary	Full body payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.promote(activities={},
                          conditions=[{"key": "value"}],
                          customer_definition_id="string",
                          name="string",
                          template_id="string",
                          template_name="string",
                          template_version="string",
                          trigger={})
print(response)

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.WorkflowSystemDefinitionsPromote(activities={},
                                                   conditions=[{"key": "value"}],
                                                   customer_definition_id="string",
                                                   name="string",
                                                   template_id="string",
                                                   template_name="string",
                                                   template_version="string",
                                                   trigger={})
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "customer_definition_id": "string",
    "name": "string",
    "parameters": {
        "activities": {
            "configuration": ["string"],
            "selection": ["string"]
        },
        "conditions": [
            {
                "fields": ["string"],
                "node_id": "string"
            }
        ],
        "trigger": {
            "fields": {},
            "node_id": "string"
        }
    },
    "template_id": "string",
    "template_name": "string",
    "template_version": "string"
}

response = falcon.command("WorkflowSystemDefinitionsPromote", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/workflows"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  customer_definition_id := "string"
  name := "string"
  template_id := "string"
  template_name := "string"
  template_version := "string"

  response, err := client.Workflows.Promote(
    &workflows.PromoteParams{
      Body: &models.ClientSystemDefinitionPromoteRequest{
        CustomerDefinitionID: &customer_definition_id,
        Name: &name,
        Parameters: &struct{}{},
        TemplateID: &template_id,
        TemplateName: &template_name,
        TemplateVersion: &template_version,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.workflows.promote(
  {
    customerDefinitionId: "string",
    name: "string",
    parameters: {
      activities: {
        configuration: [],
        selection: []
      },
      conditions: [{
          fields: [],
          nodeId: "string"
        }],
      trigger: {
        fields: {},
        nodeId: "string"
      }
    },
    templateId: "string",
    templateName: "string",
    templateVersion: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::workflows_api::workflow_system_definitions_promote;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ClientSystemDefinitionPromoteRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ClientSystemDefinitionPromoteRequest {
        customer_definition_id: Some("string".to_string()),
        name: Some("string".to_string()),
        parameters: Default::default(),
        template_id: Some("string".to_string()),
        template_name: Some("string".to_string()),
        template_version: Some("string".to_string()),
        ..Default::default()
    };

    let response = workflow_system_definitions_promote(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Workflows.new

body = Falcon::ClientSystemDefinitionPromoteRequest.new(
  customer_definition_id: 'string',
  name: 'string',
  parameters: {
    activities: {
      configuration: [],
      selection: []
    },
    conditions: [{
        fields: [],
        node_id: 'string'
      }],
    trigger: {
      fields: {},
      node_id: 'string'
    }
  },
  template_id: 'string',
  template_name: 'string',
  template_version: 'string'
)

response = api.workflow_system_definitions_promote(body)

puts response

WorkflowSystemDefinitionsProvision

Provisions a system definition onto the target CID by using the template and provided parameters.

POST /workflows/system-definitions/provision/v1

Scope Workflow: WRITE Consumes · Produces application/json

PEP 8 provision

Parameters

Name	Type	Data type	Description
activities	body	dictionary	Dictionary of workflow activities.
conditions	body	list of dictionaries	List of workflow conditions.
customer_definition_id	body	string	Customer definition ID.
name	body	string	Workflow name.
parameters	body	dictionary	Overrides specified activities, conditions and trigger keywords.
template_id	body	string	Template ID.
template_name	body	string	Template name.
template_version	body	string	Template version.
trigger	body	dictionary	Workflow trigger definition.
body	body	dictionary	Full body payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.provision(activities={},
                            conditions=[{"key": "value"}],
                            name="string",
                            template_id="string",
                            template_name="string",
                            template_version="string",
                            trigger={})
print(response)

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.WorkflowSystemDefinitionsProvision(activities={},
                                                     conditions=[{"key": "value"}],
                                                     name="string",
                                                     template_id="string",
                                                     template_name="string",
                                                     template_version="string",
                                                     trigger={})
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "name": "string",
    "parameters": {
        "activities": {
            "configuration": ["string"],
            "selection": ["string"]
        },
        "conditions": [
            {
                "fields": ["string"],
                "node_id": "string"
            }
        ],
        "trigger": {
            "fields": {},
            "node_id": "string"
        }
    },
    "template_id": "string",
    "template_name": "string",
    "template_version": "string"
}

response = falcon.command("WorkflowSystemDefinitionsProvision", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/workflows"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"
  template_id := "string"
  template_name := "string"
  template_version := "string"

  response, err := client.Workflows.Provision(
    &workflows.ProvisionParams{
      Body: &models.ClientSystemDefinitionProvisionRequest{
        Name: &name,
        Parameters: &struct{}{},
        TemplateID: &template_id,
        TemplateName: &template_name,
        TemplateVersion: &template_version,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.workflows.provision(
  {
    name: "string",
    parameters: {
      activities: {
        configuration: [],
        selection: []
      },
      conditions: [{
          fields: [],
          nodeId: "string"
        }],
      trigger: {
        fields: {},
        nodeId: "string"
      }
    },
    templateId: "string",
    templateName: "string",
    templateVersion: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::workflows_api::workflow_system_definitions_provision;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ClientSystemDefinitionProvisionRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ClientSystemDefinitionProvisionRequest {
        name: Some("string".to_string()),
        parameters: Default::default(),
        template_id: Some("string".to_string()),
        template_name: Some("string".to_string()),
        template_version: Some("string".to_string()),
        ..Default::default()
    };

    let response = workflow_system_definitions_provision(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Workflows.new

body = Falcon::ClientSystemDefinitionProvisionRequest.new(
  name: 'string',
  parameters: {
    activities: {
      configuration: [],
      selection: []
    },
    conditions: [{
        fields: [],
        node_id: 'string'
      }],
    trigger: {
      fields: {},
      node_id: 'string'
    }
  },
  template_id: 'string',
  template_name: 'string',
  template_version: 'string'
)

response = api.workflow_system_definitions_provision(body)

puts response

WorkflowDefinitionsCombined

Search workflow definitions based on the provided filter.

GET /workflows/combined/definitions/v1

Scope Workflow: READ Consumes · Produces application/json

PEP 8 search_definitions

Parameters

Name	Type	Data type	Description
filter	query	string	FQL query specifying filter parameters.
offset	query	string	Starting pagination offset of records to return.
limit	query	integer	Maximum number of records to return.
sort	query	string	Sort items by providing a comma separated list of property and direction (eg name.desc, time.asc). If direction is omitted, defaults to descending.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.search_definitions(filter="string",
                                     offset="string",
                                     limit=integer,
                                     sort="string")
print(response)

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.WorkflowDefinitionsCombined(filter="string",
                                              offset="string",
                                              limit=integer,
                                              sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("WorkflowDefinitionsCombined",
                          filter="string",
                          offset="string",
                          limit=integer,
                          sort="string")
print(response)

Get-FalconWorkflow -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/workflows"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := "string"
  limit := int64(0)
  sort := "string"

  response, err := client.Workflows.WorkflowDefinitionsCombined(
    &workflows.WorkflowDefinitionsCombinedParams{
      Filter: "string",
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.workflows.workflowDefinitionsCombined(
  "string",  // filter
  "string",  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::workflows_api::workflow_definitions_combined;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = workflow_definitions_combined(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Workflows.new

response = api.workflow_definitions_combined(filter: 'string',
                                             offset: 'string',
                                             limit: integer,
                                             sort: 'string')

puts response

WorkflowTriggersCombined

Search for triggers by namespaced identifier, i.e. FalconAudit, Detection, or FalconAudit/Detection/Status. Returns all triggers if no filter is specified.

GET /workflows/combined/triggers/v1

Scope Workflow: READ Consumes · Produces application/json

PEP 8 search_triggers

Parameters

Name	Type	Data type	Description
filter	query	string	FQL query specifying filter parameters.
offset	query	string	Starting pagination offset of records to return.
limit	query	integer	Maximum number of records to return.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.search_triggers(filter="string",
                                  offset="string",
                                  limit=integer)
print(response)

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.WorkflowTriggersCombined(filter="string",
                                           offset="string",
                                           limit=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("WorkflowTriggersCombined",
                          filter="string",
                          offset="string",
                          limit=integer)
print(response)

Get-FalconWorkflowTrigger -Filter "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/workflows"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := "string"
  limit := int64(0)

  response, err := client.Workflows.WorkflowTriggersCombined(
    &workflows.WorkflowTriggersCombinedParams{
      Filter: "string",
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.workflows.workflowTriggersCombined(
  "string",  // filter
  "string",  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::workflows_api::workflow_triggers_combined;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = workflow_triggers_combined(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Workflows.new

response = api.workflow_triggers_combined(filter: 'string',
                                          offset: 'string',
                                          limit: integer)

puts response

WorkflowExecutionsCombined

Search workflow executions based on the provided filter.

GET /workflows/combined/executions/v1

Scope Workflow: READ Consumes · Produces application/json

PEP 8 search_executions

Parameters

Name	Type	Data type	Description
filter	query	string	FQL query specifying filter parameters.
offset	query	string	Starting pagination offset of records to return.
limit	query	integer	Maximum number of records to return.
sort	query	string	Sort items by providing a comma separated list of property and direction (eg name.desc, time.asc). If direction is omitted, defaults to descending.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.search_executions(filter="string",
                                    offset="string",
                                    limit=integer,
                                    sort="string")
print(response)

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.WorkflowExecutionsCombined(filter="string",
                                             offset="string",
                                             limit=integer,
                                             sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("WorkflowExecutionsCombined",
                          filter="string",
                          offset="string",
                          limit=integer,
                          sort="string")
print(response)

Get-FalconWorkflow -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset "string" `
  -Execution $boolean

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/workflows"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := "string"
  limit := int64(0)
  sort := "string"

  response, err := client.Workflows.WorkflowExecutionsCombined(
    &workflows.WorkflowExecutionsCombinedParams{
      Filter: "string",
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.workflows.workflowExecutionsCombined(
  "string",  // filter
  "string",  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::workflows_api::workflow_executions_combined;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = workflow_executions_combined(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Workflows.new

response = api.workflow_executions_combined(filter: 'string',
                                            offset: 'string',
                                            limit: integer,
                                            sort: 'string')

puts response

WorkflowDefinitionsExport

Exports a workflow definition for the given definition ID.

GET /workflows/entities/definitions/export/v1

Scope Workflow: READ Consumes · Produces application/json · application/yaml

PEP 8 export_definition

Parameters

Name	Type	Data type	Description
id	query	string	ID of workflow definitions to return details for.
sanitize	query	boolean	Sanitize PII from workflow before it is exported.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.export_definition(id="string", sanitize=boolean)
print(response)

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.WorkflowDefinitionsExport(id="string", sanitize=boolean)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("WorkflowDefinitionsExport",
                          id="string",
                          sanitize=boolean)
print(response)

Export-FalconWorkflow -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/workflows"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  sanitize := boolean

  response, err := client.Workflows.WorkflowDefinitionsExport(
    &workflows.WorkflowDefinitionsExportParams{
      ID: "string",
      Sanitize: &sanitize,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.workflows.workflowDefinitionsExport(
  "string",  // id
  boolean  // sanitize
);

console.log(response);

use rusty_falcon::apis::workflows_api::workflow_definitions_export;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = workflow_definitions_export(
        &falcon.cfg,  // configuration
        "string",  // id
        Some(boolean),  // sanitize
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Workflows.new

response = api.workflow_definitions_export('string')

puts response

WorkflowDefinitionsImport

Imports a workflow definition based on the provided model

POST /workflows/entities/definitions/import/v1

Scope Workflow: WRITE Consumes · Produces multipart/form-data

PEP 8 import_definition

Parameters

Name	Type	Data type	Description
data_file	formData	file	A workflow definition in YAML format to import. Can be the file location or the file contents.
name	query	string	Workflow name to override.
validate_only	query	boolean	When enabled, prevents saving workflow after validating.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.import_definition(data_file="string",
                                    name="string",
                                    validate_only=boolean)
print(response)

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.WorkflowDefinitionsImport(data_file="string",
                                            name="string",
                                            validate_only=boolean)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("WorkflowDefinitionsImport",
                          data_file="string",
                          name="string",
                          validate_only=boolean,
                          include_activity_metadata=boolean)
print(response)

Import-FalconWorkflow -Path "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/workflows"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"
  validateOnly := boolean
  includeActivityMetadata := boolean

  response, err := client.Workflows.WorkflowDefinitionsImport(
    &workflows.WorkflowDefinitionsImportParams{
      Name: &name,
      ValidateOnly: &validateOnly,
      IncludeActivityMetadata: &includeActivityMetadata,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.workflows.workflowDefinitionsImport(
  "string",  // dataFile
  "string",  // name
  boolean,  // validateOnly
  boolean  // includeActivityMetadata
);

console.log(response);

use rusty_falcon::apis::workflows_api::workflow_definitions_import;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = workflow_definitions_import(
        &falcon.cfg,  // configuration
        std::path::PathBuf::default(),  // data_file
        Some("string"),  // name
        Some(boolean),  // validate_only
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Workflows.new

response = api.workflow_definitions_import('string')

puts response

WorkflowDefinitionsAction

Enable or disable a workflow definition, or stop all executions for a definition.

When a definition is disabled it will not execute against any new trigger events.

POST /workflows/entities/definition-actions/v1

Scope Workflow: WRITE Consumes · Produces application/json

PEP 8 workflow_definition_action

Parameters

Name	Type	Data type	Description
action_name	query	string	Specify one of these actions: `enable` - enable the workflow(s) specified in ids, `disable` - disable the workflow(s) specified in ids, `cancel` - cancel all in-flight executions for the workflow specified in ids. Required parameter.
ids	body	string or list of strings	ID(s) of workflow definitions to perform the action against.
body	body	dictionary	Full body payload in JSON format. Required parameter.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.workflow_definition_action(action_name="string", ids=id_list)
print(response)

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.WorkflowDefinitionsAction(action_name="string", ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "ids": ["string"]
}

response = falcon.command("WorkflowDefinitionsAction",
                          action_name="string",
                          body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/workflows"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Workflows.WorkflowDefinitionsAction(
    &workflows.WorkflowDefinitionsActionParams{
      Body: &models.ClientActionRequest{
        Ids: []string{"string"},
      },
      ActionName: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.workflows.workflowDefinitionsAction(
  "string",  // actionName
  {  // body
      ids: []
  }
);

console.log(response);

use rusty_falcon::apis::workflows_api::workflow_definitions_action;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = workflow_definitions_action(
        &falcon.cfg,  // configuration
        "string",  // action_name
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Workflows.new

body = Falcon::ClientActionRequest.new(
  ids: []
)

response = api.workflow_definitions_action(body, 'string')

puts response

WorkflowDefinitionsUpdate

Updates a workflow definition based on the provided model.

PUT /workflows/entities/definitions/v1

Scope Workflow: WRITE Consumes · Produces application/json

PEP 8 update_definition

Parameters

Name	Type	Data type	Description
change_log	body	string	Workflow revision change log comment.
definition	body	dictionary	Workflow definition parameters.
flight_control	body	dictionary	Workflow flight control functionality definitions.
id	body	string	Workflow ID to update.
validate_only	query	boolean	When enabled, prevents saving workflow after validating.
body	body	dictionary	Full workflow definition with all parameters in JSON format.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.update_definition(validate_only=boolean,
                                    definition={},
                                    change_log="string",
                                    enabled="string",
                                    flight_control={},
                                    id="string")
print(response)

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.WorkflowDefinitionsUpdate(validate_only=boolean,
                                            definition={},
                                            change_log="string",
                                            enabled="string",
                                            flight_control={},
                                            id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "definition": {
        "actions": {},
        "conditions": {},
        "description": "string",
        "disconnected_nodes": ["string"],
        "labels": ["string"],
        "loops": {},
        "multi_instance": boolean,
        "name": "string",
        "node_registry": {},
        "output_fields": ["string"],
        "parameters": {
            "actions": {},
            "conditions": {},
            "install_instructions": "string",
            "trigger": {}
        },
        "parent": {
            "actions": {},
            "conditions": {},
            "loops": {},
            "node_registry": {},
            "output_fields": ["string"],
            "parent": {},
            "summary": "string",
            "trigger": {},
            "uniq_node_seen": {}
        },
        "provision_on_install": boolean,
        "summary": "string",
        "trigger": {
            "event": "string",
            "name": "string",
            "next": ["string"],
            "parameters": {},
            "schedule": {},
            "type": "string",
            "version_constraint": "string",
            "webhook_config": {}
        },
        "type": "string",
        "uniq_node_seen": {},
        "use_cases": ["string"],
        "vendors": ["string"]
    },
    "change_log": "string",
    "enabled": boolean,
    "flight_control": {
        "all_cids": boolean,
        "excluded_cids": ["string"],
        "include_parent_cid": boolean,
        "selected_cids": ["string"]
    },
    "id": "string"
}

response = falcon.command("WorkflowDefinitionsUpdate",
                          validate_only=boolean,
                          body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/workflows"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  change_log := "string"
  enabled := boolean
  id := "string"
  validateOnly := boolean

  response, err := client.Workflows.WorkflowDefinitionsUpdate(
    &workflows.WorkflowDefinitionsUpdateParams{
      Body: &models.ModelsDefinitionUpdateRequestV2{
        Definition: &struct{}{},
        ChangeLog: &change_log,
        Enabled: &enabled,
        FlightControl: &struct{}{},
        ID: &id,
      },
      ValidateOnly: &validateOnly,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.workflows.workflowDefinitionsUpdate(
  {  // body
      Definition: {
        actions: {},
        conditions: {},
        description: "string",
        disconnectedNodes: [],
        labels: [],
        loops: {},
        multiInstance: boolean,
        name: "string",
        nodeRegistry: {},
        outputFields: [],
        parameters: {
          actions: {},
          conditions: {},
          installInstructions: "string",
          trigger: {}
        },
        parent: {
          actions: {},
          conditions: {},
          loops: {},
          nodeRegistry: {},
          outputFields: [],
          parent: {},
          summary: "string",
          trigger: {},
          uniqNodeSeen: {}
        },
        provisionOnInstall: boolean,
        summary: "string",
        trigger: {
          event: "string",
          name: "string",
          next: [],
          parameters: {},
          schedule: {},
          type: "string",
          versionConstraint: "string",
          webhookConfig: {}
        },
        type: "string",
        uniqNodeSeen: {},
        useCases: [],
        vendors: []
      },
      changeLog: "string",
      enabled: boolean,
      flightControl: {
        allCids: boolean,
        excludedCids: [],
        includeParentCid: boolean,
        selectedCids: []
      },
      id: "string"
  },
  boolean  // validateOnly
);

console.log(response);

use rusty_falcon::apis::workflows_api::workflow_definitions_update;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ModelsDefinitionUpdateRequestV2;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ModelsDefinitionUpdateRequestV2 {
        definition: Default::default(),
        enabled: Some(boolean),
        id: Some("string".to_string()),
        ..Default::default()
    };

    let response = workflow_definitions_update(
        &falcon.cfg,  // configuration
        body,  // body
        Some(boolean),  // validate_only
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Workflows.new

body = Falcon::ModelsDefinitionUpdateRequestV2.new(
  Definition: {
    actions: {},
    conditions: {},
    description: 'string',
    disconnected_nodes: [],
    labels: [],
    loops: {},
    multi_instance: boolean,
    name: 'string',
    nodeRegistry: {},
    output_fields: [],
    parameters: {
      actions: {},
      conditions: {},
      install_instructions: 'string',
      trigger: {}
    },
    parent: {
      actions: {},
      conditions: {},
      loops: {},
      nodeRegistry: {},
      output_fields: [],
      parent: {},
      summary: 'string',
      trigger: {},
      uniqNodeSeen: {}
    },
    provision_on_install: boolean,
    summary: 'string',
    trigger: {
      event: 'string',
      name: 'string',
      next: [],
      parameters: {},
      schedule: {},
      type: 'string',
      version_constraint: 'string',
      webhook_config: {}
    },
    type: 'string',
    uniqNodeSeen: {},
    use_cases: [],
    vendors: []
  },
  change_log: 'string',
  enabled: boolean,
  flight_control: {
    all_cids: boolean,
    excluded_cids: [],
    include_parent_cid: boolean,
    selected_cids: []
  },
  id: 'string'
)

response = api.workflow_definitions_update(body)

puts response

WorkflowGetHumanInputV1

Gets one or more specific human inputs by their IDs.

GET /workflows/entities/human-inputs/v1

Scope Workflow: READ Consumes · Produces application/json

PEP 8 get_human_input

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	ID(s) of human inputs to retrieve.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_human_input(ids=id_list)
print(response)

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.WorkflowGetHumanInputV1(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("WorkflowGetHumanInputV1",
                          ids=id_list)
print(response)

Get-FalconWorkflowInput -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/workflows"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Workflows.WorkflowGetHumanInputV1(
    &workflows.WorkflowGetHumanInputV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.workflows.workflowGetHumanInputV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::workflows_api::workflow_get_human_input_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = workflow_get_human_input_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Workflows.new

response = api.workflow_get_human_input_v1(['ID1', 'ID2', 'ID3'])

puts response

WorkflowUpdateHumanInputV1

Provides an input in response to a human input action. Depending on action configuration, one or more of Approve, Decline, and/or Escalate are permitted.

PATCH /workflows/entities/human-inputs/v1

Scope Workflow: WRITE Consumes · Produces application/json

PEP 8 update_human_input

Parameters

Name	Type	Data type	Description
id	query	string	ID of human input to provide an input to.
input	body	string	Input value.
note	body	string	Input note.
body	body	dictionary	Full body payload in JSON format.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.update_human_input(id="string", input="string", note="string")
print(response)

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.WorkflowUpdateHumanInputV1(id="string",
                                             input="string",
                                             note="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "input": "string",
    "note": "string"
}

response = falcon.command("WorkflowUpdateHumanInputV1",
                          id="string",
                          body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/workflows"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  input := "string"
  note := "string"

  response, err := client.Workflows.WorkflowUpdateHumanInputV1(
    &workflows.WorkflowUpdateHumanInputV1Params{
      Body: &models.ModelUserInputUpdateRequest{
        Input: &input,
        Note: &note,
      },
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.workflows.workflowUpdateHumanInputV1(
  "string",  // id
  {  // body
      input: "string",
      note: "string"
  }
);

console.log(response);

use rusty_falcon::apis::workflows_api::workflow_update_human_input_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ModelUserInputUpdateRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ModelUserInputUpdateRequest {
        input: Some("string".to_string()),
        note: Some("string".to_string()),
        ..Default::default()
    };

    let response = workflow_update_human_input_v1(
        &falcon.cfg,  // configuration
        "string",  // id
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Workflows.new

body = Falcon::ModelUserInputUpdateRequest.new(
  input: 'string',
  note: 'string'
)

response = api.workflow_update_human_input_v1(body, 'string')

puts response

v1_child_executions_query

Search for child executions by providing a FQL filter and paging details. Returns the set of child workflow execution IDs which match the filter criteria.

GET /workflows/queries/child-executions/v1

Scope Workflow: READ Consumes · Produces application/json

PEP 8 query_child_executions

Parameters

Name	Type	Data type	Description
filter	query	string	FQL query specifying filter parameters.
offset	query	string	Starting pagination offset of records to return.
limit	query	integer	Maximum number of records to return.
sort	query	string	Sort items by providing a comma separated list of property and direction (eg name.desc, time.asc). If direction is omitted, defaults to descending.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.query_child_executions(filter="string",
                                         offset="string",
                                         limit=integer,
                                         sort=["string"])
print(response)

from falconpy import Workflows

falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.v1_child_executions_query(filter="string",
                                            offset="string",
                                            limit=integer,
                                            sort=["string"])
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("v1_child_executions_query",
                          filter="string",
                          offset="string",
                          limit=integer,
                          sort="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/workflows"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := "string"
  limit := int64(0)
  sort := "string"

  response, err := client.Workflows.V1ChildExecutionsQuery(
    &workflows.V1ChildExecutionsQueryParams{
      Filter: "string",
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.workflows.v1ChildExecutionsQuery(
  "string",  // filter
  "string",  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Workflows.new

response = api.v1_child_executions_query(filter: 'string',
                                         offset: 'string',
                                         limit: integer,
                                         sort: 'string')

puts response

Workflows

Table of Contents

WorkflowActivitiesCombined

Parameters

Code Examples

WorkflowActivitiesContentCombined

Parameters

Code Examples

WorkflowExecute

Parameters

Code Examples

WorkflowExecuteInternal

Parameters

Code Examples

WorkflowMockExecute

Parameters

Code Examples

WorkflowExecutionsAction

Parameters

Code Examples

WorkflowExecutionResults

Parameters

Code Examples

WorkflowSystemDefinitionsDeProvision

Parameters

Code Examples

WorkflowSystemDefinitionsPromote

Parameters

Code Examples

WorkflowSystemDefinitionsProvision

Parameters

Code Examples

WorkflowDefinitionsCombined

Parameters

Code Examples

WorkflowTriggersCombined

Parameters

Code Examples

WorkflowExecutionsCombined

Parameters

Code Examples

WorkflowDefinitionsExport

Parameters

Code Examples

WorkflowDefinitionsImport

Parameters

Code Examples

WorkflowDefinitionsAction

Parameters

Code Examples

WorkflowDefinitionsUpdate

Parameters

Code Examples

WorkflowGetHumanInputV1

Parameters

Code Examples

WorkflowUpdateHumanInputV1

Parameters

Code Examples

v1_child_executions_query

Parameters

Code Examples