Operations by Collection

An operation is a request against a specific endpoint within the CrowdStrike API. Each operation combines an HTTP method with an API endpoint and has a unique Operation ID. No two operations share the same method/endpoint combination.

Every operation within every service collection has a unique, case-sensitive string identifier. Operation IDs are used throughout the CrowdStrike SDKs to reference specific API calls — as method names, function parameters, and endpoint identifiers across all supported languages. They also serve as the primary way to locate operation details within this documentation.

The tables below list all available operations grouped by their service collection. Each Operation ID links to the full operation details including parameters, request body schema, and code examples.

Access Scopes

Operation ID	Description
ListAccessScopesExternal	List Access Scopes By ID
QueryAccessScopesExternal	Query Access Scopes and returns IDs

Admission Control Policies

Operation ID	Description
admission-control-add-host-groups	Add one or more host groups to an admission control policy.
admission-control-add-rule-group-custom-rule	Add one or more custom Rego rules to a rule group in an admission control policy.
admission-control-create-policy	Create an admission control policy.
admission-control-create-rule-groups	Create one or more rule groups and add them to an existing admission control policy.
admission-control-delete-policies	Delete an admission control policy.
admission-control-delete-rule-groups	Delete rule groups.
admission-control-get-policies	Get admission control policies.
admission-control-query-policies	Search admission control policies.
admission-control-remove-host-groups	Remove one or more host groups from an admission control policy.
admission-control-remove-rule-group-custom-rule	Delete one or more custom Rego rules from all rule groups in an admission control policy.
admission-control-replace-rule-group-selectors	Replace labels and/or namespaces of a rule group within an admission control policy.
admission-control-set-rule-group-precedence	Change precedence of rule groups within an admission control policy.
admission-control-update-policy	Update an admission control policy.
admission-control-update-policy-precedence	Update admission control policy precedence.
admission-control-update-rule-groups	Update a rule group.

Agent Templates

Operation ID	Description
EntitiesAgentTemplatesV1	Retrieve agent template entities for the provided IDs
QueriesAgentTemplatesV1	Query agent template IDs with pagination

Agent Versions

Operation ID	Description
GetAgentVersionsV1	Retrieve agent version entities for the provided ids.
QueryAgentVersionsV1	Query agent versions based on the provided filters.

Alerts

Operation ID	Description
GetQueriesAlertsV1	Deprecated: please use version v2 of this endpoint.
GetQueriesAlertsV2	Retrieves all Alerts ids that match a given query.
PatchEntitiesAlertsV1	Perform actions on detections identified by detection ID(s) in request.
PatchEntitiesAlertsV2	Deprecated: Please use version v3 of this endpoint.
PatchEntitiesAlertsV3	Perform actions on Alerts identified by composite ID(s) in request.
PostAggregatesAlertsV1	Deprecated: Please use version v2 of this endpoint.
PostAggregatesAlertsV2	Retrieves aggregate values for Alerts across all CIDs.
PostCombinedAlertsV1	Retrieves all Alerts that match a particular FQL filter.
PostEntitiesAlertsV1	Deprecated: please use version v2 of this endpoint.
PostEntitiesAlertsV2	Retrieves all Alerts given their composite ids.

API Clients

Operation ID	Description
CreateAPIClient	Create new API Client.
DeleteAPIClients	Delete existing API Client(s) based on API Client ID(s) provided as request parameter(s) ‘ids’.
GetAccessibleScopes	Get all available scopes for customer.
GetAllAPIClientIdsForCustomer	Get All API client ID(s) for customer.
GetAPIClients	Get API Client(s) based on API Client ID(s) provided as request parameter(s) ‘ids’.
ResetAPIClientSecret	Reset existing API Client(s)‘s secret based on API Client ID(s) provided as request parameter(s) ‘ids’.
UpdateAPIClient	Update existing API Client based on API Client ID provided as request parameter ‘ids’.

API Integrations

Operation ID	Description
ExecuteCommand	Execute a command.
ExecuteCommandProxy	Execute a command and proxy the response directly.
GetCombinedPluginConfigs	Queries for config resources and returns details

ASPM

Operation ID	Description
CreateExecutorNode	Create a new relay node
CreateIntegration	Create a new integration
CreateIntegrationTask	Create new integration task.
DeleteExecutorNode	Delete a relay node
DeleteGroup
DeleteIntegration	Delete an existing integration by its ID
DeleteIntegrationTask	Delete an existing integration task by its ID
DeleteTags	Remove existing tags
ExecuteFunctionData	A selected list of queryLanguage queries. request & response are in MSA format
ExecuteFunctionDataCount	A selected list of queryLanguage count queries. request & response are in MSA format
ExecuteFunctionDataQuery	A selected list of queryLanguage queries. request & response are in MSA format
ExecuteFunctionDataQueryCount	A selected list of queryLanguage count queries. request & response are in MSA format
ExecuteFunctions	A selected list of queryLanguage services queries. request & response are in MSA format
ExecuteFunctionsCount	A selected list of queryLanguage count queries. request & response are in MSA format
ExecuteFunctionsOvertime	A selected list of queryLanguage overtime queries. request & response are in MSA format
ExecuteFunctionsQuery	A selected list of queryLanguage services queries. request & response are in MSA format
ExecuteFunctionsQueryCount	A selected list of queryLanguage count queries. request & response are in MSA format
ExecuteFunctionsQueryOvertime	A selected list of queryLanguage overtime queries. request & response are in MSA format
ExecuteQuery	Execute a query.
GetCloudSecurityIntegrationState	Get Cloud Security integration state
GetExecutorNodes	Get all the relay nodes
GetExecutorNodesMetadata	Get metadata about all executor nodes
GetGroupHierarchy	Get group hierarchy
GetGroupsV2
GetGroupV2	Get group details
GetIntegrations	Get a list of all the integrations
GetIntegrationsV2	Get a list of all the integrations
GetIntegrationTasks	Get all the integration tasks
GetIntegrationTasksAdmin	Get all the integration tasks, requires admin scope
GetIntegrationTasksMetadata	Get metadata about all integration tasks
GetIntegrationTasksV2	Get all the integration tasks
GetIntegrationTypes	Get all the integration types
getServiceArtifacts
GetServicesCount	Get the total amount of existing services
GetServiceViolationTypes	Get the different types of violation
GetTags	Get all the tags
GetUsersV2	List users
PostGroupV2	Create group
RetrieveRelayInstances	Retrieve the relay instances in CSV format
RunIntegrationTask	Run an integration task by its ID
RunIntegrationTaskAdmin	Run an integration task by its ID - for admin scope
RunIntegrationTaskV2	Run an integration task by its ID
ServiceNowGetDeployments
ServiceNowGetServices
SetCloudSecurityIntegrationState	Set Cloud Security integration state
UpdateDefaultGroup	Update default group
UpdateExecutorNode	Update an existing relay node
UpdateGroup	Update group
UpdateIntegration	Update an existing integration by its ID
UpdateIntegrationTask	Update an existing integration task by its ID
UpsertBusinessApplications	Create or Update Business Applications
UpsertTags	Create new or update existing tag.

CAO Hunting

Operation ID	Description
AggregateHuntingGuides	Aggregate Hunting Guides
AggregateIntelligenceQueries	Aggregate intelligence queries
GetArchiveExport	Creates an Archive Export
GetHuntingGuides	Retrieves a list of Hunting Guides
GetIntelligenceQueries	Retrieves the details of a list of Intelligence queries IDs
SearchHuntingGuides	Search for Hunting Guides that match the provided conditions
SearchIntelligenceQueries	Search for a list of intelligence queries IDs that match the provided conditions

Case Management

Operation ID	Description
aggregates.access-tags.post.v1	Get access tag aggregates
aggregates.file-details.post.v1	Get file details aggregates as specified via json in the request body.
aggregates.notification-groups.post.v1	Get notification groups aggregations
aggregates.notification-groups.post.v2	Get notification groups aggregations
aggregates.slas.post.v1	Get SLA aggregations
aggregates.templates.post.v1	Get templates aggregations
combined.file-details.get.v1	Query file details
entities.access-tags.get.v1	Get access tags
entities.alert-evidence.post.v1	Adds the given list of alert evidence to the specified case.
entities.case-tags.delete.v1	Removes the specified tags from the specified case.
entities.case-tags.post.v1	Adds the given list of tags to the specified case.
entities.cases.patch.v2	Updates given fields on the specified case.
entities.cases.post.v2	Retrieves all Cases given their IDs.
entities.cases.put.v2	Creates the given Case
entities.event-evidence.post.v1	Adds the given list of event evidence to the specified case.
entities.fields.get.v1	Get fields by ID
entities.file-details.get.v1	Get file details by id
entities.file-details.patch.v1	Update file details
entities.files.delete.v1	Delete file details by id
entities.files_bulk-download.post.v1	Download multiple existing file from case as a ZIP
entities.files_download.get.v1	Download existing file from case
entities.files_download.post.v1	Download existing files from case
entities.files_upload.post.v1	Upload file for case
entities.get-rtr-file-metadata.post.v1	gets metadata for a file via RTR without retrieving it
entities.merge.post.v1	Merges a source case into a destination case.
entities.notification-groups.delete.v1	Delete notification groups by ID
entities.notification-groups.delete.v2	Delete notification groups by ID
entities.notification-groups.get.v1	Get notification groups by ID
entities.notification-groups.get.v2	Get notification groups by ID
entities.notification-groups.patch.v1	Update notification group
entities.notification-groups.patch.v2	Update notification group
entities.notification-groups.post.v1	Create notification group
entities.notification-groups.post.v2	Create notification group
entities.retrieve-rtr-file.post.v1	retrieves a file from host using RTR and adds it to a case
entities.retrieve-rtr-recent-file.post.v1	RetrieveRecentRTRFile retrieves a recently fetched RTR file and adds it to a case
entities.slas.delete.v1	Delete SLAs
entities.slas.get.v1	Get SLAs by ID
entities.slas.patch.v1	Update SLA
entities.slas.post.v1	Create SLA
entities.template-snapshots.get.v1	Get template snapshots
entities.templates.delete.v1	Delete templates
entities.templates.get.v1	Get templates by ID
entities.templates.patch.v1	Update template
entities.templates.post.v1	Create template
entities.templates_export.get.v1	Export templates to files in a zip archive
entities.templates_import.post.v1	Import a template from a file
queries.access-tags.get.v1	Query access tags
queries.cases.get.v1	Retrieves all Cases IDs that match a given query.
queries.fields.get.v1	Query fields
queries.file-details.get.v1	Query for ids of file details
queries.notification-groups.get.v1	Query notification groups
queries.notification-groups.get.v2	Query notification groups
queries.slas.get.v1	Query SLAs
queries.template-snapshots.get.v1	Query template snapshots
queries.templates.get.v1	Query templates

Certificate Based Exclusions

Operation ID	Description
cb-exclusions.create.v1	Create new Certificate Based Exclusions.
cb-exclusions.delete.v1	Delete the exclusions by id
cb-exclusions.get.v1	Find all exclusion IDs matching the query with filter
cb-exclusions.query.v1	Search for cert-based exclusions.
cb-exclusions.update.v1	Updates existing Certificate Based Exclusions
certificates.get.v1	Retrieves certificate signing information for a file

Cloud AWS Registration

Operation ID	Description
cloud-registration-aws-create-account	Creates a new account in our system for a customer.
cloud-registration-aws-delete-account	Deletes an existing AWS account or organization in our system.
cloud-registration-aws-get-accounts	Retrieve existing AWS accounts by account IDs or organization IDs
cloud-registration-aws-query-accounts	Retrieve existing AWS accounts by account IDs
cloud-registration-aws-trigger-health-check	Trigger health check scan for AWS accounts
cloud-registration-aws-update-account	Patches a existing account in our system for a customer.
cloud-registration-aws-validate-accounts	Validates the AWS account registration status, and discover organization child accounts if organization is specified

Cloud Azure Registration

Operation ID	Description
cloud-registration-azure-create-registration	Create an Azure registration for a tenant.
cloud-registration-azure-create-suppressions	Create new issue suppression rules
cloud-registration-azure-delete-legacy-subscription	Delete existing legacy Azure subscriptions.
cloud-registration-azure-delete-registration	Deletes existing Azure registrations.
cloud-registration-azure-delete-suppressions	Remove/revoke suppression rules
cloud-registration-azure-download-script	Retrieve script to create resources
cloud-registration-azure-get-issue-suppression-values-by-field	Retrieve distinct filterable values for issue suppression fields
cloud-registration-azure-get-issue-values-by-field	Retrieve distinct filterable values for issue fields
cloud-registration-azure-get-issues	Retrieve issues for Azure registrations
cloud-registration-azure-get-registration	Retrieve existing Azure registration for a tenant.
cloud-registration-azure-get-script	Download Azure deployment script (Terraform or Bicep)
cloud-registration-azure-get-script-versions	Retrieve all available script versions with filtering and sorting
cloud-registration-azure-get-suppressions	Retrieve existing suppression rules with filtering
cloud-registration-azure-trigger-health-check	Trigger health check scan for Azure registrations
cloud-registration-azure-update-registration	Update an existing Azure registration for a tenant.
cloud-registration-azure-update-suppressions	Update existing suppression rules
cloud-registration-azure-validate-registration	Validate an Azure registration by checking service principal, role assignments and deployment stack (if the deployment method is Bicep)

Cloud Connect AWS

Operation ID	Description
CreateOrUpdateAWSSettings	Create or update Global Settings which are applicable to all provisioned AWS accounts
DeleteAWSAccounts	Delete a set of AWS Accounts by specifying their IDs
GetAWSAccounts	Retrieve a set of AWS Accounts by specifying their IDs
GetAWSSettings	Retrieve a set of Global Settings which are applicable to all provisioned AWS accounts
ProvisionAWSAccounts	Provision AWS Accounts by specifying details about the accounts to provision
QueryAWSAccounts	Search for provisioned AWS Accounts by providing an FQL filter and paging details.
QueryAWSAccountsForIDs	Search for provisioned AWS Accounts by providing an FQL filter and paging details.
UpdateAWSAccounts	Update AWS Accounts by specifying the ID of the account and details to update
VerifyAWSAccountAccess	Performs an Access Verification check on the specified AWS Account IDs

Cloud Google Cloud Registration

Operation ID	Description
cloud-registration-gcp-create-registration	Create a Google Cloud Registration.
cloud-registration-gcp-delete-registration	Deletes a Google Cloud Registration and returns the deleted registration in the response body.
cloud-registration-gcp-get-entities	Retrieve all GCP entities (organizations, folders, projects) grouped by type with support for FQL filtering, sorting, and pagination.
cloud-registration-gcp-get-registration	Retrieve a Google Cloud Registration.
cloud-registration-gcp-post-terraform-script	Generate Google Cloud Terraform deployment scripts (zip files)
cloud-registration-gcp-put-registration	Creates/Updates a Google Cloud Registration.
cloud-registration-gcp-trigger-health-check	Trigger health check scan for GCP registrations
cloud-registration-gcp-update-registration	Update a Google Cloud Registration.

Cloud OCI Registration

Operation ID	Description
cloud-security-registration-oci-create-account	Create OCI tenancy account in CSPM
cloud-security-registration-oci-delete-account	Delete an existing OCI tenancy in CSPM.
cloud-security-registration-oci-download-script	Retrieve script to create resources in tenancy OCID
cloud-security-registration-oci-get-account	Retrieve a list of OCI tenancies with support for FQL filtering, sorting, and pagination
cloud-security-registration-oci-rotate-key	Refresh key for the OCI Tenancy
cloud-security-registration-oci-update-account	Patch an existing OCI account in our system for a customer.
cloud-security-registration-oci-validate-tenancy	Validate the OCI account in CSPM for a provided CID.

Cloud Policies

Operation ID	Description
CloneComplianceFramework	Clone an existing compliance framework to create a custom copy
CreateComplianceControl	Create a new custom compliance control
CreateComplianceFramework	Create a new custom compliance framework
CreateRuleMixin0	Create a new rule
CreateRuleOverride	Create a new rule override
CreateSuppressionRule	Create a new suppression rule
DeleteComplianceControl	Delete custom compliance controls
DeleteComplianceFramework	Delete a custom compliance framework and all associated controls and rule assignments
DeleteRuleMixin0	Delete a rule
DeleteRuleOverride	Delete a rule override
DeleteSuppressionRules	Delete Suppression Rules by ID
GetComplianceControls	Get compliance controls by ID
GetComplianceFrameworks	Get compliance frameworks by ID
GetEnrichedAsset	Gets enriched assets that combine a primary resource with all its related resources
GetEvaluationResult	Gets evaluation results based on the provided rule
GetRule	Get a rule by id
GetRuleInputSchema	Get rule input schema for given resource type
GetRuleOverride	Get a rule override
GetSuppressionRules	Get Suppression Rules by ID
QueryComplianceControls	Query for compliance controls by various parameters
QueryComplianceFrameworks	Query for compliance frameworks by various parameters
QueryRule	Query for rules by various parameters
QuerySuppressionRules	Query suppression rules with filtering, sorting and pagination
RenameSectionComplianceFramework	Rename a section in a custom compliance framework
ReplaceControlRules	Assign rules to a compliance control (full replace)
UpdateComplianceControl	Update a custom compliance control
UpdateComplianceFramework	Update a custom compliance framework
UpdateRule	Update a rule
UpdateRuleOverride	Update a rule override
UpdateSuppressionRule	Update a suppression rule

Cloud Security

Operation ID	Description
combined-cloud-risks	Gets cloud risks with full details based on filters and sort criteria
CreateCloudGroupExternal	Create a Cloud Group.
DeleteCloudGroupsExternal	Delete Cloud Groups in batch
ListCloudGroupIDsExternal	Query Cloud Groups and returns IDs
ListCloudGroupsByIDExternal	List Cloud Groups By ID
ListCloudGroupsExternal	Query Cloud Groups and returns entities
UpdateCloudGroupExternal	Update Cloud Group

Cloud Security Assets

Operation ID	Description
cloud-security-assets-combined-application-findings	Get findings for an application resource with pagination
cloud-security-assets-combined-compliance-by-account	Gets combined compliance data aggregated by account and region.
cloud-security-assets-entities-get	Gets raw resources based on the provided IDs param.
cloud-security-assets-entities-post	Gets raw resources based on IDs in the request body.
cloud-security-assets-queries	Gets a list of resource IDs for the given parameters, filters and sort criteria

Cloud Security Compliance

Operation ID	Description
cloud-compliance-framework-posture-summaries	Get sections and requirements with scores for benchmarks.
cloud-compliance-rule-posture-summaries	Get compliance score and counts for rules.

Cloud Security Detections

Operation ID	Description
cspm-evaluations-combined-iom-by-rule	returns ioms grouped by rule
cspm-evaluations-iom-entities	Gets IOMs based on the provided IDs
cspm-evaluations-iom-entities-post	Gets IOMs based on IDs in the request body.
cspm-evaluations-iom-queries	Gets a list of IOM IDs for the given parameters, filters and sort criteria.

Cloud Security Registration Combined

Operation ID	Description
cloud-registration-cross-provider-get-account-aggregates	Returns cross-provider account aggregates by status

Cloud Security Risks

Operation ID	Description
cloud-security-timeline-risks-enriched	Returns the enriched asset timeline.

Cloud Snapshots

Operation ID	Description
CombinedDetections	Search IaC Detections using a query in Falcon Query Language
CreateDeploymentEntity	Launch a snapshot scan for a given cloud asset
GetCredentialsIAC	Gets the registry credentials (external endpoint)
GetCredentialsMixin0	Gets the registry credentials
GetScanReport	retrieve the scan report for an instance
ReadDeploymentsCombined	Retrieve snapshot jobs identified by the provided IDs
ReadDeploymentsEntities	Retrieve snapshot jobs identified by the provided IDs
RegisterCspmSnapshotAccount	Register customer cloud account for snapshot scanning

Configuration Assessment

Operation ID	Description
getCombinedAssessmentsQuery	Search for assessments in your environment by providing an FQL filter and paging details.
getRuleDetails	Get rules details for provided one or more rule IDs

Configuration Assessment Evaluation Logic

Operation ID	Description
getEvaluationLogicMixin0	Get details on evaluation logic items by providing one or more finding IDs.

Container Alerts

Operation ID	Description
ReadContainerAlertsCount	Search Container Alerts by the provided search criteria
ReadContainerAlertsCountBySeverity	Get Container Alerts counts by severity
SearchAndReadContainerAlerts	Search Container Alerts by the provided search criteria

Container Detections

Operation ID	Description
GetRuntimeDetectionsCombinedV2	Retrieve container runtime detections by the provided search criteria
ReadCombinedDetections	Retrieve image assessment detections identified by the provided filter criteria
ReadDetections	Retrieve image assessment detection entities identified by the provided filter criteria
ReadDetectionsCount	Aggregate count of detections
ReadDetectionsCountBySeverity	Aggregate counts of detections by severity
ReadDetectionsCountByType	Aggregate counts of detections by detection type
SearchDetections	Retrieve image assessment detection entities identified by the provided filter criteria

Container Image Compliance

Operation ID	Description
extAggregateClusterAssessments	get the assessments for each cluster
extAggregateFailedContainersByRulesPath	get the containers grouped into rules on which they failed
extAggregateFailedContainersCountBySeverity	get the failed containers count grouped into severity levels
extAggregateFailedImagesByRulesPath	get the images grouped into rules on which they failed
extAggregateFailedImagesCountBySeverity	get the failed images count grouped into severity levels
extAggregateFailedRulesByClusters	get the failed rules for each cluster grouped into severity levels
extAggregateFailedRulesByImages	get images with failed rules, rule count grouped by severity for each image
extAggregateFailedRulesCountBySeverity	get the failed rules count grouped into severity levels
extAggregateImageAssessments	get the assessments for each image
extAggregateRulesAssessments	get the assessments for each rule
extAggregateRulesByStatus	get the rules grouped by their statuses

Container Images

Operation ID	Description
AggregateImageAssessmentHistory	Image assessment history
AggregateImageCount	Aggregate count of images
AggregateImageCountByBaseOS	Aggregate count of images grouped by Base OS distribution
AggregateImageCountByState	Aggregate count of images grouped by state
CombinedBaseImages	Retrieves a list of base images for the provided filter.
CombinedImageByVulnerabilityCount	Retrieve top x images with the most vulnerabilities
CombinedImageDetail	Retrieve image entities identified by the provided filter criteria
CombinedImageIssuesSummary	Retrieve image issues summary such as Image detections, Runtime detections, Policies, vulnerabilities
CombinedImageVulnerabilitySummary	aggregates information about vulnerabilities for an image
CreateBaseImagesEntities	Creates base images using the provided details
DeleteBaseImages	Delete base images by base image uuid
GetCombinedImages	Get image assessment results by providing an FQL filter and paging details
ReadCombinedImagesExport	Retrieves a paginated list of images, with an option to expand aggregated vulnerabilities/detections.

Container Packages

Operation ID	Description
ReadPackagesByFixableVulnCount	Retrieve top x app packages with the most fixable vulnerabilities
ReadPackagesByImageCount	Retrieves the N most frequently used packages across images
ReadPackagesByVulnCount	Retrieve top x packages with the most vulnerabilities
ReadPackagesCombined	Retrieve packages identified by the provided filter criteria
ReadPackagesCombinedExport	Retrieves a paginated list of packages identified by the provided filter criteria,used for export.Maximum page size: 100.
ReadPackagesCombinedV2	Retrieve packages identified by the provided filter criteria
ReadPackagesCountByZeroDay	Retrieve packages count affected by zero day vulnerabilities

Container Vulnerabilities

Operation ID	Description
ReadCombinedVulnerabilities	Retrieves a paginated list of vulnerabilities filtered by the provided FQL.
ReadCombinedVulnerabilitiesDetails	Retrieve vulnerability details related to an image
ReadCombinedVulnerabilitiesInfo	Retrieve vulnerability and package related info for this customer
ReadVulnerabilitiesByImageCount	Retrieve top x vulnerabilities with the most impacted images
ReadVulnerabilitiesPublicationDate	Retrieve top x vulnerabilities with the most recent publication date
ReadVulnerabilityCount	Aggregate count of vulnerabilities
ReadVulnerabilityCountByActivelyExploited	Aggregate count of vulnerabilities grouped by actively exploited
ReadVulnerabilityCountByCPSRating	Aggregate count of vulnerabilities grouped by csp_rating
ReadVulnerabilityCountByCVSSScore	Aggregate count of vulnerabilities grouped by CVSS score
ReadVulnerabilityCountBySeverity	Aggregate count of vulnerabilities grouped by severity

Content Update Policies

Operation ID	Description
createContentUpdatePolicies	Create Content Update Policies by specifying details about the policy to create
deleteContentUpdatePolicies	Delete a set of Content Update Policies by specifying their IDs
getContentUpdatePolicies	Retrieve a set of Content Update Policies by specifying their IDs
performContentUpdatePoliciesAction	Perform the specified action on the Content Update Policies specified in the request
queryCombinedContentUpdatePolicies	Search for Content Update Policies in your environment by providing an FQL filter and paging details.
queryCombinedContentUpdatePolicyMembers	Search for members of a Content Update Policy in your environment by providing an FQL filter and paging details.
queryContentUpdatePolicies	Search for Content Update Policies in your environment by providing an FQL filter and paging details.
queryContentUpdatePolicyMembers	Search for members of a Content Update Policy in your environment by providing an FQL filter and paging details.
queryPinnableContentVersions	Search for content versions available for pinning given the category.
setContentUpdatePoliciesPrecedence	Sets the precedence of Content Update Policies based on the order of IDs specified in the request.
updateContentUpdatePolicies	Update Content Update Policies by specifying the ID of the policy and details to update

Correlation Rules

Operation ID	Description
aggregates.rule-versions.post.v1	Get rules aggregates as specified via json in the request body.
combined.rules.get.v1	Find all rules matching the query and filter.
combined.rules.get.v2	Find all rules matching the query and filter.
entities.latest-rules.get.v1	Retrieve latest rule versions by rule IDs
entities.rule-versions.delete.v1	Delete versions by IDs
entities.rule-versions_export.post.v1	Export rule versions
entities.rule-versions_import.post.v1	Import rule versions
entities.rule-versions_publish.patch.v1	Publish existing rule version
entities.rules.delete.v1	Delete rules by IDs
entities.rules.get.v1	Retrieve rules by IDs
entities.rules.get.v2	Retrieve rule versions by IDs
entities.rules.patch.v1	Update rules
entities.rules.post.v1	Create rule
entities.templates.get.v1Mixin0	Retrieve rule templates by IDs
entities.templates_rules.post.v1	Create rule from template
queries.rules.get.v1	Find all rule IDs matching the query and filter.
queries.rules.get.v2	Find all rule version IDs matching the query and filter.
queries.templates.get.v1Mixin0	Search rule template IDs matching the filter.

Correlation Rules Admin

Operation ID	Description
entities.rules_ownership.put.v1	Change the owner of an existing Correlation Rule
entities.rules_ownership.put.v2	Bulk change the owner of existing Correlation Rules

CSPM Registration

Operation ID	Description
AzureRefreshCertificate	Refresh certificate and returns JSON object(s) that contain the base64 encoded certificate for a service principal.
ConnectCSPMGCPAccount	Creates a new GCP account with newly-uploaded service account or connects with existing service account with only the following fields: parent_id, parent_type and service_account_id
CreateCSPMAwsAccount	Creates a new account in our system for a customer and generates a script for them to run in their AWS cloud environment to grant us access.
CreateCSPMAzureAccount	Creates a new account in our system for a customer and generates a script for them to run in their cloud environment to grant us access.
CreateCSPMAzureManagementGroup	Creates a new management group in our system for a customer.
CreateCSPMGCPAccount	Creates a new account in our system for a customer and generates a new service account for them to add access to in their GCP environment to grant us access.
DeleteCSPMAwsAccount	Deletes an existing AWS account or organization in our system.
DeleteCSPMAzureAccount	Deletes an Azure subscription from the system.
DeleteCSPMAzureManagementGroup	Deletes Azure management groups from the system.
DeleteCSPMGCPAccount	Deletes a GCP account from the system.
DiscoverCloudAzureDownloadCertificate	Returns JSON object(s) that contain the base64 encoded certificate for a service principal.
GetBehaviorDetections	Get list of detected behaviors
getCloudEventIDs	Deprecated: use cdrapi entities/event-details/v1 ‘logscale_related_events_query’ instead.
GetConfigurationDetectionEntities	Get misconfigurations based on the ID - including custom policy detections in addition to default policy detections.
GetConfigurationDetectionIDsV2	Get list of active misconfiguration ids - including custom policy detections in addition to default policy detections.
GetConfigurationDetections	Get list of active misconfigurations.
GetCSPMAwsAccount	Returns information about the current status of an AWS account.
GetCSPMAwsAccountScriptsAttachment	Return a script for customer to run in their cloud environment to grant us access to their AWS environment as a downloadable attachment.
GetCSPMAwsConsoleSetupURLs	Return a URL for customer to visit in their cloud environment to grant us access to their AWS environment.
GetCSPMAzureAccount	Return information about Azure account registration
GetCSPMAzureManagementGroup	Return information about Azure management group registration
GetCSPMAzureUserScriptsAttachment	Return a script for customer to run in their cloud environment to grant us access to their Azure environment as a downloadable attachment
GetCSPMGCPAccount	Returns information about the current status of an GCP account.
GetCSPMGCPServiceAccountsExt	Returns the service account id and client email for external clients.
GetCSPMGCPUserScriptsAttachment	Return a script for customer to run in their cloud environment to grant us access to their GCP environment as a downloadable attachment
GetCSPMGCPValidateAccountsExt	Run a synchronous health check.
GetCSPMPoliciesDetails	Given an array of policy IDs, returns detailed policies information.
GetCSPMPolicy	Given a policy ID, returns detailed policy information.
GetCSPMPolicySettings	Returns information about current policy settings.
GetCSPMScanSchedule	Returns scan schedule configuration for one or more cloud platforms.
GetIOAEvents	For CSPM IOA events, gets list of IOA events.
GetIOAUsers	For CSPM IOA users, gets list of IOA users.
PatchCSPMAwsAccount	Patches a existing account in our system for a customer.
UpdateCSPMAzureAccount	Patches a existing account in our system for a customer.
UpdateCSPMAzureAccountClientID	Update an Azure service account in our system by with the user-created client_id created with the public key we’ve provided
UpdateCSPMAzureTenantDefaultSubscriptionID	Update an Azure default subscription_id in our system for given tenant_id
UpdateCSPMGCPAccount	Patches a existing account in our system for a customer.
UpdateCSPMGCPServiceAccountsExt	Patches the service account key for external clients.
UpdateCSPMPolicySettings	Updates a policy setting - can be used to override policy severity or to disable a policy entirely.
UpdateCSPMScanSchedule	Updates scan schedule configuration for one or more cloud platforms.
ValidateCSPMGCPServiceAccountExt	Validates credentials for a service account

Custom IOA

Operation ID	Description
create-rule	Create a rule within a rule group.
create-rule-groupMixin0	Create a rule group for a platform with a name and an optional description.
delete-rule-groupsMixin0	Delete rule groups by ID.
delete-rules	Delete rules from a rule group by ID.
get-patterns	Get pattern severities by ID.
get-platformsMixin0	Get platforms by ID.
get-rule-groupsMixin0	Get rule groups by ID.
get-rule-types	Get rule types by ID.
get-rules-get	Get rules by ID and optionally with cid and/or version in the following format: [cid:]ID[:version].
get-rulesMixin0	Get rules by ID and optionally with cid and/or version in the following format: [cid:]ID[:version].
query-patterns	Get all pattern severity IDs.
query-platformsMixin0	Get all platform IDs.
query-rule-groups-full	Find all rule groups matching the query with optional filter.
query-rule-groupsMixin0	Finds all rule group IDs matching the query with optional filter.
query-rule-types	Get all rule type IDs.
query-rulesMixin0	Finds all rule IDs matching the query with optional filter.
update-rule-groupMixin0	Update a rule group.
update-rules	Update rules within a rule group.
update-rules-v2	Update name, description, enabled or field_values for individual rules within a rule group.
validate	Validates field values and checks for matches if a test string is provided.

Custom Storage

Operation ID	Description
DeleteObject	Delete the specified object
DeleteVersionedObject	Delete the specified versioned object
DescribeCollection	Fetch metadata about an existing collection
DescribeCollections	Fetch metadata about one or more existing collections
GetObject	Get the bytes for the specified object
GetObjectMetadata	Get the metadata for the specified object
GetSchema	Get the bytes of the specified schema of the requested collection
GetSchemaMetadata	Get the metadata for the specified schema of the requested collection
GetVersionedObject	Get the bytes for the specified object
GetVersionedObjectMetadata	Get the metadata for the specified object
ListCollections	List available collection names in alphabetical order
ListObjects	List the object keys in the specified collection in alphabetical order
ListObjectsByVersion	List the object keys in the specified collection in alphabetical order
ListSchemas	Get the list of schemas for the requested collection in reverse version order (latest first)
PutObject	Put the specified new object at the given key or overwrite an existing object at the given key
PutObjectByVersion	Put the specified new object at the given key or overwrite an existing object at the given key
SearchObjects	Search for objects that match the specified filter criteria (returns metadata, not actual objects)
SearchObjectsByVersion	Search for objects that match the specified filter criteria (returns metadata, not actual objects)

D4C Registration

Operation ID	Description
ConnectD4CGCPAccount	Creates a new GCP account with newly-uploaded service account or connects with existing service account with only the following fields: parent_id, parent_type and service_account_id
CreateD4CAwsAccount	Creates a new account in our system for a customer and generates a script for them to run in their AWS cloud environment to grant us access.
CreateD4CGCPAccount	Creates a new account in our system for a customer and generates a new service account for them to add access to in their GCP environment to grant us access.
CreateDiscoverCloudAzureAccount	Creates a new account in our system for a customer and generates a script for them to run in their cloud environment to grant us access.
DeleteD4CAwsAccount	Deletes an existing AWS account or organization in our system.
DeleteD4CGCPAccount	Deletes a GCP account from the system.
GetD4CAwsAccount	Returns information about the current status of an AWS account.
GetD4CAWSAccountScriptsAttachment	Return a script for customer to run in their cloud environment to grant us access to their AWS environment as a downloadable attachment.
GetD4CAwsConsoleSetupURLs	Return a URL for customer to visit in their cloud environment to grant us access to their AWS environment.
GetD4CCGPAccount	Returns information about the current status of an GCP account.
GetD4CGCPServiceAccountsExt	Returns the service account id and client email for external clients.
GetD4CGCPUserScripts	Return a script for customer to run in their cloud environment to grant us access to their GCP environment
GetD4CGCPUserScriptsAttachment	Return a script for customer to run in their cloud environment to grant us access to their GCP environment as a downloadable attachment
GetDiscoverCloudAzureAccount	Return information about Azure account registration
GetDiscoverCloudAzureTenantIDs	Return available tenant ids for discover for cloud
GetDiscoverCloudAzureUserScripts	Return a script for customer to run in their cloud environment to grant us access to their Azure environment
GetDiscoverCloudAzureUserScriptsAttachment	Return a script for customer to run in their cloud environment to grant us access to their Azure environment as a downloadable attachment
GetHorizonD4CScripts	Returns static install scripts for Horizon.
UpdateD4CGCPServiceAccountsExt	Patches the service account key for external clients.
UpdateDiscoverCloudAzureAccountClientID	Update an Azure service account in our system by with the user-created client_id created with the public key we’ve provided

Data Protection Configuration

Operation ID	Description
entities.classification.delete.v2	Deletes classifications that match the provided ids
entities.classification.get.v2	Gets the classifications that match the provided ids
entities.classification.patch.v2	Update classifications
entities.classification.post.v2	Create classifications
entities.cloud-application.create	Persist the given cloud application for the provided entity instance
entities.cloud-application.delete	Delete cloud application
entities.cloud-application.get	Get a particular cloud-application
entities.cloud-application.patch	Update a cloud application
entities.content-pattern.create	Persist the given content pattern for the provided entity instance
entities.content-pattern.delete	Delete content pattern
entities.content-pattern.get	Get a particular content-pattern(s)
entities.content-pattern.patch	Update a content pattern
entities.enterprise-account.create	Persist the given enterprise account for the provided entity instance
entities.enterprise-account.delete	Delete enterprise account
entities.enterprise-account.get	Get a particular enterprise-account(s)
entities.enterprise-account.patch	Update a enterprise account
entities.file-type.get	Get a particular file-type
entities.local-application-group.create	Persist the given local application group for the provided entity instance
entities.local-application-group.delete	Soft Delete local application.
entities.local-application-group.get	Get specific local application groups
entities.local-application-group.patch	Update a local application group
entities.local-application.create	Persist the given local application for the provided entity instance
entities.local-application.delete	Soft Delete local application.
entities.local-application.get	Get a particular local application
entities.local-application.patch	Update a local application
entities.policy.delete.v2	Deletes policies that match the provided ids
entities.policy.get.v2	Gets policies that match the provided ids
entities.policy.patch.v2	Update policies
entities.policy.post.v2	Create policies
entities.policy.precedence.post.v1	Update Policy Precedence
entities.sensitivity-label.create-v2	Create new sensitivity label (V2)
entities.sensitivity-label.delete-v2	Delete sensitivity labels matching the IDs (V2)
entities.sensitivity-label.get-v2	Get sensitivity label matching the IDs (V2)
entities.web-location-group.create	Create a web location group
entities.web-location-group.delete	Soft delete web location groups
entities.web-location-group.get	Get specific web location groups
entities.web-location-group.patch	Update a web location group
entities.web-location.create-v2	Persist the given web-locations
entities.web-location.delete-v2	Delete web-location
entities.web-location.get-v2	Get web-location entities matching the provided ID(s)
entities.web-location.patch-v2	Update a web-location
queries.classification.get.v2	Search for classifications that match the provided criteria
queries.cloud-application.get-v2	Get all cloud-application IDs matching the query with filter
queries.content-pattern.get-v2	Get all content-pattern IDs matching the query with filter
queries.enterprise-account.get-v2	Get all enterprise-account IDs matching the query with filter
queries.file-type.get-v2	Get all file-type IDs matching the query with filter
queries.local-application-group.get	Get all local application group IDs matching the query with filter
queries.local-application.get	Get all local-application IDs matching the query with filter
queries.policy.get.v2	Search for policies that match the provided criteria
queries.sensitivity-label.get-v2	Get all sensitivity label IDs matching the query with filter
queries.web-location-group.get	Get all web location group IDs matching the query with filter
queries.web-location.get-v2	Get web-location IDs matching the query with filter

Delivery Settings

Operation ID	Description
GetDeliverySettings	Get Delivery Settings
PostDeliverySettings	Create Delivery Settings

Deployments

Operation ID	Description
CombinedReleaseNotesV1	Queries for release-notes resources and returns details
CombinedReleasesV1Mixin0	Queries for releases resources and returns details
GetDeploymentsExternalV1	Get deployment resources by ids
GetEntityIDsByQueryPOST	returns the release notes for the IDs in the request
GetEntityIDsByQueryPOSTV2	returns the release notes for the IDs in the request with EA and GA dates in ISO 8601 format
QueryReleaseNotesV1	Queries for release-notes resources and returns ids

Detects

Operation ID	Description
GetAggregateDetects	Deprecated: This endpoint will be decommissioned on September 30, 2025.
GetDetectSummaries	Deprecated: This endpoint will be decommissioned on September 30, 2025.
QueryDetects	Deprecated: This endpoint will be decommissioned on September 30, 2025.
UpdateDetectsByIdsV2	Deprecated: This endpoint will be decommissioned on September 30, 2025.

Device Content

Operation ID	Description
entities.states.v1	Retrieve the host content state for a number of ids between 1 and 100.
queries.states.v1	Query for the content state of the host.

Device Control Policies

Operation ID	Description
createDeviceControlPolicies	Create Device Control Policies by specifying details about the policy to create
deleteDeviceControlPolicies	Delete a set of Device Control Policies by specifying their IDs
getDefaultDeviceControlPolicies	Retrieve the configuration for a Default Device Control Policy
getDefaultDeviceControlSettings	Get default device control settings (USB and Bluetooth)
getDeviceControlPolicies	Retrieve a set of Device Control Policies by specifying their IDs
getDeviceControlPoliciesV2	Get device control policies for the given filter criteria.
patchDeviceControlPoliciesClassesV1	Update device control policy’s classes (USB and Bluetooth)
patchDeviceControlPoliciesV2	Update device control policy base (USB and Bluetooth)
performDeviceControlPoliciesAction	Perform the specified action on the Device Control Policies specified in the request
postDeviceControlPoliciesV2	Create/clone a device control policy (USB and Bluetooth)
queryCombinedDeviceControlPolicies	Search for Device Control Policies in your environment by providing an FQL filter and paging details.
queryCombinedDeviceControlPolicyMembers	Search for members of a Device Control Policy in your environment by providing an FQL filter and paging details.
queryDeviceControlPolicies	Search for Device Control Policies in your environment by providing an FQL filter and paging details.
queryDeviceControlPolicyMembers	Search for members of a Device Control Policy in your environment by providing an FQL filter and paging details.
setDeviceControlPoliciesPrecedence	Sets the precedence of Device Control Policies based on the order of IDs specified in the request.
updateDefaultDeviceControlPolicies	Update the configuration for a Default Device Control Policy
updateDefaultDeviceControlSettings	Update the configuration for Default Device Control Settings
updateDeviceControlPolicies	Update Device Control Policies by specifying the ID of the policy and details to update

Discover

Operation ID	Description
combined-applications	Search for applications in your environment by providing an FQL filter and paging details.
combined-hosts	Search for assets in your environment by providing an FQL (Falcon Query Language) filter and paging details.
get-accounts	Get details on accounts by providing one or more IDs.
get-applications	Get details on applications by providing one or more IDs.
get-hosts	Get details on assets by providing one or more IDs.
get-iot-hosts	Get details on IoT assets by providing one or more IDs.
get-logins	Get details on logins by providing one or more IDs.
query-accounts	Search for accounts in your environment by providing an FQL (Falcon Query Language) filter and paging details.
query-applications	Search for applications in your environment by providing an FQL filter and paging details. returns a set of application IDs which match the filter criteria.
query-hosts	Search for assets in your environment by providing an FQL (Falcon Query Language) filter and paging details.
query-iot-hosts	Search for IoT assets in your environment by providing an FQL (Falcon Query Language) filter and paging details.
query-iot-hostsV2	Search for IoT assets in your environment by providing an FQL (Falcon Query Language) filter and paging details.
query-logins	Search for logins in your environment by providing an FQL (Falcon Query Language) filter and paging details.

Downloads

Operation ID	Description
DownloadFile	Gets pre-signed URL for the file
EnumerateFile	Enumerates a list of files available for CID
FetchFilesDownloadInfo	Get files info and pre-signed download URLs
FetchFilesDownloadInfoV2	Get cloud security tools info and pre-signed download URLs

Drift Indicators

Operation ID	Description
GetDriftIndicatorsValuesByDate	Returns the count of Drift Indicators by the date. by default it’s for 7 days.
ReadDriftIndicatorEntities	Retrieve Drift Indicator entities identified by the provided IDs
ReadDriftIndicatorsCount	Returns the total count of Drift indicators over a time period
SearchAndReadDriftIndicatorEntities	Retrieve Drift Indicators by the provided search criteria
SearchDriftIndicators	Retrieve all drift indicators that match the given query

Event Streams

Operation ID	Description
listAvailableStreamsOAuth2	Discover all event streams in your environment
refreshActiveStreamSession	Refresh an active event stream.

Exposure Management

Operation ID	Description
aggregate-external-assets	Returns external assets aggregates.
blob-download-external-assets	Download the entire contents of the blob.
blob-preview-external-assets	Download a preview of the blob.
combined-ecosystem-subsidiaries	Retrieves a list of ecosystem subsidiaries with their detailed information.
delete-external-assets	Delete multiple external assets.
get-ecosystem-subsidiaries	Retrieves detailed information about ecosystem subsidiaries by ID.
get-external-assets	Get details on external assets by providing one or more IDs.
patch-external-assets	Update the details of external assets.
post-external-assets-inventory-v1	Add external assets for external asset scanning.
query-ecosystem-subsidiaries	Retrieves a list of IDs for ecosystem subsidiaries.
query-external-assets	Get a list of external asset IDs that match the provided filter conditions.
query-external-assets-v2	Get a list of external asset IDs that match the provided filter conditions.

FaaS Execution

Operation ID	Description
ReadRequestBody	retrieve a large request body, such as a file, that has spilled into object storage

Falcon Complete Dashboard

Operation ID	Description
AggregateAlerts	Retrieve aggregate epp alerts values based on the matched filter
AggregateAllowList	Retrieve aggregate allowlist ticket values based on the matched filter
AggregateBlockList	Retrieve aggregate blocklist ticket values based on the matched filter
AggregateDeviceCountCollection	Retrieve aggregate host/devices count based on the matched filter
AggregateEscalations	Retrieve aggregate escalation ticket values based on the matched filter
AggregatePreventionPolicy	Retrieve prevention policies aggregate values based on the matched filter
AggregateRemediations	Retrieve aggregate remediation ticket values based on the matched filter
AggregateSensorUpdatePolicy	Retrieve sensor update policies aggregate values
AggregateSupportIssues	Retrieve aggregate support issue ticket values based on the matched filter
AggregateTotalDeviceCounts	Retrieve aggregate total host/devices based on the matched filter
GetDeviceCountCollectionQueriesByFilter	Retrieve device count collection Ids that match the provided FQL filter, criteria with scrolling enabled
QueryAlertIdsByFilter	Retrieve Alerts Ids for epp that match the provided FQL filter criteria with scrolling enabled
QueryAlertIdsByFilterV2	Retrieve Alerts Ids for epp, idp and ngsiem that match the provided FQL filter criteria with scrolling enabled
QueryAllowListFilter	Retrieve allowlist tickets that match the provided filter criteria with scrolling enabled
QueryBlockListFilter	Retrieve block listtickets that match the provided filter criteria with scrolling enabled
QueryEscalationsFilter	Retrieve escalation tickets that match the provided filter criteria with scrolling enabled
QueryRemediationsFilter	Retrieve remediation tickets that match the provided filter criteria with scrolling enabled

Falcon Container

Operation ID	Description
CreateRegistryEntities	Create a registry entity using the provided details
DeleteImageDetails	Delete Images by ids.
DeleteRegistryEntities	Delete the registry entity identified by the entity UUID
DownloadExportFile	Download an export file
GetCredentials	Gets the registry credentials
GetImageAssessmentReport	Retrieves the Assessment report for the Image ID provided.
GetReportByReference	Get image assessment scan report by image reference (v2)
GetReportByScanID	Get image assessment scan report by scan UUID (v2)
HeadImageScanInventory	Get headers for POST request for image scan inventory
ImageMatchesPolicy	After an image scan, use this operation to see if any images match a policy.
LaunchExportJob	Launch an export job of a Container Security resource.
PolicyChecks	Check image prevention policies
PostImageScanInventory	Post image scan inventory
QueryExportJobs	Query export jobs entities
ReadExportJobs	Read export jobs entities
ReadImageVulnerabilities	Retrieve known vulnerabilities for the provided image
ReadRegistryEntities	Retrieves a list of registry entities identified by the customer id.
ReadRegistryEntitiesByUUID	Retrieves a list of registry entities by the provided UUIDs.
UpdateRegistryEntities	Update the registry entity, as identified by the entity UUID, using the provided details

Falcon ID

Operation ID	Description
DeleteThirdPartyPasskeyRegistry	Deletes third party passkey registries
GetThirdPartyPasskeyRegistry	Fetches third party passkey registries
QueryThirdPartyPasskeyRegistry	Query third party passkey registries
UpdateThirdPartyPasskeyRegistry	Updates third party passkey registries

Falconx Sandbox

Operation ID	Description
DeleteReport	Delete report based on the report ID.
DeleteSampleV2	Removes a sample, including file, meta and submissions from the collection
GetArtifacts	Download IOC packs, PCAP files, memory dumps, and other analysis artifacts.
GetMemoryDump	Get memory dump content, as binary
GetMemoryDumpExtractedStrings	Get extracted strings from a memory dump
GetMemoryDumpHexDump	Get hex view of a memory dump
GetReports	Get a full sandbox report.
GetSampleV2	Retrieves the file associated with the given ID (SHA256)
GetSubmissions	Check the status of a sandbox analysis.
GetSummaryReports	Get a short summary version of a sandbox report.
QueryReports	Find sandbox reports by providing an FQL filter and paging details.
QuerySampleV1	Retrieves a list with sha256 of samples that exist and customer has rights to access them, maximum number of accepted items is 200
QuerySubmissions	Find submission IDs for uploaded files by providing an FQL filter and paging details.
Submit	Submit an uploaded file or a URL for sandbox analysis.
UploadSampleV2	Upload a file for sandbox analysis.

FDR

Operation ID	Description
fdrschema.combined.event.get	Fetch combined schema
fdrschema.entities.event.get	Fetch event schema by ID
fdrschema.entities.field.get	Fetch field schema by ID
fdrschema.queries.event.get	Get list of event IDs given a particular query.
fdrschema.queries.field.get	Get list of field IDs given a particular query.

Federated Connections

Operation ID	Description
DeleteFederatedConnectionsConfig	Delete configuration for a federated connection
PatchFederatedConnectionsConfig	Update configuration for a federated connection
PostFederatedConnectionsConfig	Create configuration for a federated connection

FileVantage

Operation ID	Description
createPolicies	Creates a new policy of the specified type.
createRuleGroups	Creates a new rule group of the specified type.
createRules	Creates a new rule configuration within the specified rule group.
createScheduledExclusions	Creates a new scheduled exclusion configuration for the provided policy id.
deletePolicies	Deletes 1 or more policies.
deleteRuleGroups	Deletes 1 or more rule groups
deleteRules	Deletes 1 or more rules from the specified rule group.
deleteScheduledExclusions	Deletes 1 or more scheduled exclusions from the provided policy id.
getActionsMixin0	Retrieves the processing results for 1 or more actions.
getChanges	Retrieve information on changes
getContents	Retrieves the content captured for the provided change id
getPolicies	Retrieves the configuration for 1 or more policies.
getRuleGroups	Retrieves the rule group details for 1 or more rule groups.
getRules	Retrieves the configuration for 1 or more rules.
getScheduledExclusions	Retrieves the configuration of 1 or more scheduled exclusions from the provided policy id.
highVolumeQueryChanges	Returns 1 or more change ids
queryActionsMixin0	Returns one or more action ids
queryChanges	Returns 1 or more change ids
queryPolicies	Retrieve the ids of all policies that are assigned the provided policy type.
queryRuleGroups	Retrieve the ids of all rule groups that are of the provided rule group type.
queryScheduledExclusions	Retrieve the ids of all scheduled exclusions contained within the provided policy id.
signalChangesExternal	Initiates workflows for the provided change ids
startActions	Initiates the specified action on the provided change ids
updatePolicies	Updates the general information of the provided policy.
updatePolicyHostGroups	Manage host groups assigned to a policy.
updatePolicyPrecedence	Updates the policy precedence for all policies of a specific type.
updatePolicyRuleGroups	Manage the rule groups assigned to the policy or set the rule group precedence for all rule groups within the policy.
updateRuleGroupPrecedence	Updates the rule precedence for all rules in the identified rule group.
updateRuleGroups	Updates the provided rule group.
updateRules	Updates the provided rule configuration within the specified rule group.
updateScheduledExclusions	Updates the provided scheduled exclusion configuration within the provided policy.

Firewall Management

Operation ID	Description
aggregate-events	Aggregate events for customer
aggregate-policy-rules	Aggregate rules within a policy for customer
aggregate-rule-groups	Aggregate rule groups for customer
aggregate-rules	Aggregate rules for customer
create-network-locations	Create new network locations provided, and return the ID.
create-rule-group	Create new rule group on a platform for a customer with a name and description, and return the ID
create-rule-group-validation	Validates the request of creating a new rule group on a platform for a customer with a name and description
delete-network-locations	Delete network location entities by ID.
delete-rule-groups	Delete rule group entities by ID
get-events	Get events entities by ID and optionally version
get-firewall-fields	Get the firewall field specifications by ID
get-network-locations	Get a summary of network locations entities by ID
get-network-locations-details	Get network locations entities by ID
get-platforms	Get platforms by ID, e.g., windows or mac or droid
get-policy-containers	Get policy container entities by policy ID
get-rule-groups	Get rule group entities by ID.
get-rules	Get rule entities by ID (64-bit unsigned int as decimal string) or Family ID (32-character hexadecimal string)
query-events	Find all event IDs matching the query with filter
query-firewall-fields	Get the firewall field specification IDs for the provided platform
query-network-locations	Get a list of network location IDs
query-platforms	Get the list of platform names
query-policy-rules	Find all firewall rule IDs matching the query with filter, and return them in precedence order
query-rule-groups	Find all rule group IDs matching the query with filter
query-rules	Find all rule IDs matching the query with filter
update-network-locations	Updates the network locations provided, and return the ID.
update-network-locations-metadata	Updates the network locations metadata such as polling_intervals for the cid
update-network-locations-precedence	Updates the network locations precedence according to the list of ids provided.
update-policy-container	Update an identified policy container, including local logging functionality.
update-policy-container-v1	Update an identified policy container.
update-rule-group	Update name, description, or enabled status of a rule group, or create, edit, delete, or reorder rules
update-rule-group-validation	Validates the request of updating name, description, or enabled status of a rule group, or create, edit, delete, or reorder rules
upsert-network-locations	Updates the network locations provided, and return the ID.
validate-filepath-pattern	Validates that the test pattern matches the executable filepath glob pattern.

Firewall Policies

Operation ID	Description
createFirewallPolicies	Create Firewall Policies by specifying details about the policy to create
deleteFirewallPolicies	Delete a set of Firewall Policies by specifying their IDs
getFirewallPolicies	Retrieve a set of Firewall Policies by specifying their IDs
performFirewallPoliciesAction	Perform the specified action on the Firewall Policies specified in the request
queryCombinedFirewallPolicies	Search for Firewall Policies in your environment by providing an FQL filter and paging details.
queryCombinedFirewallPolicyMembers	Search for members of a Firewall Policy in your environment by providing an FQL filter and paging details.
queryFirewallPolicies	Search for Firewall Policies in your environment by providing an FQL filter and paging details.
queryFirewallPolicyMembers	Search for members of a Firewall Policy in your environment by providing an FQL filter and paging details.
setFirewallPoliciesPrecedence	Sets the precedence of Firewall Policies based on the order of IDs specified in the request.
updateFirewallPolicies	Update Firewall Policies by specifying the ID of the policy and details to update

Foundry LogScale

Operation ID	Description
CreateSavedSearchesDynamicExecuteV1	Execute a dynamic saved search
CreateSavedSearchesExecuteV1	Execute a saved search
CreateSavedSearchesIngestV1	Populate a saved search
GetSavedSearchesExecuteV1	Get the results of a saved search
GetSavedSearchesJobResultsDownloadV1	Get the results of a saved search as a file
IngestDataAsyncV1	Asynchronously ingest data into the application repository
IngestDataV1	Synchronously ingest data into the application repository
ListReposV1	Lists available repositories
ListViewV1	List available views

Foundry Lookup Files

Operation ID	Description
CreateFileV1	Creates a lookup file within a foundry app
UpdateFileV1	Updates a lookup file within a Foundry app

Host Group

Operation ID	Description
createHostGroups	Create Host Groups by specifying details about the group to create
deleteHostGroups	Delete a set of Host Groups by specifying their IDs
getHostGroups	Retrieve a set of Host Groups by specifying their IDs
performGroupAction	Perform the specified action on the Host Groups specified in the request
queryCombinedGroupMembers	Search for members of a Host Group in your environment by providing an FQL filter and paging details.
queryCombinedHostGroups	Search for Host Groups in your environment by providing an FQL filter and paging details.
queryGroupMembers	Search for members of a Host Group in your environment by providing an FQL filter and paging details.
queryHostGroups	Search for Host Groups in your environment by providing an FQL filter and paging details.
updateHostGroups	Update Host Groups by specifying the ID of the group and details to update

Host Migration

Operation ID	Description
CreateMigrationV1	Create a device migration job.
GetHostMigrationIDsV1	Query host migration IDs.
GetHostMigrationsV1	Get host migration details.
GetMigrationDestinationsV1	Get destinations for a migration.
GetMigrationIDsV1	Query migration jobs.
GetMigrationsV1	Get migration job details.
HostMigrationAggregatesV1	Get host migration aggregates as specified via json in request body.
HostMigrationsActionsV1	Perform an action on host migrations.
MigrationAggregatesV1	Get migration aggregates as specified via json in request body.
MigrationsActionsV1	Perform an action on a migration job.

Hosts

Operation ID	Description
CombinedDevicesByFilter	Search for hosts in your environment by platform, hostname, IP, and other criteria.
CombinedHiddenDevicesByFilter	Search for hidden hosts in your environment by platform, hostname, IP, and other criteria.
DevicesActionsDeleteV1	Permanently delete hosts from the system.
entities.perform_action	Performs the specified action on the provided group IDs.
GetDeviceDetails	Get details on one or more hosts by providing host IDs in a POST body.
GetDeviceDetailsV1	Get details on one or more hosts by providing agent IDs (AID).
GetDeviceDetailsV2	Get details on one or more hosts by providing host IDs as a query parameter.
GetOnlineState.V1	Get the online status for one or more hosts by specifying each host’s unique ID.
PerformActionV2	Take various actions on the hosts in your environment.
PostDeviceDetailsV2	Get details on one or more hosts by providing host IDs in a POST body.
QueryDeviceLoginHistory	Retrieve details about recent login sessions for a set of devices.
QueryDeviceLoginHistoryV2	Retrieve details about recent interactive login sessions for a set of devices powered by the Host Timeline.
QueryDevicesByFilter	Search for hosts in your environment by platform, hostname, IP, and other criteria.
QueryDevicesByFilterScroll	Search for hosts in your environment by platform, hostname, IP, and other criteria with continuous pagination capability (based on offset pointer which expires after 2 minutes with no maximum limit)
QueryGetNetworkAddressHistoryV1	Retrieve history of IP and MAC addresses of devices.
QueryHiddenDevices	Retrieve hidden hosts that match the provided filter criteria.
UpdateDeviceTags	Append or remove one or more Falcon Grouping Tags on one or more hosts.

Identity Protection

Operation ID	Description
api_preempt_proxy_post_graphql	Identity Protection GraphQL API.
delete_policy_rules	Delete policy rules
delete_policy_rules	Delete policy rules
get_policy_rules	Get policy rules
get_policy_rules	Get policy rules
get_policy_rules_query	Query policy rule IDs
get_policy_rules_query	Query policy rule IDs
GetSensorAggregates	Get sensor aggregates as specified via json in request body.
GetSensorDetails	Get details on one or more sensors by providing device IDs in a POST body.
post_policy_rules	Create policy rule
post_policy_rules	Create policy rule
QuerySensorsByFilter	Search for sensors in your environment by hostname, IP, and other criteria.

Image Assessment Policies

Operation ID	Description
CreatePolicies	Create Image Assessment policies
CreatePolicyGroups	Create Image Assessment Policy Group entities
DeletePolicy	Delete Image Assessment Policy by policy UUID
DeletePolicyGroup	Delete Image Assessment Policy Group entities
ReadPolicies	Get all Image Assessment policies
ReadPolicyExclusions	Retrieve Image Assessment Policy Exclusion entities
ReadPolicyGroups	Retrieve Image Assessment Policy Group entities
UpdatePolicies	Update Image Assessment Policy entities
UpdatePolicyExclusions	Update Image Assessment Policy Exclusion entities
UpdatePolicyGroups	Update Image Assessment Policy Group entities
UpdatePolicyPrecedence	Update Image Assessment Policy precedence

Installation Tokens

Operation ID	Description
audit-events-query	Search for audit events by providing an FQL filter and paging details.
audit-events-read	Gets the details of one or more audit events by id.
customer-settings-read	Check current installation token settings.
customer-settings-update	Update installation token settings.
tokens-create	Creates a token.
tokens-delete	Deletes a token immediately.
tokens-query	Search for tokens by providing an FQL filter and paging details.
tokens-read	Gets the details of one or more tokens by id.
tokens-update	Updates one or more tokens.

Intel

Operation ID	Description
cao_incidents_aggregates_v1	Perform statistical aggregations over incident data.
cao_incidents_entities_v1	Retrieve full details for one or more adversary incidents by their IDs.
cao_incidents_queries_v1	Search for adversary incidents using FQL criteria and return a paginated list of matching incident IDs.
GetIntelActorEntities	Retrieve specific actors using their actor IDs.
GetIntelIndicatorEntities	Retrieve specific indicators using their indicator IDs.
GetIntelReportEntities	Retrieve specific reports using their report IDs.
GetIntelReportPDF	Return a Report PDF attachment
GetIntelRuleEntities	Retrieve details for rule sets for the specified ids.
GetIntelRuleFile	Download earlier rule sets.
GetLatestIntelRuleFile	Download the latest rule set.
GetMalwareEntities	Get malware entities for specified ids.
GetMalwareMitreReport	Export Mitre ATT&CK information for a given malware family.
GetMitreReport	Export Mitre ATT&CK information for a given actor.
GetVulnerabilities	Get vulnerabilities
PostMitreAttacks	Retrieves report and observable IDs associated with the given actor and attacks
QueryIntelActorEntities	Get info about actors that match provided FQL filters.
QueryIntelActorIds	Get actor IDs that match provided FQL filters.
QueryIntelIndicatorEntities	Get info about indicators that match provided FQL filters.
QueryIntelIndicatorIds	Get indicators IDs that match provided FQL filters.
QueryIntelReportEntities	Get info about reports that match provided FQL filters.
QueryIntelReportIds	Get report IDs that match provided FQL filters.
QueryIntelRuleIds	Search for rule IDs that match provided filter criteria.
QueryMalware	Get malware family names that match provided FQL filters.
QueryMalwareEntities	Get malware entities that match provided FQL filters.
QueryMitreAttacks	Gets MITRE tactics and techniques for the given actor, returning concatenation of id and tactic and technique ids, example: fancy-bear_TA0011_T1071
QueryMitreAttacksForMalware	Gets MITRE tactics and techniques for the given malware
QueryVulnerabilities	Get vulnerabilities IDs

Intelligence Feeds

Operation ID	Description
DownloadFeedArchive	Downloads the content as a zip archive for a given feed item ID
ListFeedTypes	Lists the accessible feed types for a given customer
QueryFeedArchives	Queries the accessible feed types for a customer.

Intelligence Indicator Graph

Operation ID	Description
LookupIndicators	Get indicators based on their value.
SearchIndicators	Search indicators based on FQL filter.

IOA Exclusions

Operation ID	Description
createIOAExclusionsV1	Create the IOA exclusions
deleteIOAExclusionsV1	Delete the IOA exclusions by id
getIOAExclusionsV1	Get a set of IOA Exclusions by specifying their IDs
queryIOAExclusionsV1	Search for IOA exclusions.
ss-ioa-exclusions.aggregates.v2	Get Self Service IOA Exclusion aggregates as specified via json in the request body.
ss-ioa-exclusions.create.v2	Create new Self Service IOA Exclusions.
ss-ioa-exclusions.delete.v2	Delete the Self Service IOA Exclusions rule by id.
ss-ioa-exclusions.get-reports.v2	Create a report of Self Service IOA Exclusions scoped by the given filters
ss-ioa-exclusions.get.v2	Get the Self Service IOA Exclusions rules by id.
ss-ioa-exclusions.matched-rule.v2	Get Self Service IOA Exclusions rules for matched IFN/CLI for child, parent and grandparent
ss-ioa-exclusions.new-rules.v2	Get defaults for Self Service IOA Exclusions based on provided IFN/CLI for child, parent and grandparent.
ss-ioa-exclusions.search.v2	Search for Self Service IOA Exclusions.
ss-ioa-exclusions.update.v2	Update the Self Service IOA Exclusions rule by id.
updateIOAExclusionsV1	Update the IOA exclusions

IOC

Operation ID	Description
action.get.v1	Get Actions by ids.
action.query.v1	Query Actions.
GetIndicatorsReport	Launch an indicators report creation job
indicator.aggregate.v1	Get Indicators aggregates as specified via json in the request body.
indicator.combined.v1	Get Combined for Indicators.
indicator.create.v1	Create Indicators.
indicator.delete.v1	Delete Indicators by ids.
indicator.get.device_count.v1	Get the number of devices the indicator has run on
indicator.get.devices_ran_on.v1	Get the IDs of devices the indicator has run on
indicator.get.processes_ran_on.v1	Get the number of processes the indicator has run on
indicator.get.v1	Get Indicators by ids.
indicator.sdmf-query.v1	Executes an SDMF data frame query against IOC indicators
indicator.search.v1	Search for Indicators.
indicator.update.v1	Update Indicators.
ioc_type.query.v1	Query IOC Types.
platform.query.v1	Query Platforms.
severity.query.v1	Query Severities.

IOCs

Operation ID	Description
CreateIOC	Create a new IOC. *** Deprecated - Use the new IOC Management endpoint (POST /iocs/entities/indicators/v1). ***
DeleteIOC	Delete an IOC by providing a type and value. *** Deprecated - Use the new IOC Management endpoint (DELETE /iocs/entities/indicators/v1). ***
DevicesCount	Number of hosts in your customer account that have observed a given custom IOC
DevicesRanOn	Find hosts that have observed a given custom IOC.
entities.processes	For the provided ProcessID retrieve the process details
GetIOC	Get an IOC by providing a type and value. *** Deprecated - Use the new IOC Management endpoint (GET /iocs/entities/indicators/v1). ***
ProcessesRanOn	Search for processes associated with a custom IOC
QueryIOCs	Search the custom IOCs in your customer account. *** Deprecated - Use the new IOC Management endpoint (GET /iocs/queries/indicators/v1). ***
UpdateIOC	Update an IOC by providing a type and value. *** Deprecated - Use the new IOC Management endpoint (PATCH /iocs/entities/indicators/v1). ***

IT Automation

Operation ID	Description
ITAutomationCancelTaskExecution	Cancel a task execution specified in the request
ITAutomationCombinedScheduledTasks	Returns full details of scheduled tasks matching the filter query parameter.
ITAutomationCreatePolicy	Creates a new policy of the specified type.
ITAutomationCreateScheduledTask	Creates a scheduled task from the given request
ITAutomationCreateTask	Creates a task with details from the given request.
ITAutomationCreateTaskGroup	Creates a task group from the given request
ITAutomationCreateUserGroup	Creates a user group from the given request
ITAutomationDeletePolicy	Deletes 1 or more policies.
ITAutomationDeleteScheduledTasks	Delete one or more scheduled tasks by providing the scheduled tasks IDs
ITAutomationDeleteTask	Deletes tasks for each provided ID
ITAutomationDeleteTaskGroups	Delete one or more task groups by providing the task group IDs
ITAutomationDeleteUserGroup	Deletes user groups for each provided ids
ITAutomationGetAssociatedTasks	Retrieve tasks associated with the provided file id
ITAutomationGetExecutionResults	Get the task execution results from an async search.
ITAutomationGetExecutionResultsSearchStatus	Get the status of an async task execution results.
ITAutomationGetPolicies	Retrieves the configuration for 1 or more policies.
ITAutomationGetScheduledTasks	Returns scheduled tasks for each provided id
ITAutomationGetTaskExecution	Get the task execution for the provided task execution IDs
ITAutomationGetTaskExecutionHostStatus	Get the status of host executions by providing the execution IDs
ITAutomationGetTaskExecutionsByQuery	Returns the list of task executions (and their details) matching the filter query parameter.
ITAutomationGetTaskGroups	Returns task groups for each provided id
ITAutomationGetTaskGroupsByQuery	Returns full details of task groups matching the filter query parameter.
ITAutomationGetTasks	Returns tasks for each provided ID
ITAutomationGetTasksByQuery	Returns full details of tasks matching the filter query parameter.
ITAutomationGetUserGroup	Returns user groups for each provided id
ITAutomationQueryPolicies	Returns the list of policy ids matching the filter query parameter.
ITAutomationRerunTaskExecution	Rerun the task execution specified in the request
ITAutomationRunLiveQuery	Starts a new task execution from the provided query data in the request and returns the initiated task executions
ITAutomationSearchScheduledTasks	Returns the list of scheduled task IDs matching the filter query parameter
ITAutomationSearchTaskExecutions	Returns the list of task execution IDs matching the filter query parameter.
ITAutomationSearchTaskGroups	Returns the list of task group ids matching the filter query parameter
ITAutomationSearchTasks	Returns the list of task IDs matching the filter query parameter.
ITAutomationSearchUserGroup	Returns the list of user group ids matching the filter query parameter.
ITAutomationStartExecutionResultsSearch	Starts an async task execution results search.
ITAutomationStartTaskExecution	Starts a new task execution from an existing task provided in the request and returns the initiated task executions
ITAutomationUpdatePolicies	Updates a new policy of the specified type.
ITAutomationUpdatePoliciesPrecedence	Updates the policy precedence for all policies of a specific platform.
ITAutomationUpdatePolicyHostGroups	Manage host groups assigned to a policy.
ITAutomationUpdateScheduledTask	Update an existing scheduled task with the supplied info
ITAutomationUpdateTask	Update a task with details from the given request.
ITAutomationUpdateTaskGroup	Update a task group for a given id
ITAutomationUpdateUserGroup	Update a user group for a given id

Knowledge Base Audit Events

Operation ID	Description
CombinedKnowledgeBaseAuditEventsV1	Get knowledge base audit events with full event details and pagination.
EntitiesKnowledgeBaseAuditEventsV1	Retrieve knowledge base audit event entities by their IDs.
QueriesKnowledgeBaseAuditEventsV1	Query knowledge base audit event IDs with pagination and filtering.

Knowledge Base Files

Operation ID	Description
EntitiesKnowledgeBaseFilesCreateV1	Upload a file to a knowledge base.
EntitiesKnowledgeBaseFilesDeleteV1	Delete document from knowledge base.
EntitiesKnowledgeBaseFilesDownloadV1	Download knowledge base file entities for the provided id.
EntitiesKnowledgeBaseFilesUpdateV1	Update an existing file in a knowledge base.
EntitiesKnowledgeBaseFilesV1	Retrieve knowledge base file entities for the provided id.
QueriesKnowledgeBaseFilesV1	Query knowledge base files based on the provided filters.

Knowledge Bases

Operation ID	Description
CombinedKnowledgeBasesV1	Search for knowledge bases with filtering and return full entity details in a single response.
EntitiesKnowledgeBasesCreateV1	Create or update a knowledge base.
EntitiesKnowledgeBasesUpdateV1	Update an existing knowledge base.
EntitiesKnowledgeBasesV1	Retrieve knowledge base entities for the provided id.
QueriesKnowledgeBasesV1	Query knowledge bases based on the provided filters.

Kubernetes Container Compliance

Operation ID	Description
AggregateAssessmentsGroupedByClustersV2	Returns cluster details along with aggregated assessment results organized by cluster, including pass/fail assessment counts for various asset types.
AggregateAssessmentsGroupedByRulesV2	Returns rule details along with aggregated assessment results organized by compliance rule, including pass/fail assessment counts.
AggregateComplianceByAssetType	Provides aggregated compliance assessment metrics and rule status information, organized by asset type.
AggregateComplianceByClusterType	Provides aggregated compliance assessment metrics and rule status information, organized by Kubernetes cluster type.
AggregateComplianceByFramework	Provides aggregated compliance assessment metrics and rule status information, organized by compliance framework.
AggregateFailedRulesByClustersV3	Retrieves the most non-compliant clusters, ranked in descending order based on the number of failed compliance rules across severity levels (critical, high, medium, and low).
AggregateTopFailedImages	Retrieves the most non-compliant container images, ranked in descending order based on the number of failed assessments across severity levels (critical, high, medium, and low).
CombinedImagesFindings	Returns detailed compliance assessment results for container images, providing the information needed to identify compliance violations.
CombinedNodesFindings	Returns detailed compliance assessment results for kubernetes nodes, providing the information needed to identify compliance violations.
getRulesMetadataByID	Retrieve detailed compliance rule information including descriptions, remediation steps, and audit procedures by specifying rule identifiers.

Kubernetes Protection

Operation ID	Description
CreateAWSAccount	Creates a new AWS account in our system for a customer and generates the installation script
CreateAzureSubscription	Creates a new Azure Subscription in our system
DeleteAWSAccountsMixin0	Delete AWS accounts.
DeleteAzureSubscription	Deletes a new Azure Subscription in our system
FindContainersByContainerRunTimeVersion	Retrieve containers by container_runtime_version
FindContainersCountAffectedByZeroDayVulnerabilities	Retrieve containers count affected by zero day vulnerabilities
GetAWSAccountsMixin0	Provides a list of AWS accounts.
GetAzureInstallScript	Provides the script to run for a given tenant id and subscription IDs
GetAzureTenantConfig	Gets the Azure tenant Config
GetAzureTenantIDs	Provides all the azure subscriptions and tenants
GetClusters	Provides the clusters acknowledged by the Kubernetes Protection service
GetCombinedCloudClusters	Returns a combined list of provisioned cloud accounts and known kubernetes clusters
GetHelmValuesYaml	Provides a sample Helm values.yaml file for a customer to install alongside the agent Helm chart
GetLocations	Provides the cloud locations acknowledged by the Kubernetes Protection service
GetStaticScripts	Gets static bash scripts that are used during registration
GroupContainersByManaged	Group the containers by Managed
ListAzureAccounts	Provides the azure subscriptions registered to Kubernetes Protection
PatchAzureServicePrincipal	Adds the client ID for the given tenant ID to our system
PostAggregatesPods	Get aggregate query result for pods
PostSearchKubernetesIOMEntities	Search for Kubernetes IOMs with filtering options.Pagination is supported via Elasticsearch’s search_after search param and point in time.
ReadClusterCombined	Retrieve kubernetes clusters identified by the provided filter criteria
ReadClusterCombinedV2	Retrieve Kubernetes cluster data
ReadClusterCount	Retrieve cluster counts
ReadClusterEnrichment	Retrieve cluster enrichment data
ReadClustersByDateRangeCount	Retrieve clusters by date range counts
ReadClustersByKubernetesVersionCount	Bucket clusters by kubernetes version
ReadClustersByStatusCount	Bucket clusters by status
ReadContainerCombined	Retrieves a paginated list of containers identified by the provided filter criteria.
ReadContainerCount	Retrieve container counts
ReadContainerCountByRegistry	Retrieves a list with the top container image registries.
ReadContainerEnrichment	Retrieve container enrichment data
ReadContainerImageDetectionsCountByDate	Retrieve count of image assessment detections on running containers over a period of time
ReadContainerImagesByMostUsed	Bucket container by image-digest
ReadContainerImagesByState	Retrieve count of image states running on containers
ReadContainersByDateRangeCount	Retrieve containers by date range counts
ReadContainersSensorCoverage	Bucket containers by agent type and calculate sensor coverage
ReadContainerVulnerabilitiesBySeverityCount	Retrieve container vulnerabilities by severity counts
ReadDeploymentCombined	Retrieve kubernetes deployments identified by the provided filter criteria
ReadDeploymentCount	Retrieve deployment counts
ReadDeploymentEnrichment	Retrieve deployment enrichment data
ReadDeploymentsByDateRangeCount	Retrieve deployments by date range counts
ReadDistinctContainerImageCount	Retrieve count of distinct images running on containers
ReadKubernetesIomByDateRange	Returns the count of Kubernetes IOMs by the date. by default it’s for 7 days.
ReadKubernetesIomCount	Returns the total count of Kubernetes IOMs over the past seven days
ReadKubernetesIomEntities	Retrieve Kubernetes IOM entities identified by the provided IDs
ReadNamespaceCount	Retrieve namespace counts
ReadNamespacesByDateRangeCount	Retrieve namespaces by date range counts
ReadNodeCombined	Retrieve kubernetes nodes identified by the provided filter criteria
ReadNodeCount	Retrieve node counts
ReadNodeEnrichment	Retrieve node enrichment data
ReadNodesByCloudCount	Bucket nodes by cloud providers
ReadNodesByContainerEngineVersionCount	Bucket nodes by their container engine version
ReadNodesByDateRangeCount	Retrieve nodes by date range counts
ReadPodCombined	Retrieve kubernetes pods identified by the provided filter criteria
ReadPodCount	Retrieve pod counts
ReadPodEnrichment	Retrieve pod enrichment data
ReadPodsByDateRangeCount	Retrieve pods by date range counts
ReadRunningContainerImages	Retrieve images on running containers
ReadVulnerableContainerImageCount	Retrieve count of vulnerable images running on containers
RegenerateAPIKey	Regenerate API key for docker registry integrations
SearchAndReadKubernetesIomEntities	Retrieves a list of Kubernetes IOMs identified by the provided search criteria.
SearchKubernetesIoms	Search Kubernetes IOMs by the provided search criteria. this endpoint returns a list of Kubernetes IOM UUIDs matching the query
TriggerScan	Triggers a dry run or a full scan of a customer’s kubernetes footprint
UpdateAWSAccount	Updates the AWS account per the query parameters provided

MalQuery

Operation ID	Description
GetMalQueryDownloadV1	Download a file indexed by MalQuery.
GetMalQueryEntitiesSamplesFetchV1	Fetch a zip archive with password ‘infected’ containing the samples.
GetMalQueryMetadataV1	Retrieve indexed files metadata by their hash
GetMalQueryQuotasV1	Get information about search and download quotas in your environment
GetMalQueryRequestV1	Check the status and results of an asynchronous request, such as hunt or exact-search.
PostMalQueryEntitiesSamplesMultidownloadV1	Schedule samples for download.
PostMalQueryExactSearchV1	Search Falcon MalQuery for a combination of hex patterns and strings in order to identify samples based upon file content at byte level granularity.
PostMalQueryFuzzySearchV1	Search Falcon MalQuery quickly, but with more potential for false positives.
PostMalQueryHuntV1	Schedule a YARA-based search for execution.

Message Center

Operation ID	Description
AggregateCases	Retrieve aggregate case values based on the matched filter
CaseAddActivity	Add an activity to case.
CaseAddAttachment	Upload an attachment for the case.
CaseDownloadAttachment	retrieves an attachment for the case, given the attachment id
CreateCaseV2	create a new case
GetCaseActivityByIds	Retrieve activities for given id’s
GetCaseEntitiesByIDs	Retrieve message center cases
QueryActivityByCaseID	Retrieve activities id’s for a case
QueryCasesIdsByFilter	Retrieve case id’s that match the provided filter criteria
UpdateCase	update an existing case

ML Exclusions

Operation ID	Description
createMLExclusionsV1	Create the ML exclusions
deleteMLExclusionsV1	Delete the ML exclusions by id
exclusions.aggregates.v2	Get exclusion aggregates as specified via json in request body.
exclusions.create.v2	Create the exclusions, with ancestor fields.
exclusions.delete.v2	Delete the exclusions by id, with ancestor fields.
exclusions.get-all.v2	Get all exclusions.
exclusions.get-reports.v2	Create a report of ML exclusions scoped by the given filters
exclusions.get.v2	Get the exclusions by id, with ancestor fields.
exclusions.perform-action.v2	Actions used to manipulate the content of exclusions, with ancestor fields.
exclusions.sdmf-query.v1	Executes an SDMF data frame query against exclusion entities
exclusions.search.v2	Search for exclusions, with ancestor fields.
exclusions.update.v2	Update the exclusions by id, with ancestor fields.
getMLExclusionsV1	Get a set of ML Exclusions by specifying their IDs
queryMLExclusionsV1	Search for ML exclusions.
updateMLExclusionsV1	Update the ML exclusions

Mobile Enrollment

Operation ID	Description
RequestDeviceEnrollmentV3	Trigger on-boarding process for a mobile device
RequestDeviceEnrollmentV4	Trigger on-boarding process for a mobile device

Models

Operation ID	Description
EntitiesModelsV1	Get Model Entities by IDs
QueriesModelsV1	Query models based on the provided filters.

MSSP (Flight Control)

Operation ID	Description
addCIDGroupMembers	Add new CID group member.
addRole	Create a link between user group and CID group, with zero or more additional roles.
addUserGroupMembers	Add new user group member.
createCIDGroups	Create new CID groups.
createUserGroups	Create new user groups.
deleteCIDGroupMembersV1	Deprecated : Please use DELETE /entities/cid-group-members/v2.
deleteCIDGroupMembersV2	Delete CID group members.
deleteCIDGroups	Delete CID groups by ID.
deletedRoles	Delete links or additional roles between user groups and CID groups.
deleteUserGroupMembers	Delete user group members entry.
deleteUserGroups	Delete user groups by ID.
getChildren	Get link to child customer by child CID(s)
getChildrenV2	Get link to child customer by child CID(s)
getCIDGroupByIdV1	Deprecated : Please use GET /mssp/entities/cid-groups/v2.
getCIDGroupByIdV2	Get CID Groups by ID.
getCIDGroupMembersByV1	Deprecated : Please use GET /mssp/entities/cid-group-members/v2.
getCIDGroupMembersByV2	Get CID group members by CID Group ID.
getRolesByID	Get link between user group and CID group by ID.
getUserGroupMembersByIDV1	Deprecated : Please use GET /mssp/entities/user-group-members/v2.
getUserGroupMembersByIDV2	Get user group members by user group ID.
getUserGroupsByIDV1	Deprecated : Please use GET /entities/user-groups/v2.
getUserGroupsByIDV2	Get user groups by ID.
queryChildren	Query for customers linked as children
queryCIDGroupMembers	Query a CID groups members by associated CID.
queryCIDGroups	Query CID groups.
queryRoles	Query links between user groups and CID groups.
queryUserGroupMembers	Query user group member by user UUID.
queryUserGroups	Query user groups.
updateCIDGroups	Update existing CID groups.
updateUserGroups	Update existing user group(s).

Network Scan Global Configs

Operation ID	Description
get-global-configs	Get “global-configs” for the CID
update-global-configs	Update “global-configs” using provided specifications

Network Scan Networks

Operation ID	Description
aggregate-networks	Returns “networks” aggregations
create-networks	Create “networks” using provided specifications
delete-networks	Delete “networks” by their IDs
get-networks	Get “networks” by their IDs
query-networks	Get “networks IDs” by filter
update-networks	Update “networks” using provided specifications

Network Scan Scan Run Reports

Operation ID	Description
get-scan-run-reports	Downloads scan run report in CSV format

Network Scan Scan Runs

Operation ID	Description
aggregate-scan-runs	Returns “scan-runs” aggregations
create-scan-runs	Create “scan-runs” using provided specifications
get-scan-runs	Get “scan-runs” by their IDs
query-scan-runs	Get “scan-runs IDs” by filter
update-scan-runs	Update “scan-runs” using provided specifications

Network Scan Scanners

Operation ID	Description
aggregate-scanners	Returns “scanners” aggregations
get-scanners	Get “scanners” by their IDs
query-scanners	Get “scanners IDs” by filter
update-scanners	Update “scanners” using provided specifications

Network Scan Scans

Operation ID	Description
aggregate-scansMixin0	Returns “scans” aggregations
create-scans	Create “scans” using provided specifications
delete-scans	Delete “scans” by their IDs
get-scans	Get “scans” by their IDs
query-scansMixin0	Get “scans IDs” by filter
update-scans	Update “scans” using provided specifications

Network Scan Templates

Operation ID	Description
create-templates	Create “templates” using provided specifications
delete-templates	Delete “templates” by their IDs
get-template-configs	Get details on the network scan template configurations
get-templates	Get “templates” by their IDs
query-templates	Get “templates IDs” by filter
update-templates	Update “templates” using provided specifications

Network Scan Zones

Operation ID	Description
aggregate-zones	Returns “zones” aggregations
combined-zones	Get “zones” by filter
create-zones	Create “zones” using provided specifications
delete-zones	Delete “zones” by their IDs
get-zones	Get “zones” by their IDs
query-zones	Get “zones IDs” by filter
update-zones	Update “zones” using provided specifications

NGSIEM

Operation ID	Description
addDashboardLabels	Add multiple labels to a single dashboard
addFileLabels	Add multiple labels to a single file
addSavedQueryLabels	Add multiple labels to a saved query
bulkAddDashboardLabels	Add labels to multiple dashboards (max 100 items, non-transactional)
bulkAddLookupFileLabels	Add labels to multiple lookup files (max 100 items, non-transactional)
bulkAddSavedQueryLabels	Add labels to multiple saved queries (max 100 items, non-transactional)
BulkCreateDashboardsFromTemplate	Create Multiple Dashboards from YAML Templates.
BulkCreateLookupFiles	Create Multiple Lookup Files.
BulkCreateSavedQueriesFromTemplate	Create Multiple Saved Queries from LogScale YAML Templates.
BulkGetLookupFiles	Retrieve Multiple Lookup Files by Filenames in NGSIEM.
BulkInstallParsers	Installs multiple CrowdStrike-managed out-of-the-box (OOTB) parsers into the customer’s repository in a single operation.
bulkRemoveDashboardLabels	Remove labels from multiple dashboards (max 100 items, non-transactional)
bulkRemoveLookupFileLabels	Remove labels from multiple lookup files (max 100 items, non-transactional)
bulkRemoveSavedQueryLabels	Remove labels from multiple saved queries (max 100 items, non-transactional)
bulkUpdateDashboardLabels	Replace all labels on multiple dashboards (max 100 items, non-transactional)
BulkUpdateDashboardsFromTemplate	Update Multiple Dashboards from YAML Templates.
bulkUpdateLookupFileLabels	Replace all labels on multiple lookup files (max 100 items, non-transactional)
BulkUpdateLookupFiles	Update Multiple Lookup Files.
BulkUpdateSavedQueriesFromTemplate	Update Multiple Saved Queries from LogScale YAML Templates.
bulkUpdateSavedQueryLabels	Replace all labels on multiple saved queries (max 100 items, non-transactional)
CloneParser	Clone an existing parser with a new name
CreateDashboardFromTemplate	Create Dashboard from LogScale YAML Template in NGSIEM
CreateLookupFile	Create Lookup File in NGSIEM
CreateParser	Create Parser in NGSIEM.
CreateParserExtension	Create a Parser extension in NGSIEM for the provided base parser.
CreateParserFromTemplate	Create Parser from LogScale YAML Template in NGSIEM
CreateSavedQuery	Create Saved Query from LogScale YAML Template in NGSIEM
DeleteDashboard	Delete Dashboard in NGSIEM
DeleteLookupFile	Delete Lookup File in NGSIEM
DeleteParser	Delete Parser in NGSIEM
DeleteSavedQuery	Delete Saved Query in NGSIEM
ExternalCreateConnectorConfig	Create a new configuration for a data connector
ExternalCreateDataConnection	Create a new data connection
ExternalDeleteConnectorConfigs	Delete data connection config
ExternalDeleteDataConnection	Delete a data connection
ExternalGetDataConnectionByID	Get data connection by ID
ExternalGetDataConnectionStatus	Get data connection provisioning status
ExternalGetDataConnectionToken	Get Ingest token for data connection
ExternalListConnectorConfigs	List configurations for a data connector
ExternalListDataConnections	List and search data connections
ExternalListDataConnectors	List available data connectors
ExternalPatchConnectorConfig	Patch configurations for a data connector
ExternalRegenerateDataConnectionToken	Regenerate Ingest token for data connection
ExternalUpdateDataConnection	Update a data connection
ExternalUpdateDataConnectionStatus	Update data connection status
GetDashboardTemplate	Retrieve Dashboard(s) in NGSIEM as LogScale YAML Template.
GetLookupFile	Retrieve Lookup File in NGSIEM
GetLookupFromPackageV1	Download lookup file in package from NGSIEM
GetLookupFromPackageWithNamespaceV1	Download lookup file in namespaced package from NGSIEM
GetLookupV1	Download lookup file from NGSIEM
GetParser	Retrieve Parser in NGSIEM.
GetParserTemplate	Retrieve Parser in NGSIEM as LogScale YAML Template
GetSavedQueryTemplate	Retrieve Saved Quer(ies) in NGSIEM as LogScale YAML Template.
GetSearchStatusV1	Get status of search
InstallParser	Installs a CrowdStrike-managed out-of-the-box (OOTB) parser into the customer’s repository.
ListDashboards	List Dashboards in NGSIEM with Pagination and Filtering.
ListLookupFiles	List Lookup Files in NGSIEM with Pagination and Filtering.
ListParsers	List Parsers in NGSIEM
ListSavedQueries	List Saved Queries in NGSIEM with Pagination and Filtering.
removeDashboardLabels	Remove multiple labels from a single dashboard
removeFileLabels	Remove multiple labels from a single file
removeSavedQueryLabels	Remove multiple labels from a saved query
StartSearchV1	Initiate search
StopSearchV1	Stop search
TestParserFromTemplate	Test Parser from LogScale YAML Template in NGSIEM
UpdateDashboardFromTemplate	Update Dashboard from LogScale YAML Template in NGSIEM.
updateDashboardLabels	Replace all labels on a single dashboard
updateFileLabels	Replace all labels on a single file
UpdateLookupFile	Update an entire Lookup File in NGSIEM
UpdateLookupFileEntries	Update entries in an existing Lookup File in NGSIEM
UpdateParser	Update Parser in NGSIEM.
UpdateParserAutoUpdatePolicy	Updates a parser auto update policy - ‘on’ enables auto-updates, ‘off’ disables them
UpdateParserExtension	Update an existing Parser extension in NGSIEM.
UpdateParserFromTemplate	Update Parser in NGSIEM from YAML Template.
UpdateSavedQueryFromTemplate	Update Saved Query from LogScale YAML Template in NGSIEM.
updateSavedQueryLabels	Replace all labels on a single saved query
UploadLookupV1	Upload file to NGSIEM

OAuth2

Operation ID	Description
oauth2AccessToken	Generate an OAuth2 access token
oauth2RevokeToken	Revoke a previously issued OAuth2 access token before the end of its standard 30-minute lifespan.

ODS (On Demand Scan)

Operation ID	Description
aggregate-query-scan-host-metadata	Get aggregates on ODS scan-hosts data.
aggregate-scans	Get aggregates on ODS scan data.
aggregate-scheduled-scans	Get aggregates on ODS scheduled-scan data.
cancel-scans	Cancel ODS scans for the given scan ids.
create-scan	Create ODS scan and start or schedule scan for the given scan request.
delete-scheduled-scans	Delete ODS scheduled-scans for the given scheduled-scan ids.
get-malicious-files-by-ids	Get malicious files by ids.
get-scan-host-metadata-by-ids	Get scan hosts by ids.
get-scans-by-scan-ids	Get Scans by IDs.
get-scans-by-scan-ids-v2	Get Scans by IDs.
get-scheduled-scans-by-scan-ids	Get ScheduledScans by IDs.
query-malicious-files	Query malicious files.
query-scan-host-metadata	Query scan hosts.
query-scans	Query Scans.
query-scheduled-scans	Query ScheduledScans.
scans-report	Launch a scans report creation job
schedule-scan	Create ODS scan and start or schedule scan for the given scan request.

Prevention Policies

Operation ID	Description
createPreventionPolicies	Create Prevention Policies by specifying details about the policy to create
deletePreventionPolicies	Delete a set of Prevention Policies by specifying their IDs
getPreventionPolicies	Retrieve a set of Prevention Policies by specifying their IDs
performPreventionPoliciesAction	Perform the specified action on the Prevention Policies specified in the request
queryCombinedPreventionPolicies	Search for Prevention Policies in your environment by providing an FQL filter and paging details.
queryCombinedPreventionPolicyMembers	Search for members of a Prevention Policy in your environment by providing an FQL filter and paging details.
queryPreventionPolicies	Search for Prevention Policies in your environment by providing an FQL filter and paging details.
queryPreventionPolicyMembers	Search for members of a Prevention Policy in your environment by providing an FQL filter and paging details.
setPreventionPoliciesPrecedence	Sets the precedence of Prevention Policies based on the order of IDs specified in the request.
updatePreventionPolicies	Update Prevention Policies by specifying the ID of the policy and details to update

Profile Groups

Operation ID	Description
CreateGroupV1Mixin0	Create a new profile group
DeleteGroupsV1	Delete profile groups by IDs
GetGroupsV1Mixin0	Get profile groups by IDs with full details
GetGroupUsersV1	Get a list of groups with users that belong to them
GetUserGroupsV1	Get a list of users with the groups that they belong to
GroupActionsV1Mixin0	Perform actions on profile groups (add/remove roles, user groups, FGA objects)
GroupUsersActionsV1Mixin0	Add or remove users from profile groups
QueryGroupsV1Mixin0	Query profile group IDs with FQL filtering, pagination, and sorting
UpdateGroupV1Mixin0	Update profile group metadata (name, description)

Quarantine

Operation ID	Description
ActionUpdateCount	Returns count of potentially affected quarantined files for each action.
GetAggregateFiles	Get quarantine file aggregates as specified via json in request body.
GetQuarantineFiles	Get quarantine file metadata for specified ids.
QueryQuarantineFiles	Get quarantine file ids that match the provided filter criteria.
UpdateQfByQuery	Apply quarantine file actions by query.
UpdateQuarantinedDetectsByIds	Apply action by quarantine file ids

Quick Scan

Operation ID	Description
GetScans	Check the status of a volume scan.
GetScansAggregates	Get scans aggregations as specified via json in request body.
QuerySubmissionsMixin0	Find IDs for submitted scans by providing an FQL filter and paging details.
ScanSamples	Submit a volume of files for ml scanning.

Quick Scan Pro

Operation ID	Description
DeleteFile	Deletes file by its sha256 identifier.
DeleteScanResult	Deletes the result of an QuickScan Pro scan.
GetScanResult	Gets the result of an QuickScan Pro scan.
LaunchScan	Starts scanning a file uploaded through ‘/quickscanpro/entities/files/v1’.
QueryScanResults	FQL query specifying the filter parameters
UploadFileMixin0Mixin94	Uploads a file to be further analyzed with QuickScan Pro.
UploadFileQuickScanPro	Uploads a file to be further analyzed with QuickScan Pro.

Real Time Response

Operation ID	Description
BatchActiveResponderCmd	Batch executes a RTR active-responder command across the hosts mapped to the given batch ID.
BatchCmd	Batch executes a RTR read-only command across the hosts mapped to the given batch ID.
BatchGetCmd	Batch executes get command across hosts to retrieve files.
BatchGetCmdStatus	Retrieves the status of the specified batch get command.
BatchInitSessions	Batch initialize a RTR session on multiple hosts.
BatchRefreshSessions	Batch refresh a RTR session on multiple hosts.
RTR-AggregateSessions	Get aggregates on session data.
RTR-CheckActiveResponderCommandStatus	Get status of an executed active-responder command on a single host.
RTR-CheckCommandStatus	Get status of an executed command on a single host.
RTR-DeleteFile	Delete a RTR session file.
RTR-DeleteFileV2	Delete a RTR session file.
RTR-DeleteQueuedSession	Delete a queued session command
RTR-DeleteSession	Delete a session.
RTR-ExecuteActiveResponderCommand	Execute an active responder command on a single host.
RTR-ExecuteCommand	Execute a command on a single host.
RTR-GetExtractedFileContents	Get RTR extracted file contents for specified session and sha256.
RTR-InitSession	Initialize a new session with the RTR cloud.
RTR-ListAllSessions	Get a list of session_ids.
RTR-ListFiles	Get a list of files for the specified RTR session.
RTR-ListFilesV2	Get a list of files for the specified RTR session.
RTR-ListQueuedSessions	Get queued session metadata by session ID.
RTR-ListSessions	Get session metadata by session id.
RTR-PulseSession	Refresh a session timeout on a single host.

Real Time Response Admin

Operation ID	Description
BatchAdminCmd	Batch executes a RTR administrator command across the hosts mapped to the given batch ID.
RTR-CheckAdminCommandStatus	Get status of an executed RTR administrator command on a single host.
RTR-CreatePut-Files	Upload a new put-file to use for the RTR put command.
RTR-CreatePut-FilesV2	Upload a new put-file to use for the RTR put command.
RTR-CreateScripts	Upload a new custom-script to use for the RTR runscript command.
RTR-CreateScriptsV2	Upload a new custom-script to use for the RTR runscript command.
RTR-DeletePut-Files	Delete a put-file based on the ID given.
RTR-DeleteScripts	Delete a custom-script based on the ID given.
RTR-ExecuteAdminCommand	Execute a RTR administrator command on a single host.
RTR-GetFalconScripts	Get Falcon scripts with metadata and content of script
RTR-GetPut-Files	Get put-files based on the ID’s given.
RTR-GetPut-FilesV2	Get put-files based on the ID’s given.
RTR-GetPutFileContents	Get RTR put file contents for a given file ID
RTR-GetScripts	Get custom-scripts based on the ID’s given.
RTR-GetScriptsV2	Get custom-scripts based on the ID’s given.
RTR-ListFalconScripts	Get a list of Falcon script IDs available to the user to run
RTR-ListPut-Files	Get a list of put-file ID’s that are available to the user for the put command.
RTR-ListScripts	Get a list of custom-script ID’s that are available to the user for the runscript command.
RTR-UpdateScripts	Upload a new scripts to replace an existing one.
RTR-UpdateScriptsV2	Upload a new scripts to replace an existing one.

Real Time Response Audit

Operation ID	Description
RTRAuditSessions	Get all the RTR sessions created for a customer in a specified duration

Recon

Operation ID	Description
AggregateNotificationsExposedDataRecordsV1	Get notification exposed data record aggregates as specified via JSON in request body.
AggregateNotificationsV1	Get notification aggregates as specified via JSON in request body.
CreateActionsV1	Create actions for a monitoring rule.
CreateExportJobsV1	Launch asynchronous export job.
CreateRulesV1	Create monitoring rules.
DeleteActionV1	Delete an action from a monitoring rule based on the action ID.
DeleteExportJobsV1	Delete export jobs (and their associated file(s)) based on their IDs.
DeleteNotificationsV1	Delete notifications based on IDs.
DeleteRulesV1	Delete monitoring rules.
GetActionsV1	Get actions based on their IDs.
GetExportJobsV1	Get the status of export jobs based on their IDs.
GetFileContentForExportJobsV1	Download the file associated with a job ID.
GetNotificationsDetailedTranslatedV1	Get detailed notifications based on their IDs.
GetNotificationsDetailedV1	Get detailed notifications based on their IDs.
GetNotificationsExposedDataRecordsV1	Get notifications exposed data records based on their IDs.
GetNotificationsTranslatedV1	Get notifications based on their IDs.
GetNotificationsV1	Get notifications based on their IDs.
GetRulesV1	Get monitoring rules based on their IDs.
PreviewRuleV1	Preview rules notification count and distribution.
QueryActionsV1	Query actions based on provided criteria.
QueryNotificationsExposedDataRecordsV1	Query notifications exposed data records based on provided criteria.
QueryNotificationsV1	Query notifications based on provided criteria.
QueryRulesV1	Query monitoring rules based on provided criteria.
UpdateActionV1	Update an action for a monitoring rule.
UpdateNotificationsV1	Update notification status or assignee.
UpdateRulesV1	Update monitoring rules.

Report Executions

Operation ID	Description
report-executions-download.get	Get report entity download
report-executions.get	Retrieve report details for the provided report IDs.
report-executions.query	Find all report execution IDs matching the query with filter
report-executions.retry	This endpoint will be used to retry report executions

Response Policies

Operation ID	Description
createRTResponsePolicies	Create Response Policies by specifying details about the policy to create
deleteRTResponsePolicies	Delete a set of Response Policies by specifying their IDs
getRTResponsePolicies	Retrieve a set of Response Policies by specifying their IDs
performRTResponsePoliciesAction	Perform the specified action on the Response Policies specified in the request
queryCombinedRTResponsePolicies	Search for Response Policies in your environment by providing an FQL filter and paging details.
queryCombinedRTResponsePolicyMembers	Search for members of a Response policy in your environment by providing an FQL filter and paging details.
queryRTResponsePolicies	Search for Response Policies in your environment by providing an FQL filter with sort and/or paging details.
queryRTResponsePolicyMembers	Search for members of a Response policy in your environment by providing an FQL filter and paging details.
setRTResponsePoliciesPrecedence	Sets the precedence of Response Policies based on the order of IDs specified in the request.
updateRTResponsePolicies	Update Response Policies by specifying the ID of the policy and details to update

SaaS Security

Operation ID	Description
DismissAffectedEntityV3	POST Dismiss Affected Entity
DismissSecurityCheckV3	POST Dismiss Security Check by ID
GetActivityMonitorV3	GET Activity Monitor
GetAlertsV3	GET Alert by ID or GET Alerts
GetAppInventory	GET Applications Inventory
GetAppInventoryUsers	GET Application Users
GetAssetInventoryV3	GET Data Inventory
GetDeviceInventoryV3	GET Device Inventory
GetIntegrationsV3	GET Integrations
GetMetricsV3	GET Metrics
GetSecurityCheckAffectedV3	GET Security Check Affected
GetSecurityCheckComplianceV3	GET Compliance
GetSecurityChecksV3	GET Security Check by ID or GET List Security Checks
GetSupportedSaasV3	GET Supported SaaS
GetSystemLogsV3	GET System Logs
GetSystemUsersV3	GET System Users
GetUserInventoryV3	GET User Inventory
IntegrationBuilderEndTransactionV3	POST Data Upload Transaction Completion
IntegrationBuilderGetStatusV3	GET Status
IntegrationBuilderResetV3	Reset
IntegrationBuilderUploadV3	POST Upload

Sample Uploads

Operation ID	Description
ArchiveDeleteV1	Delete an archive that was uploaded previously
ArchiveGetV1	Retrieves the archives upload operation statuses.
ArchiveListV1	Retrieves the archives files in chunks.
ArchiveUploadV1	Uploads an archive and extracts files list from it.
ArchiveUploadV2	Uploads an archive and extracts files list from it.
DeleteSampleV3	Removes a sample, including file, meta and submissions from the collection
ExtractionCreateV1	Extracts files from an uploaded archive and copies them to internal storage making it available for content analysis.
ExtractionGetV1	Retrieves the files extraction operation statuses.
ExtractionListV1	Retrieves the files extractions in chunks.
GetSampleV3	Retrieves the file associated with the given ID (SHA256)
UploadSampleV3	Upload a file for further cloud analysis.

Scheduled Reports

Operation ID	Description
scheduled-reports.get	Retrieve scheduled reports for the provided report IDs.
scheduled-reports.launch	Launch scheduled reports executions for the provided report IDs.
scheduled-reports.query	Find all report IDs matching the query with filter

Sensor Download

Operation ID	Description
DownloadSensorInstallerById	Download sensor installer by SHA256 ID
DownloadSensorInstallerByIdV2	Download sensor installer by SHA256 ID
DownloadSensorInstallerByIdV3	Download sensor installer by SHA256 ID
GetCombinedSensorInstallersByQuery	Get sensor installer details by provided query
GetCombinedSensorInstallersByQueryV2	Get sensor installer details by provided query
GetCombinedSensorInstallersByQueryV3	Get sensor installer details by provided query
GetSensorInstallersByQuery	Get sensor installer IDs by provided query
GetSensorInstallersByQueryV2	Get sensor installer IDs by provided query
GetSensorInstallersByQueryV3	Get sensor installer IDs by provided query
GetSensorInstallersCCIDByQuery	Get CCID to use with sensor installers
GetSensorInstallersEntities	Get sensor installer details by provided SHA256 IDs
GetSensorInstallersEntitiesV2	Get sensor installer details by provided SHA256 IDs
GetSensorInstallersEntitiesV3	Get sensor installer details by provided SHA256 IDs

Sensor Update Policy

Operation ID	Description
createSensorUpdatePolicies	Create Sensor Update Policies by specifying details about the policy to create
createSensorUpdatePoliciesV2	Create Sensor Update Policies by specifying details about the policy to create with additional support for uninstall protection
deleteSensorUpdatePolicies	Delete a set of Sensor Update Policies by specifying their IDs
getSensorUpdatePolicies	Retrieve a set of Sensor Update Policies by specifying their IDs
getSensorUpdatePoliciesV2	Retrieve a set of Sensor Update Policies with additional support for uninstall protection by specifying their IDs
incrementUninstallToken	Increments a bulk maintenance token.
performSensorUpdatePoliciesAction	Perform the specified action on the Sensor Update Policies specified in the request
queryCombinedSensorUpdateBuilds	Retrieve available builds for use with Sensor Update Policies
queryCombinedSensorUpdateKernels	Retrieve kernel compatibility info for Sensor Update Builds
queryCombinedSensorUpdatePolicies	Search for Sensor Update Policies in your environment by providing an FQL filter and paging details.
queryCombinedSensorUpdatePoliciesV2	Search for Sensor Update Policies with additional support for uninstall protection in your environment by providing an FQL filter and paging details.
queryCombinedSensorUpdatePolicyMembers	Search for members of a Sensor Update Policy in your environment by providing an FQL filter and paging details.
querySensorUpdateKernelsDistinct	Retrieve kernel compatibility info for Sensor Update Builds
querySensorUpdatePolicies	Search for Sensor Update Policies in your environment by providing an FQL filter and paging details.
querySensorUpdatePolicyMembers	Search for members of a Sensor Update Policy in your environment by providing an FQL filter and paging details.
revealUninstallToken	Reveals an uninstall token for a specific device.
setSensorUpdatePoliciesPrecedence	Sets the precedence of Sensor Update Policies based on the order of IDs specified in the request.
updateSensorUpdatePolicies	Update Sensor Update Policies by specifying the ID of the policy and details to update
updateSensorUpdatePoliciesV2	Update Sensor Update Policies by specifying the ID of the policy and details to update with additional support for uninstall protection

Sensor Usage

Operation ID	Description
GetSensorUsageHourly	Fetches hourly average.
GetSensorUsageWeekly	Fetches weekly average.

Sensor Visibility Exclusions

Operation ID	Description
createSVExclusionsV1	Create the sensor visibility exclusions
deleteSensorVisibilityExclusionsV1	Delete the sensor visibility exclusions by id
getSensorVisibilityExclusionsV1	Get a set of Sensor Visibility Exclusions by specifying their IDs
querySensorVisibilityExclusionsV1	Search for sensor visibility exclusions.
updateSensorVisibilityExclusionsV1	Update the sensor visibility exclusions

Serverless Exports

Operation ID	Description
DownloadExportFileMixin0	Download an export file
LaunchExportJobMixin0	Launch an export job of a Lambda Security resource.
QueryExportJobsMixin0	Query export jobs entities
ReadExportJobsMixin0	Read export jobs entities

Serverless Vulnerabilities

Operation ID	Description
GetCombinedVulnerabilitiesSARIF	Retrieve all lambda vulnerabilities that match the given query and return in the SARIF format

Spans

Operation ID	Description
EntitiesSpansV1	Retrieve spans for the provided ids.
QueriesSpansV1	Query spans based on the provided filters.

Spotlight Evaluation Logic

Operation ID	Description
combinedQueryEvaluationLogic	Search for evaluation logic in your environment by providing a FQL filter and paging details.
combinedSupportedEvaluationExt	Performs a combined query and get operation for retrieving RiskSupportedEvaluation entities.
getEvaluationLogic	Get details on evaluation logic items by providing one or more IDs.
queryEvaluationLogic	Search for evaluation logic in your environment by providing a FQL filter and paging details.

Spotlight Vulnerabilities

Operation ID	Description
combinedQueryVulnerabilities	Search for Vulnerabilities in your environment by providing an FQL filter and paging details.
getRemediations	Get details on remediations by providing one or more IDs
getRemediationsV2	Get details on remediation by providing one or more IDs
getVulnerabilities	Get details on vulnerabilities by providing one or more IDs
queryVulnerabilities	Search for Vulnerabilities in your environment by providing an FQL filter and paging details.

Spotlight Vulnerability Metadata

Operation ID	Description
combineVulnMetadataExt	Performs a combined query and get operation for retrieving Risk (vulnerability metadata) entities.

Tailored Intelligence

Operation ID	Description
GetEventsBody	Get event body for the provided event ID
GetEventsEntities	Get events entities for specified ids.
GetRulesEntities	Get rules entities for specified ids.
QueryEvents	Get events ids that match the provided filter criteria.
QueryRules	Get rules ids that match the provided filter criteria.

ThreatGraph

Operation ID	Description
combined_edges_get	Retrieve edges for a given vertex id.
combined_ran_on_get	Look up instances of indicators such as hashes, domain names, and ip addresses that have been seen on devices in your environment.
combined_summary_get	Retrieve summary for a given vertex ID
entities_vertices_get	Retrieve metadata for a given vertex ID.
entities_vertices_getv2	Retrieve metadata for a given vertex ID
queries_edgetypes_get	Show all available edge types

Tools

Operation ID	Description
EntitiesToolsV1	Retrieve tools entities for the provided id.
QueriesToolsV1	Query tools based on the provided filters.

Unidentified Containers

Operation ID	Description
ReadUnidentifiedContainersByDateRangeCount	Returns the count of Unidentified Containers over the last 7 days
ReadUnidentifiedContainersCount	Returns the total count of Unidentified Containers over a time period
SearchAndReadUnidentifiedContainers	Search Unidentified Containers by the provided search criteria

User Management

Operation ID	Description
aggregateUsersV1	Get host aggregates as specified via json in request body.
combinedUserRolesV1	Deprecated : Please use GET /user-management/combined/user-roles/v2.
CombinedUserRolesV2	Get User Grant(s).
CreateUser	Deprecated : Please use POST /user-management/entities/users/v1.
createUserV1	Create a new user.
DeleteUser	Deprecated : Please use DELETE /user-management/entities/users/v1.
deleteUserV1	Delete a user permanently.
entitiesRolesGETV2	Get info about a role
entitiesRolesV1	Get info about a role
GetAvailableRoleIds	Deprecated : Please use GET /user-management/queries/roles/v1.
GetRoles	Deprecated : Please use GET /user-management/entities/roles/v1.
GetUserRoleIds	Deprecated : Please use GET /user-management/combined/user-roles/v1.
GrantUserRoleIds	Deprecated : Please use POST /user-management/entities/user-role-actions/v1.
queriesRolesV1	Show role IDs for all roles available in your customer account.
queryUserV1	List user IDs for all users in your customer account.
RetrieveEmailsByCID	Deprecated : Please use POST /user-management/entities/users/GET/v1.
retrieveUser	Deprecated : Please use POST /user-management/entities/users/GET/v1.
RetrieveUser	Deprecated : Please use retrieveUsersGETV1.
retrieveUsersGETV1	Get info about users including their name, UID and CID by providing user UUIDs
RetrieveUserUUID	Deprecated : Please use GET /user-management/queries/users/v1.
RetrieveUserUUIDsByCID	Deprecated : Please use GET /user-management/queries/users/v1.
RevokeUserRoleIds	Deprecated : Please use POST /user-management/entities/user-role-actions/v1.
UpdateUser	Deprecated : Please use PATCH /user-management/entities/users/v1.
updateUserV1	Modify an existing user’s first or last name.
userActionV1	Apply actions to one or more User.
userRolesActionV1	Grant or Revoke one or more role(s) to a user against a CID.

Workflows

Operation ID	Description
v1.child-executions.query	Search for child executions by providing a FQL filter and paging details.
WorkflowActivitiesCombined	Search for activities by name.
WorkflowActivitiesContentCombined	Search for activities by name.
WorkflowDefinitionsAction	Enable or disable a workflow definition, or stop all executions for a definition.
WorkflowDefinitionsCombined	Search workflow definitions based on the provided filter.
WorkflowDefinitionsDelete	Accepts a list of workflow definition IDs and deletes those definitions and all their associated versions.
WorkflowDefinitionsExport	Exports a workflow definition for the given definition ID
WorkflowDefinitionsImport	Imports a workflow definition based on the provided model
WorkflowDefinitionsUpdate	Updates a workflow definition based on the provided model
WorkflowExecute	Executes an on-demand Workflow, the body is JSON used to trigger the execution, the response the execution ID(s)
WorkflowExecuteSingleNodeV1	Executes a single activity node, resulting in an execution where test_mode=true and single_node_execution=true, associated with a definition ID if provided
WorkflowExecutionResults	Get execution result of a given execution
WorkflowExecutionsAction	Allows a user to resume/retry a failed workflow execution, or cancel/stop a currently running workflow execution
WorkflowExecutionsCombined	Search workflow executions based on the provided filter
WorkflowGetHumanInputV1	Gets one or more specific human inputs by their IDs.
WorkflowMockExecute	Executes a workflow definition with mocks
WorkflowSystemDefinitionsDeProvision	Deprovisions a system definition that was previously provisioned on the target CID
WorkflowSystemDefinitionsPromote	Promotes a version of a system definition for a customer.
WorkflowSystemDefinitionsProvision	Provisions a system definition onto the target CID by using the template and provided parameters
WorkflowTriggersCombined	Search for triggers by namespaced identifier, i.e.
WorkflowUpdateHumanInputV1	Provides an input in response to a human input action.

Zero Trust Assessment

Operation ID	Description
getAssessmentsByScoreV1	Get Zero Trust Assessment data for one or more hosts by providing a customer ID (CID) and a range of scores.
getAssessmentV1	Get Zero Trust Assessment data for one or more hosts by providing agent IDs (AID) and a customer ID (CID).
getAuditV1	Get the Zero Trust Assessment audit report for one customer ID (CID).