# CrowdStrike Developer Center

> Documentation for the CrowdStrike Falcon platform APIs, SDKs, and Configuration as Code tools. Build integrations, automate security operations, and manage your Falcon environment programmatically.

## Sections

- [Falcon API Reference](/api-reference/overview/): CrowdStrike Falcon API reference documentation.
- [Falcon Foundry](/foundry/understanding-foundry/): Build custom apps, API integrations, and automated workflows directly on the CrowdStrike Falcon platform.
- [Configuration as Code](/cac/overview/): Manage the CrowdStrike Falcon platform using Configuration as Code with Terraform.
- [Falcon MCP](/falcon-mcp/overview/): Connect AI assistants to the CrowdStrike Falcon platform via the Model Context Protocol.
- [Sensor Deployment](/falcon-sensor/overview/): Deploy, configure, and manage the CrowdStrike Falcon sensor across your infrastructure.
- [Falcon Next-Gen SIEM](/ngsiem/overview/): Build custom parsers, normalize security data, and integrate third-party log sources with CrowdStrike Next-Gen SIEM.
- [Software Development Kits](/sdks/overview/): Official CrowdStrike Falcon SDKs. Six languages, full API coverage.

## API Reference

- [All Operations](/api-reference/all-operations/): Complete alphabetical list of all 1388+ API operations
- [Operations by Collection](/api-reference/operations-by-collection/): Operations grouped by service collection
- [Falcon Query Language](/api-reference/falcon-query-language/): FQL syntax reference for filtering API results

### Service Collections (119 collections, 1388+ operations)

- [Admission Control Policies](/api-reference/collections/admission-control-policies/): 15 operations
  - [admission_control_get_policies](/api-reference/collections/admission-control-policies/#admission_control_get_policies): Get admission control policies.
  - [admission_control_create_policy](/api-reference/collections/admission-control-policies/#admission_control_create_policy): Create an admission control policy.
  - [admission_control_update_policy](/api-reference/collections/admission-control-policies/#admission_control_update_policy): Update an admission control policy.
  - [admission_control_delete_policies](/api-reference/collections/admission-control-policies/#admission_control_delete_policies): Delete an admission control policy.
  - [admission_control_add_host_groups](/api-reference/collections/admission-control-policies/#admission_control_add_host_groups): Add one or more host groups to an admission control policy.
  - [admission_control_remove_host_groups](/api-reference/collections/admission-control-policies/#admission_control_remove_host_groups): Remove one or more host groups from an admission control policy.
  - [admission_control_update_policy_precedence](/api-reference/collections/admission-control-policies/#admission_control_update_policy_precedence): Update admission control policy precedence.
  - [admission_control_add_rule_group_custom_rule](/api-reference/collections/admission-control-policies/#admission_control_add_rule_group_custom_rule): Add one or more custom Rego rules to a rule group in an admission control policy. The requested custom rules are also added to all other unspecified rule groups in the policy with action 'Disabled'.
  - [admission_control_remove_rule_group_custom_rule](/api-reference/collections/admission-control-policies/#admission_control_remove_rule_group_custom_rule): Delete one or more custom Rego rules from all rule groups in an admission control policy.
  - [admission_control_set_rule_group_precedence](/api-reference/collections/admission-control-policies/#admission_control_set_rule_group_precedence): Change precedence of rule groups within an admission control policy.
  - [admission_control_replace_rule_group_selectors](/api-reference/collections/admission-control-policies/#admission_control_replace_rule_group_selectors): Replace labels and/or namespaces of a rule group within an admission control policy.
  - [admission_control_create_rule_groups](/api-reference/collections/admission-control-policies/#admission_control_create_rule_groups): Create one or more rule groups and add them to an existing admission control policy.
  - [admission_control_update_rule_groups](/api-reference/collections/admission-control-policies/#admission_control_update_rule_groups): Update a rule group. Change rule group name, description, deny on error, Image Assessment settings, default rule actions, and custom rule actions.
  - [admission_control_delete_rule_groups](/api-reference/collections/admission-control-policies/#admission_control_delete_rule_groups): Delete rule groups.
  - [admission_control_query_policies](/api-reference/collections/admission-control-policies/#admission_control_query_policies): Search admission control policies.
- [Alerts](/api-reference/collections/alerts/): 9 operations
  - [PostAggregatesAlertsV1](/api-reference/collections/alerts/#postaggregatesalertsv1): Get alert aggregates as specified via json in request body.
  - [PostAggregatesAlertsV2](/api-reference/collections/alerts/#postaggregatesalertsv2): Get alert aggregates as specified via json in request body.
  - [PostCombinedAlertsV1](/api-reference/collections/alerts/#postcombinedalertsv1): Retrieves all Alerts that match a particular FQL filter. This API is intended for retrieval of large amounts of Alerts(>10k) using a pagination based on a `after` token.
  - [PatchEntitiesAlertsV2](/api-reference/collections/alerts/#patchentitiesalertsv2): Perform actions on alerts identified by alert ID(s) in request.
  - [PatchEntitiesAlertsV3](/api-reference/collections/alerts/#patchentitiesalertsv3): Perform actions on alerts identified by alert ID(s) in request.
  - [PostEntitiesAlertsV1](/api-reference/collections/alerts/#postentitiesalertsv1): Retrieve all Alerts given their IDs.
  - [PostEntitiesAlertsV2](/api-reference/collections/alerts/#postentitiesalertsv2): Retrieve all Alerts given their composite IDs.
  - [GetQueriesAlertsV1](/api-reference/collections/alerts/#getqueriesalertsv1): Search for alert IDs that match a given query.
  - [GetQueriesAlertsV2](/api-reference/collections/alerts/#getqueriesalertsv2): Search for alert IDs that match a given query.
- [API Integrations](/api-reference/collections/api-integrations/): 3 operations
  - [GetCombinedPluginConfigs](/api-reference/collections/api-integrations/#getcombinedpluginconfigs): Queries for config resources and returns details
  - [ExecuteCommandProxy](/api-reference/collections/api-integrations/#executecommandproxy): Execute a command and proxy the response directly.
  - [ExecuteCommand](/api-reference/collections/api-integrations/#executecommand): Execute a command.
- [ASPM](/api-reference/collections/aspm/): 52 operations
  - [ExecuteFunctionDataCount](/api-reference/collections/aspm/#executefunctiondatacount): A selected list of queryLanguage count queries.
  - [ExecuteFunctionsCount](/api-reference/collections/aspm/#executefunctionscount): A selected list of queryLanguage count queries.
  - [ExecuteFunctionDataQueryCount](/api-reference/collections/aspm/#executefunctiondataquerycount): A selected list of queryLanguage count queries.
  - [ExecuteFunctionsQueryCount](/api-reference/collections/aspm/#executefunctionsquerycount): A selected list of queryLanguage count queries.
  - [ExecuteFunctionData](/api-reference/collections/aspm/#executefunctiondata): A selected list of queryLanguage queries.
  - [ExecuteFunctionsOvertime](/api-reference/collections/aspm/#executefunctionsovertime): A selected list of queryLanguage overtime queries.
  - [ExecuteFunctions](/api-reference/collections/aspm/#executefunctions): A selected list of queryLanguage services queries.
  - [ExecuteFunctionDataQuery](/api-reference/collections/aspm/#executefunctiondataquery): A selected list of queryLanguage queries.
  - [ExecuteFunctionsQueryOvertime](/api-reference/collections/aspm/#executefunctionsqueryovertime): A selected list of queryLanguage overtime queries.
  - [ExecuteFunctionsQuery](/api-reference/collections/aspm/#executefunctionsquery): A selected list of queryLanguage services queries.
  - [getServiceArtifacts](/api-reference/collections/aspm/#getserviceartifacts): Retrieve service artifacts.
  - [UpsertBusinessApplications](/api-reference/collections/aspm/#upsertbusinessapplications): Create or Update Business Applications
  - [GetCloudSecurityIntegrationState](/api-reference/collections/aspm/#getcloudsecurityintegrationstate): Get Cloud Security integration state.
  - [SetCloudSecurityIntegrationState](/api-reference/collections/aspm/#setcloudsecurityintegrationstate): Set Cloud Security integration state.
  - [GetExecutorNodes](/api-reference/collections/aspm/#getexecutornodes): Get all the relay nodes
  - [UpdateExecutorNode](/api-reference/collections/aspm/#updateexecutornode): Update an existing relay node
  - [CreateExecutorNode](/api-reference/collections/aspm/#createexecutornode): Create a new relay node
  - [GetExecutorNodesMetadata](/api-reference/collections/aspm/#getexecutornodesmetadata): Get metadata about all executor nodes.
  - [DeleteExecutorNode](/api-reference/collections/aspm/#deleteexecutornode): Delete a relay node
  - [RetrieveRelayInstances](/api-reference/collections/aspm/#retrieverelayinstances): Retrieve the relay instances in CSV format.
  - [GetIntegrationTasks](/api-reference/collections/aspm/#getintegrationtasks): Get all the integration tasks
  - [CreateIntegrationTask](/api-reference/collections/aspm/#createintegrationtask): Create new integration task.
  - [GetIntegrationTasksMetadata](/api-reference/collections/aspm/#getintegrationtasksmetadata): Get metadata about all integration tasks.
  - [GetIntegrationTasksV2](/api-reference/collections/aspm/#getintegrationtasksv2): Get all the integration tasks.
  - [UpdateIntegrationTask](/api-reference/collections/aspm/#updateintegrationtask): Update an existing integration task by its ID
  - [DeleteIntegrationTask](/api-reference/collections/aspm/#deleteintegrationtask): Delete an existing integration task by its ID
  - [RunIntegrationTask](/api-reference/collections/aspm/#runintegrationtask): Run an integration task by its ID
  - [RunIntegrationTaskAdmin](/api-reference/collections/aspm/#runintegrationtaskadmin): Run an integration task by its ID with admin scope.
  - [RunIntegrationTaskV2](/api-reference/collections/aspm/#runintegrationtaskv2): Run an integration task by its ID
  - [GetIntegrationTypes](/api-reference/collections/aspm/#getintegrationtypes): Get all the integration types
  - [GetIntegrations](/api-reference/collections/aspm/#getintegrations): Get a list of all the integrations
  - [CreateIntegration](/api-reference/collections/aspm/#createintegration): Create a new integration
  - [GetIntegrationsV2](/api-reference/collections/aspm/#getintegrationsv2): Get a list of all the integrations.
  - [UpdateIntegration](/api-reference/collections/aspm/#updateintegration): Update an existing integration by its ID
  - [DeleteIntegration](/api-reference/collections/aspm/#deleteintegration): Delete an existing integration by its ID
  - [ExecuteQuery](/api-reference/collections/aspm/#executequery): Execute a query. The syntax used is identical to that of the query page.
  - [ServiceNowGetDeployments](/api-reference/collections/aspm/#servicenowgetdeployments): Retrieve ServiceNow deployments
  - [ServiceNowGetServices](/api-reference/collections/aspm/#servicenowgetservices): Retrieve ServiceNow services.
  - [GetServicesCount](/api-reference/collections/aspm/#getservicescount): Get the total amount of existing services
  - [GetServiceViolationTypes](/api-reference/collections/aspm/#getserviceviolationtypes): Get the different types of violation
  - [GetTags](/api-reference/collections/aspm/#gettags): Get all the tags
  - [UpsertTags](/api-reference/collections/aspm/#upserttags): Create new or update existing tag. You can update unique tags table or regular tags table
  - [DeleteTags](/api-reference/collections/aspm/#deletetags): Remove existing tags
  - [GetGroupHierarchy](/api-reference/collections/aspm/#getgrouphierarchy): Get group hierarchy
  - [GetGroupV2](/api-reference/collections/aspm/#getgroupv2): Get group details
  - [DeleteGroup](/api-reference/collections/aspm/#deletegroup)
  - [GetGroupsV2](/api-reference/collections/aspm/#getgroupsv2)
  - [GetIntegrationTasksAdmin](/api-reference/collections/aspm/#getintegrationtasksadmin): Get all the integration tasks, requires admin scope
  - [GetUsersV2](/api-reference/collections/aspm/#getusersv2): List users
  - [PostGroupV2](/api-reference/collections/aspm/#postgroupv2): Create group
  - [UpdateDefaultGroup](/api-reference/collections/aspm/#updatedefaultgroup): Update default group
  - [UpdateGroup](/api-reference/collections/aspm/#updategroup): Update group
- [CAO Hunting](/api-reference/collections/cao-hunting/): 7 operations
  - [AggregateIntelligenceQueries](/api-reference/collections/cao-hunting/#aggregateintelligencequeries): Aggregate intelligence queries.
  - [GetArchiveExport](/api-reference/collections/cao-hunting/#getarchiveexport): Creates an Archive Export.
  - [GetIntelligenceQueries](/api-reference/collections/cao-hunting/#getintelligencequeries): Retrieves a list of Intelligence queries.
  - [SearchIntelligenceQueries](/api-reference/collections/cao-hunting/#searchintelligencequeries): Search intelligence queries that match the provided conditions.
  - [AggregateHuntingGuides](/api-reference/collections/cao-hunting/#aggregatehuntingguides): Aggregate Hunting Guides
  - [GetHuntingGuides](/api-reference/collections/cao-hunting/#gethuntingguides): Retrieves a list of Hunting Guides
  - [SearchHuntingGuides](/api-reference/collections/cao-hunting/#searchhuntingguides): Search for Hunting Guides that match the provided conditions
- [Case Management](/api-reference/collections/case-management/): 53 operations
  - [aggregates_file_details_post_v1](/api-reference/collections/case-management/#aggregates_file_details_post_v1): Get file details aggregates as specified via json in the request body.
  - [combined_file_details_get_v1](/api-reference/collections/case-management/#combined_file_details_get_v1): Query file details
  - [entities_files_upload_post_v1](/api-reference/collections/case-management/#entities_files_upload_post_v1): Upload file for case
  - [entities_file_details_patch_v1](/api-reference/collections/case-management/#entities_file_details_patch_v1): Update file details
  - [entities_file_details_get_v1](/api-reference/collections/case-management/#entities_file_details_get_v1): Get file details by id
  - [entities_files_bulk_download_post_v1](/api-reference/collections/case-management/#entities_files_bulk_download_post_v1): Download multiple existing file from case as a ZIP
  - [entities_files_download_get_v1](/api-reference/collections/case-management/#entities_files_download_get_v1): Download existing file from case
  - [entities_files_delete_v1](/api-reference/collections/case-management/#entities_files_delete_v1): Delete file details by id
  - [queries_file_details_get_v1](/api-reference/collections/case-management/#queries_file_details_get_v1): Query for ids of file details
  - [entities_get_rtr_file_metadata_post_v1](/api-reference/collections/case-management/#entities_get_rtr_file_metadata_post_v1): Get metadata for a file via RTR without retrieving it.
  - [entities_retrieve_rtr_file_post_v1](/api-reference/collections/case-management/#entities_retrieve_rtr_file_post_v1): Retrieve a file from host using RTR and add it to a case.
  - [entities_retrieve_rtr_recent_file_post_v1](/api-reference/collections/case-management/#entities_retrieve_rtr_recent_file_post_v1): Retrieve a recently fetched RTR file and add it to a case.
  - [aggregates_notification_groups_post_v1](/api-reference/collections/case-management/#aggregates_notification_groups_post_v1): Get notification groups aggregations
  - [aggregates_notification_groups_post_v2](/api-reference/collections/case-management/#aggregates_notification_groups_post_v2): Get notification groups aggregations
  - [aggregates_slas_post_v1](/api-reference/collections/case-management/#aggregates_slas_post_v1): Get SLA aggregations
  - [aggregates_templates_post_v1](/api-reference/collections/case-management/#aggregates_templates_post_v1): Get templates aggregations
  - [aggregates_access_tags_post_v1](/api-reference/collections/case-management/#aggregates_access_tags_post_v1): Get access tag aggregates.
  - [entities_access_tags_get_v1](/api-reference/collections/case-management/#entities_access_tags_get_v1): Get access tags.
  - [entities_notification_groups_get_v1](/api-reference/collections/case-management/#entities_notification_groups_get_v1): Get notification groups by ID
  - [entities_notification_groups_post_v1](/api-reference/collections/case-management/#entities_notification_groups_post_v1): Create notification group
  - [entities_notification_groups_patch_v1](/api-reference/collections/case-management/#entities_notification_groups_patch_v1): Update notification group
  - [entities_notification_groups_delete_v1](/api-reference/collections/case-management/#entities_notification_groups_delete_v1): Delete notification groups by ID
  - [entities_notification_groups_get_v2](/api-reference/collections/case-management/#entities_notification_groups_get_v2): Get notification groups by ID
  - [entities_notification_groups_post_v2](/api-reference/collections/case-management/#entities_notification_groups_post_v2): Create notification group
  - [entities_notification_groups_patch_v2](/api-reference/collections/case-management/#entities_notification_groups_patch_v2): Update notification group
  - [entities_notification_groups_delete_v2](/api-reference/collections/case-management/#entities_notification_groups_delete_v2): Delete notification groups by ID
  - [entities_fields_get_v1](/api-reference/collections/case-management/#entities_fields_get_v1): Get fields by ID
  - [entities_slas_get_v1](/api-reference/collections/case-management/#entities_slas_get_v1): Get SLAs by ID
  - [entities_slas_post_v1](/api-reference/collections/case-management/#entities_slas_post_v1): Create SLA
  - [entities_slas_patch_v1](/api-reference/collections/case-management/#entities_slas_patch_v1): Update SLA
  - [entities_slas_delete_v1](/api-reference/collections/case-management/#entities_slas_delete_v1): Delete SLAs
  - [entities_template_snapshots_get_v1](/api-reference/collections/case-management/#entities_template_snapshots_get_v1): Get template snapshots
  - [entities_templates_export_get_v1](/api-reference/collections/case-management/#entities_templates_export_get_v1): Export templates to files in a zip archive
  - [entities_templates_import_post_v1](/api-reference/collections/case-management/#entities_templates_import_post_v1): Import a template from a file
  - [entities_templates_get_v1](/api-reference/collections/case-management/#entities_templates_get_v1): Get templates by ID
  - [entities_templates_post_v1](/api-reference/collections/case-management/#entities_templates_post_v1): Create template
  - [entities_templates_patch_v1](/api-reference/collections/case-management/#entities_templates_patch_v1): Update template
  - [entities_templates_delete_v1](/api-reference/collections/case-management/#entities_templates_delete_v1): Delete templates
  - [queries_access_tags_get_v1](/api-reference/collections/case-management/#queries_access_tags_get_v1): Query access tags.
  - [queries_fields_get_v1](/api-reference/collections/case-management/#queries_fields_get_v1): Query fields
  - [queries_notification_groups_get_v1](/api-reference/collections/case-management/#queries_notification_groups_get_v1): Query notification groups
  - [queries_notification_groups_get_v2](/api-reference/collections/case-management/#queries_notification_groups_get_v2): Query notification groups
  - [queries_slas_get_v1](/api-reference/collections/case-management/#queries_slas_get_v1): Query SLAs
  - [queries_template_snapshots_get_v1](/api-reference/collections/case-management/#queries_template_snapshots_get_v1): Query template snapshots
  - [queries_templates_get_v1](/api-reference/collections/case-management/#queries_templates_get_v1): Query templates
  - [entities_alert_evidence_post_v1](/api-reference/collections/case-management/#entities_alert_evidence_post_v1): Adds the given list of alert evidence to the specified case.
  - [entities_case_tags_post_v1](/api-reference/collections/case-management/#entities_case_tags_post_v1): Adds the given list of tags to the specified case.
  - [entities_case_tags_delete_v1](/api-reference/collections/case-management/#entities_case_tags_delete_v1): Removes the specified tags from the specified case.
  - [entities_cases_put_v2](/api-reference/collections/case-management/#entities_cases_put_v2): Creates the given Case
  - [entities_cases_post_v2](/api-reference/collections/case-management/#entities_cases_post_v2): Retrieves all Cases given their IDs.
  - [entities_cases_patch_v2](/api-reference/collections/case-management/#entities_cases_patch_v2): Updates given fields on the specified case.
  - [entities_event_evidence_post_v1](/api-reference/collections/case-management/#entities_event_evidence_post_v1): Adds the given list of event evidence to the specified case.
  - [queries_cases_get_v1](/api-reference/collections/case-management/#queries_cases_get_v1): Retrieves all Cases IDs that match a given query.
- [Certificate Based Exclusions](/api-reference/collections/certificate-based-exclusions/): 6 operations
  - [cb_exclusions_get_v1](/api-reference/collections/certificate-based-exclusions/#cb_exclusions_get_v1): Find all exclusion IDs matching the query with filter.
  - [cb_exclusions_create_v1](/api-reference/collections/certificate-based-exclusions/#cb_exclusions_create_v1): Create new Certificate Based Exclusions.
  - [cb_exclusions_delete_v1](/api-reference/collections/certificate-based-exclusions/#cb_exclusions_delete_v1): Delete the exclusions by ID.
  - [cb_exclusions_update_v1](/api-reference/collections/certificate-based-exclusions/#cb_exclusions_update_v1): Updates existing Certificate Based Exclusions.
  - [certificates_get_v1](/api-reference/collections/certificate-based-exclusions/#certificates_get_v1): Retrieves certificate signing information for a file.
  - [cb_exclusions_query_v1](/api-reference/collections/certificate-based-exclusions/#cb_exclusions_query_v1): Search for cert-based exclusions.
- [Cloud AWS Registration](/api-reference/collections/cloud-aws-registration/): 7 operations
  - [cloud_registration_aws_get_accounts](/api-reference/collections/cloud-aws-registration/#cloud_registration_aws_get_accounts): Retrieve existing AWS accounts by account IDs.
  - [cloud_registration_aws_create_account](/api-reference/collections/cloud-aws-registration/#cloud_registration_aws_create_account): Creates a new account in our system for a customer.
  - [cloud_registration_aws_delete_account](/api-reference/collections/cloud-aws-registration/#cloud_registration_aws_delete_account): Deletes an existing AWS account or organization in our system.
  - [cloud_registration_aws_trigger_health_check](/api-reference/collections/cloud-aws-registration/#cloud_registration_aws_trigger_health_check): Trigger health check scan for AWS accounts.
  - [cloud_registration_aws_update_account](/api-reference/collections/cloud-aws-registration/#cloud_registration_aws_update_account): Patches a existing account in our system for a customer.
  - [cloud_registration_aws_validate_accounts](/api-reference/collections/cloud-aws-registration/#cloud_registration_aws_validate_accounts): Validates the AWS account registration status, and discover organization child accounts if organization is specified.
  - [cloud_registration_aws_query_accounts](/api-reference/collections/cloud-aws-registration/#cloud_registration_aws_query_accounts): Retrieve existing AWS accounts by account IDs
- [Cloud Azure Registration](/api-reference/collections/cloud-azure-registration/): 9 operations
  - [cloud_registration_azure_get_registration](/api-reference/collections/cloud-azure-registration/#cloud_registration_azure_get_registration): Retrieve existing Azure registration for a tenant.
  - [cloud_registration_azure_create_registration](/api-reference/collections/cloud-azure-registration/#cloud_registration_azure_create_registration): Create an Azure registration for a tenant.
  - [cloud_registration_azure_update_registration](/api-reference/collections/cloud-azure-registration/#cloud_registration_azure_update_registration): Update an existing Azure registration for a tenant.
  - [cloud_registration_azure_delete_registration](/api-reference/collections/cloud-azure-registration/#cloud_registration_azure_delete_registration): Deletes existing Azure registrations.
  - [download_azure_script](/api-reference/collections/cloud-azure-registration/#download_azure_script): Download Azure deployment script (Terraform or Bicep).
  - [cloud_registration_azure_delete_legacy_subscription](/api-reference/collections/cloud-azure-registration/#cloud_registration_azure_delete_legacy_subscription): Delete existing legacy Azure subscriptions.
  - [cloud_registration_azure_trigger_health_check](/api-reference/collections/cloud-azure-registration/#cloud_registration_azure_trigger_health_check): Trigger health check scan for Azure registrations.
  - [cloud_registration_azure_validate_registration](/api-reference/collections/cloud-azure-registration/#cloud_registration_azure_validate_registration): Validate an Azure registration by checking service principal, role assignments and deployment stack (if the deployment method is Bicep).
  - [cloud_registration_azure_download_script](/api-reference/collections/cloud-azure-registration/#cloud_registration_azure_download_script): Retrieve script to create resources.
- [Cloud Connect AWS](/api-reference/collections/cloud-connect-aws/): 9 operations
  - [QueryAWSAccounts](/api-reference/collections/cloud-connect-aws/#queryawsaccounts): Search for provisioned AWS Accounts by providing a FQL filter and paging details. Returns a set of AWS accounts which match the filter criteria
  - [GetAWSSettings](/api-reference/collections/cloud-connect-aws/#getawssettings): Retrieve a set of Global Settings which are applicable to all provisioned AWS accounts
  - [GetAWSAccounts](/api-reference/collections/cloud-connect-aws/#getawsaccounts): Retrieve a set of AWS Accounts by specifying their IDs
  - [ProvisionAWSAccounts](/api-reference/collections/cloud-connect-aws/#provisionawsaccounts): Provision AWS Accounts by specifying details about the accounts to provision
  - [DeleteAWSAccounts](/api-reference/collections/cloud-connect-aws/#deleteawsaccounts): Delete a set of AWS Accounts by specifying their IDs
  - [UpdateAWSAccounts](/api-reference/collections/cloud-connect-aws/#updateawsaccounts): Update AWS Accounts by specifying the ID of the account and details to update
  - [CreateOrUpdateAWSSettings](/api-reference/collections/cloud-connect-aws/#createorupdateawssettings): Create or update Global Settings which are applicable to all provisioned AWS accounts
  - [VerifyAWSAccountAccess](/api-reference/collections/cloud-connect-aws/#verifyawsaccountaccess): Performs an Access Verification check on the specified AWS Account IDs
  - [QueryAWSAccountsForIDs](/api-reference/collections/cloud-connect-aws/#queryawsaccountsforids): Search for provisioned AWS Accounts by providing a FQL filter and paging details. Returns a set of AWS account IDs which match the filter criteria
- [Cloud GCP Registration](/api-reference/collections/cloud-gcp-registration/): 7 operations
  - [cloud_registration_gcp_get_entities](/api-reference/collections/cloud-gcp-registration/#cloud_registration_gcp_get_entities): Retrieve all GCP entities (organizations, folders, projects) grouped by type with support for FQL filtering, sorting, and pagination.
  - [cloud_registration_gcp_trigger_health_check](/api-reference/collections/cloud-gcp-registration/#cloud_registration_gcp_trigger_health_check): Trigger health check scan for GCP registrations
  - [cloud_registration_gcp_get_registration](/api-reference/collections/cloud-gcp-registration/#cloud_registration_gcp_get_registration): Retrieve a Google Cloud Registration.
  - [cloud_registration_gcp_put_registration](/api-reference/collections/cloud-gcp-registration/#cloud_registration_gcp_put_registration): Creates/Updates a Google Cloud Registration.
  - [cloud_registration_gcp_create_registration](/api-reference/collections/cloud-gcp-registration/#cloud_registration_gcp_create_registration): Create a Google Cloud Registration.
  - [cloud_registration_gcp_update_registration](/api-reference/collections/cloud-gcp-registration/#cloud_registration_gcp_update_registration): Update a Google Cloud Registration.
  - [cloud_registration_gcp_delete_registration](/api-reference/collections/cloud-gcp-registration/#cloud_registration_gcp_delete_registration): Deletes a Google Cloud Registration and returns the deleted registration in the response body.
- [Cloud Google Cloud Registration](/api-reference/collections/cloud-google-cloud-registration/): 7 operations
  - [cloud_registration_gcp_get_entities](/api-reference/collections/cloud-google-cloud-registration/#cloud_registration_gcp_get_entities): Retrieve all GCP entities (organizations, folders, projects) grouped by type with support for FQL filtering, sorting, and pagination.
  - [cloud_registration_gcp_trigger_health_check](/api-reference/collections/cloud-google-cloud-registration/#cloud_registration_gcp_trigger_health_check): Trigger health check scan for GCP registrations
  - [cloud_registration_gcp_get_registration](/api-reference/collections/cloud-google-cloud-registration/#cloud_registration_gcp_get_registration): Retrieve a Google Cloud Registration.
  - [cloud_registration_gcp_put_registration](/api-reference/collections/cloud-google-cloud-registration/#cloud_registration_gcp_put_registration): Creates/Updates a Google Cloud Registration.
  - [cloud_registration_gcp_create_registration](/api-reference/collections/cloud-google-cloud-registration/#cloud_registration_gcp_create_registration): Create a Google Cloud Registration.
  - [cloud_registration_gcp_delete_registration](/api-reference/collections/cloud-google-cloud-registration/#cloud_registration_gcp_delete_registration): Deletes a Google Cloud Registration and returns the deleted registration in the response body.
  - [cloud_registration_gcp_update_registration](/api-reference/collections/cloud-google-cloud-registration/#cloud_registration_gcp_update_registration): Update a Google Cloud Registration.
- [Cloud OCI Registration](/api-reference/collections/cloud-oci-registration/): 7 operations
  - [cloud_security_registration_oci_get_account](/api-reference/collections/cloud-oci-registration/#cloud_security_registration_oci_get_account): Retrieve a list of OCI tenancies with support for FQL filtering, sorting, and pagination.
  - [cloud_security_registration_oci_rotate_key](/api-reference/collections/cloud-oci-registration/#cloud_security_registration_oci_rotate_key): Refresh key for the OCI tenancy.
  - [cloud_security_registration_oci_validate_tenancy](/api-reference/collections/cloud-oci-registration/#cloud_security_registration_oci_validate_tenancy): Validate the OCI account in CSPM for a provided CID. For internal clients only.
  - [cloud_security_registration_oci_create_account](/api-reference/collections/cloud-oci-registration/#cloud_security_registration_oci_create_account): Create OCI tenancy account in CSPM
  - [cloud_security_registration_oci_delete_account](/api-reference/collections/cloud-oci-registration/#cloud_security_registration_oci_delete_account): Delete an existing OCI tenancy in CSPM.
  - [cloud_security_registration_oci_update_account](/api-reference/collections/cloud-oci-registration/#cloud_security_registration_oci_update_account): Update an existing OCI account.
  - [cloud_security_registration_oci_download_script](/api-reference/collections/cloud-oci-registration/#cloud_security_registration_oci_download_script): Retrieve script to create resources in tenancy OCID.
- [Cloud Policies](/api-reference/collections/cloud-policies/): 29 operations
  - [GetRuleInputSchema](/api-reference/collections/cloud-policies/#getruleinputschema): Get rule input schema for given resource type.
  - [ReplaceControlRules](/api-reference/collections/cloud-policies/#replacecontrolrules): Assign rules to a compliance control (full replace).
  - [GetComplianceControls](/api-reference/collections/cloud-policies/#getcompliancecontrols): Get compliance controls by ID.
  - [CreateComplianceControl](/api-reference/collections/cloud-policies/#createcompliancecontrol): Create a new custom compliance control.
  - [UpdateComplianceControl](/api-reference/collections/cloud-policies/#updatecompliancecontrol): Update a custom compliance control.
  - [DeleteComplianceControl](/api-reference/collections/cloud-policies/#deletecompliancecontrol): Delete custom compliance controls.
  - [QueryComplianceControls](/api-reference/collections/cloud-policies/#querycompliancecontrols): Query for compliance controls by various parameters.
  - [GetRule](/api-reference/collections/cloud-policies/#getrule): Get a rule by id.
  - [RenameSectionComplianceFramework](/api-reference/collections/cloud-policies/#renamesectioncomplianceframework): Rename a section in a custom compliance framework.
  - [GetComplianceFrameworks](/api-reference/collections/cloud-policies/#getcomplianceframeworks): Get compliance frameworks by ID.
  - [CreateComplianceFramework](/api-reference/collections/cloud-policies/#createcomplianceframework): Create a new custom compliance framework.
  - [UpdateComplianceFramework](/api-reference/collections/cloud-policies/#updatecomplianceframework): Update a custom compliance framework.
  - [DeleteComplianceFramework](/api-reference/collections/cloud-policies/#deletecomplianceframework): Delete a custom compliance framework and all associated controls and rule assignments.
  - [GetEnrichedAsset](/api-reference/collections/cloud-policies/#getenrichedasset): Get enriched assets that combine a primary resource with all its related resources.
  - [GetEvaluationResult](/api-reference/collections/cloud-policies/#getevaluationresult): Get evaluation results based on the provided rule.
  - [GetRuleOverride](/api-reference/collections/cloud-policies/#getruleoverride): Get a rule override by ID.
  - [CreateRuleOverride](/api-reference/collections/cloud-policies/#createruleoverride): Create a new rule override.
  - [UpdateRuleOverride](/api-reference/collections/cloud-policies/#updateruleoverride): Update a rule override.
  - [DeleteRuleOverride](/api-reference/collections/cloud-policies/#deleteruleoverride): Delete a rule override.
  - [CreateRuleMixin0](/api-reference/collections/cloud-policies/#createrulemixin0): Create a new rule.
  - [UpdateRule](/api-reference/collections/cloud-policies/#updaterule): Update a rule.
  - [DeleteRuleMixin0](/api-reference/collections/cloud-policies/#deleterulemixin0): Delete a rule.
  - [QueryComplianceFrameworks](/api-reference/collections/cloud-policies/#querycomplianceframeworks): Query for compliance frameworks by various parameters.
  - [QueryRule](/api-reference/collections/cloud-policies/#queryrule): Query for rules by various parameters.
  - [GetSuppressionRules](/api-reference/collections/cloud-policies/#getsuppressionrules): Get Suppression Rules by ID.
  - [CreateSuppressionRule](/api-reference/collections/cloud-policies/#createsuppressionrule): Create a new suppression rule.
  - [UpdateSuppressionRule](/api-reference/collections/cloud-policies/#updatesuppressionrule): Update a suppression rule.
  - [DeleteSuppressionRules](/api-reference/collections/cloud-policies/#deletesuppressionrules): Delete Suppression Rules by ID.
  - [QuerySuppressionRules](/api-reference/collections/cloud-policies/#querysuppressionrules): Query suppression rules with filtering, sorting and pagination.
- [Cloud Security](/api-reference/collections/cloud-security/): 7 operations
  - [combined_cloud_risks](/api-reference/collections/cloud-security/#combined_cloud_risks): Get cloud risks with full details based on filters and sort criteria.
  - [ListCloudGroupsExternal](/api-reference/collections/cloud-security/#listcloudgroupsexternal): Query Cloud Groups and return entities with full details.
  - [ListCloudGroupsByIDExternal](/api-reference/collections/cloud-security/#listcloudgroupsbyidexternal): Retrieve Cloud Groups by their UUIDs.
  - [CreateCloudGroupExternal](/api-reference/collections/cloud-security/#createcloudgroupexternal): Create a new Cloud Group with specified properties and selectors.
  - [UpdateCloudGroupExternal](/api-reference/collections/cloud-security/#updatecloudgroupexternal): Update an existing Cloud Group's properties.
  - [DeleteCloudGroupsExternal](/api-reference/collections/cloud-security/#deletecloudgroupsexternal): Delete Cloud Groups in batch by their UUIDs.
  - [ListCloudGroupIDsExternal](/api-reference/collections/cloud-security/#listcloudgroupidsexternal): Query Cloud Groups and return only their IDs.
- [Cloud Security Assets](/api-reference/collections/cloud-security-assets/): 4 operations
  - [cloud_security_assets_combined_application_findings](/api-reference/collections/cloud-security-assets/#cloud_security_assets_combined_application_findings): Get findings for an application resource with pagination.
  - [cloud_security_assets_combined_compliance_by_account](/api-reference/collections/cloud-security-assets/#cloud_security_assets_combined_compliance_by_account): Gets combined compliance data aggregated by account and region. Results can be filtered and sorted.
  - [cloud_security_assets_entities_get](/api-reference/collections/cloud-security-assets/#cloud_security_assets_entities_get): Gets raw resources based on the provided IDs param.  Maximum of 100 resources can be requested with this method.
  - [cloud_security_assets_queries](/api-reference/collections/cloud-security-assets/#cloud_security_assets_queries): Gets a list of resource IDs for the given parameters, filters and sort criteria.
- [Cloud Security Compliance](/api-reference/collections/cloud-security-compliance/): 2 operations
  - [cloud_compliance_framework_posture_summaries](/api-reference/collections/cloud-security-compliance/#cloud_compliance_framework_posture_summaries): Get sections and requirements with scores for benchmarks.
  - [cloud_compliance_rule_posture_summaries](/api-reference/collections/cloud-security-compliance/#cloud_compliance_rule_posture_summaries): Get compliance score and counts for rules.
- [Cloud Security Detections](/api-reference/collections/cloud-security-detections/): 3 operations
  - [cspm_evaluations_combined_iom_by_rule](/api-reference/collections/cloud-security-detections/#cspm_evaluations_combined_iom_by_rule): Return IOMs grouped by rule.
  - [cspm_evaluations_iom_entities](/api-reference/collections/cloud-security-detections/#cspm_evaluations_iom_entities): Gets IOMs based on the provided IDs
  - [cspm_evaluations_iom_queries](/api-reference/collections/cloud-security-detections/#cspm_evaluations_iom_queries): Gets a list of IOM IDs for the given parameters, filters and sort criteria.
- [Cloud Security Risks](/api-reference/collections/cloud-security-risks/): 1 operations
  - [cloud_security_timeline_risks_enriched](/api-reference/collections/cloud-security-risks/#cloud_security_timeline_risks_enriched): Returns the enriched asset timeline. Rate limited to 500 requests per minute per CID. Exceeding this limit returns HTTP 429 (Too Many Requests).
- [Cloud Snapshots](/api-reference/collections/cloud-snapshots/): 8 operations
  - [CombinedDetections](/api-reference/collections/cloud-snapshots/#combineddetections): Search IaC Detections using a query in Falcon Query Language.
  - [ReadDeploymentsCombined](/api-reference/collections/cloud-snapshots/#readdeploymentscombined): Search for snapshot jobs identified by the provided filter.
  - [RegisterCspmSnapshotAccount](/api-reference/collections/cloud-snapshots/#registercspmsnapshotaccount): Register a cloud account for snapshot scanning.
  - [ReadDeploymentsEntities](/api-reference/collections/cloud-snapshots/#readdeploymentsentities): Retrieve snapshot jobs identified by the provided IDs.
  - [CreateDeploymentEntity](/api-reference/collections/cloud-snapshots/#createdeploymententity): Launch a snapshot scan for a given cloud asset.
  - [GetCredentialsIAC](/api-reference/collections/cloud-snapshots/#getcredentialsiac): Gets the registry credentials (external endpoint).
  - [GetScanReport](/api-reference/collections/cloud-snapshots/#getscanreport): Retrieve the scan report for an instance.
  - [GetCredentialsMixin0](/api-reference/collections/cloud-snapshots/#getcredentialsmixin0): Gets the registry credentials.
- [Configuration Assessment](/api-reference/collections/configuration-assessment/): 2 operations
  - [getCombinedAssessmentsQuery](/api-reference/collections/configuration-assessment/#getcombinedassessmentsquery): Search for assessments in your environment by providing an FQL filter and paging details. Returns a set of HostFinding entities which match the filter criteria
  - [getRuleDetails](/api-reference/collections/configuration-assessment/#getruledetails): Get rules details for provided one or more rule IDs
- [Configuration Assessment Evaluation Logic](/api-reference/collections/configuration-assessment-evaluation-logic/): 1 operations
  - [getEvaluationLogicMixin0](/api-reference/collections/configuration-assessment-evaluation-logic/#getevaluationlogicmixin0): Get details on evaluation logic items by providing one or more finding IDs.
- [Container Alerts](/api-reference/collections/container-alerts/): 3 operations
  - [ReadContainerAlertsCountBySeverity](/api-reference/collections/container-alerts/#readcontaineralertscountbyseverity): Get Container Alert counts by severity.
  - [ReadContainerAlertsCount](/api-reference/collections/container-alerts/#readcontaineralertscount): Search Container Alerts by the provided search criteria
  - [SearchAndReadContainerAlerts](/api-reference/collections/container-alerts/#searchandreadcontaineralerts): Search Container Alerts by the provided search criteria
- [Container Detections](/api-reference/collections/container-detections/): 7 operations
  - [GetRuntimeDetectionsCombinedV2](/api-reference/collections/container-detections/#getruntimedetectionscombinedv2): Retrieve image assessment detections identified by the provided filter criteria.
  - [ReadDetectionsCountBySeverity](/api-reference/collections/container-detections/#readdetectionscountbyseverity): Aggregate counts of detections by severity.
  - [ReadDetectionsCountByType](/api-reference/collections/container-detections/#readdetectionscountbytype): Aggregate counts of detections by detection type.
  - [ReadDetectionsCount](/api-reference/collections/container-detections/#readdetectionscount): Aggregate count of detections.
  - [ReadCombinedDetections](/api-reference/collections/container-detections/#readcombineddetections): Retrieve image assessment detections identified by the provided filter criteria.
  - [ReadDetections](/api-reference/collections/container-detections/#readdetections): Retrieve image assessment detection entities identified by the provided filter criteria.
  - [SearchDetections](/api-reference/collections/container-detections/#searchdetections): Retrieve image assessment detection entities identified by the provided filter criteria.
- [Container Image Compliance](/api-reference/collections/container-image-compliance/): 11 operations
  - [extAggregateClusterAssessments](/api-reference/collections/container-image-compliance/#extaggregateclusterassessments): Get the assessments for each cluster.
  - [extAggregateImageAssessments](/api-reference/collections/container-image-compliance/#extaggregateimageassessments): Get the assessments for each image.
  - [extAggregateRulesAssessments](/api-reference/collections/container-image-compliance/#extaggregaterulesassessments): Get the assessments for each rule.
  - [extAggregateFailedContainersByRulesPath](/api-reference/collections/container-image-compliance/#extaggregatefailedcontainersbyrulespath): Get the containers grouped into rules on which they failed.
  - [extAggregateFailedContainersCountBySeverity](/api-reference/collections/container-image-compliance/#extaggregatefailedcontainerscountbyseverity): Get the failed containers count grouped into severity levels.
  - [extAggregateFailedImagesByRulesPath](/api-reference/collections/container-image-compliance/#extaggregatefailedimagesbyrulespath): Get the images grouped into rules on which they failed.
  - [extAggregateFailedImagesCountBySeverity](/api-reference/collections/container-image-compliance/#extaggregatefailedimagescountbyseverity): Get the failed images count grouped into severity levels.
  - [extAggregateFailedRulesByClusters](/api-reference/collections/container-image-compliance/#extaggregatefailedrulesbyclusters): Get the failed rules for each cluster grouped into severity levels.
  - [extAggregateFailedRulesByImages](/api-reference/collections/container-image-compliance/#extaggregatefailedrulesbyimages): Get images with failed rules, rule count grouped by severity for each image.
  - [extAggregateFailedRulesCountBySeverity](/api-reference/collections/container-image-compliance/#extaggregatefailedrulescountbyseverity): Get the failed rules count grouped into severity levels.
  - [extAggregateRulesByStatus](/api-reference/collections/container-image-compliance/#extaggregaterulesbystatus): Get the rules grouped by their statuses.
- [Container Images](/api-reference/collections/container-images/): 13 operations
  - [AggregateImageAssessmentHistory](/api-reference/collections/container-images/#aggregateimageassessmenthistory): Image assessment history
  - [AggregateImageCountByBaseOS](/api-reference/collections/container-images/#aggregateimagecountbybaseos): Aggregate count of images grouped by Base OS distribution
  - [AggregateImageCountByState](/api-reference/collections/container-images/#aggregateimagecountbystate): Aggregate count of images grouped by state
  - [AggregateImageCount](/api-reference/collections/container-images/#aggregateimagecount): Aggregate count of images
  - [CombinedBaseImages](/api-reference/collections/container-images/#combinedbaseimages): Retrieve base images identified by the provided filter criteria
  - [GetCombinedImages](/api-reference/collections/container-images/#getcombinedimages): Get image assessment results by providing an FQL filter and paging details
  - [CombinedImageByVulnerabilityCount](/api-reference/collections/container-images/#combinedimagebyvulnerabilitycount): Retrieve top x images with the most vulnerabilities
  - [CombinedImageDetail](/api-reference/collections/container-images/#combinedimagedetail): Retrieve image entities identified by the provided filter criteria
  - [ReadCombinedImagesExport](/api-reference/collections/container-images/#readcombinedimagesexport): Retrieve images with an option to expand aggregated vulnerabilities/detections
  - [CombinedImageIssuesSummary](/api-reference/collections/container-images/#combinedimageissuessummary): Retrieve image issues summary such as Image detections, Runtime detections, Policies, vulnerabilities
  - [CombinedImageVulnerabilitySummary](/api-reference/collections/container-images/#combinedimagevulnerabilitysummary): aggregates information about vulnerabilities for an image
  - [CreateBaseImagesEntities](/api-reference/collections/container-images/#createbaseimagesentities): Creates base images using the provided details
  - [DeleteBaseImages](/api-reference/collections/container-images/#deletebaseimages): Delete base images by base image UUID
- [Container Packages](/api-reference/collections/container-packages/): 7 operations
  - [ReadPackagesByImageCount](/api-reference/collections/container-packages/#readpackagesbyimagecount): Retrieves the N most frequently used packages across images.
  - [ReadPackagesCountByZeroDay](/api-reference/collections/container-packages/#readpackagescountbyzeroday): Retrieve packages count affected by zero day vulnerabilities.
  - [ReadPackagesByFixableVulnCount](/api-reference/collections/container-packages/#readpackagesbyfixablevulncount): Retrieve top x app packages with the most fixable vulnerabilities.
  - [ReadPackagesByVulnCount](/api-reference/collections/container-packages/#readpackagesbyvulncount): Retrieve top x packages with the most vulnerabilities.
  - [ReadPackagesCombinedExport](/api-reference/collections/container-packages/#readpackagescombinedexport): Retrieve packages identified by the provided filter criteria for the purpose of export.
  - [ReadPackagesCombined](/api-reference/collections/container-packages/#readpackagescombined): Retrieve packages identified by the provided filter criteria.
  - [ReadPackagesCombinedV2](/api-reference/collections/container-packages/#readpackagescombinedv2): Retrieve packages identified by the provided filter criteria.
- [Container Vulnerabilities](/api-reference/collections/container-vulnerabilities/): 10 operations
  - [ReadVulnerabilityCountByActivelyExploited](/api-reference/collections/container-vulnerabilities/#readvulnerabilitycountbyactivelyexploited): Aggregate count of vulnerabilities grouped by actively exploited
  - [ReadVulnerabilityCountByCPSRating](/api-reference/collections/container-vulnerabilities/#readvulnerabilitycountbycpsrating): Aggregate count of vulnerabilities grouped by csp_rating
  - [ReadVulnerabilityCountByCVSSScore](/api-reference/collections/container-vulnerabilities/#readvulnerabilitycountbycvssscore): Aggregate count of vulnerabilities grouped by cvss score
  - [ReadVulnerabilityCountBySeverity](/api-reference/collections/container-vulnerabilities/#readvulnerabilitycountbyseverity): Aggregate count of vulnerabilities grouped by severity
  - [ReadVulnerabilityCount](/api-reference/collections/container-vulnerabilities/#readvulnerabilitycount): Aggregate count of vulnerabilities
  - [ReadVulnerabilitiesByImageCount](/api-reference/collections/container-vulnerabilities/#readvulnerabilitiesbyimagecount): Retrieve top x vulnerabilities with the most impacted images
  - [ReadVulnerabilitiesPublicationDate](/api-reference/collections/container-vulnerabilities/#readvulnerabilitiespublicationdate): Retrieve top x vulnerabilities with the most recent publication date
  - [ReadCombinedVulnerabilitiesDetails](/api-reference/collections/container-vulnerabilities/#readcombinedvulnerabilitiesdetails): Retrieve vulnerability details related to an image
  - [ReadCombinedVulnerabilitiesInfo](/api-reference/collections/container-vulnerabilities/#readcombinedvulnerabilitiesinfo): Retrieve vulnerability and package related info for this customer
  - [ReadCombinedVulnerabilities](/api-reference/collections/container-vulnerabilities/#readcombinedvulnerabilities): Retrieve vulnerability and aggregate data filtered by the provided FQL
- [Content Update Policies](/api-reference/collections/content-update-policies/): 11 operations
  - [queryCombinedContentUpdatePolicyMembers](/api-reference/collections/content-update-policies/#querycombinedcontentupdatepolicymembers): Search for members of a Content Update Policy in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria.
  - [queryCombinedContentUpdatePolicies](/api-reference/collections/content-update-policies/#querycombinedcontentupdatepolicies): Search for Content Update Policies in your environment by providing an FQL filter and paging details. Returns a set of Content Update Policies which match the filter criteria.
  - [performContentUpdatePoliciesAction](/api-reference/collections/content-update-policies/#performcontentupdatepoliciesaction): Perform the specified action on the Content Update Policies specified in the request.
  - [setContentUpdatePoliciesPrecedence](/api-reference/collections/content-update-policies/#setcontentupdatepoliciesprecedence): Sets the precedence of Content Update Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies when updating precedence.
  - [getContentUpdatePolicies](/api-reference/collections/content-update-policies/#getcontentupdatepolicies): Retrieve a set of Content Update Policies by specifying their IDs.
  - [createContentUpdatePolicies](/api-reference/collections/content-update-policies/#createcontentupdatepolicies): Create Content Update Policies by specifying details about the policy to create.
  - [deleteContentUpdatePolicies](/api-reference/collections/content-update-policies/#deletecontentupdatepolicies): Delete a set of Content Update Policies by specifying their IDs.
  - [updateContentUpdatePolicies](/api-reference/collections/content-update-policies/#updatecontentupdatepolicies): Update Content Update Policies by specifying the ID of the policy and details to update.
  - [queryContentUpdatePolicyMembers](/api-reference/collections/content-update-policies/#querycontentupdatepolicymembers): Search for members of a Content Update Policy in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria.
  - [queryPinnableContentVersions](/api-reference/collections/content-update-policies/#querypinnablecontentversions): Search for content versions available for pinning given the category.
  - [queryContentUpdatePolicies](/api-reference/collections/content-update-policies/#querycontentupdatepolicies): Search for Content Update Policies in your environment by providing an FQL filter and paging details. Returns a set of Content Update Policy IDs which match the filter criteria.
- [Correlation Rules](/api-reference/collections/correlation-rules/): 18 operations
  - [aggregates_rule_versions_post_v1](/api-reference/collections/correlation-rules/#aggregates_rule_versions_post_v1): Get rules aggregates as specified via json in the request body.
  - [combined_rules_get_v1](/api-reference/collections/correlation-rules/#combined_rules_get_v1): Find all rules matching the query and filter.
  - [combined_rules_get_v2](/api-reference/collections/correlation-rules/#combined_rules_get_v2): Find all rules matching the query and filter.
  - [entities_latest_rules_get_v1](/api-reference/collections/correlation-rules/#entities_latest_rules_get_v1): Retrieve latest rule versions by rule IDs.
  - [entities_rule_versions_export_post_v1](/api-reference/collections/correlation-rules/#entities_rule_versions_export_post_v1): Export rule versions.
  - [entities_rule_versions_import_post_v1](/api-reference/collections/correlation-rules/#entities_rule_versions_import_post_v1): Import rule versions.
  - [entities_rule_versions_publish_patch_v1](/api-reference/collections/correlation-rules/#entities_rule_versions_publish_patch_v1): Publish existing rule version.
  - [entities_rule_versions_delete_v1](/api-reference/collections/correlation-rules/#entities_rule_versions_delete_v1): Delete versions by IDs.
  - [entities_rules_get_v1](/api-reference/collections/correlation-rules/#entities_rules_get_v1): Retrieve rules by IDs.
  - [entities_rules_post_v1](/api-reference/collections/correlation-rules/#entities_rules_post_v1): Create a correlation rule.
  - [entities_rules_delete_v1](/api-reference/collections/correlation-rules/#entities_rules_delete_v1): Delete rules by IDs.
  - [entities_rules_patch_v1](/api-reference/collections/correlation-rules/#entities_rules_patch_v1): Update a correlation rule.
  - [entities_rules_get_v2](/api-reference/collections/correlation-rules/#entities_rules_get_v2): Retrieve rule versions by IDs.
  - [queries_rules_get_v1](/api-reference/collections/correlation-rules/#queries_rules_get_v1): Find all rule IDs matching the query and filter.
  - [queries_rules_get_v2](/api-reference/collections/correlation-rules/#queries_rules_get_v2): Find all rule version IDs matching the query and filter.
  - [queries_templates_get_v1Mixin0](/api-reference/collections/correlation-rules/#queries_templates_get_v1mixin0): Search rule template IDs matching the filter.
  - [entities_templates_rules_post_v1](/api-reference/collections/correlation-rules/#entities_templates_rules_post_v1): Create rule from template.
  - [entities_templates_get_v1Mixin0](/api-reference/collections/correlation-rules/#entities_templates_get_v1mixin0): Retrieve rule templates by IDs.
- [Correlation Rules Admin](/api-reference/collections/correlation-rules-admin/): 1 operations
  - [entities_rules_ownership_put_v1](/api-reference/collections/correlation-rules-admin/#entities_rules_ownership_put_v1): Change the owner of an existing Correlation Rule
- [CSPM Registration](/api-reference/collections/cspm-registration/): 39 operations
  - [GetCSPMAwsAccount](/api-reference/collections/cspm-registration/#getcspmawsaccount): Returns information about the current status of an AWS account.
  - [CreateCSPMAwsAccount](/api-reference/collections/cspm-registration/#createcspmawsaccount): Creates a new account in our system for a customer and generates a script for them to run in their AWS cloud environment to grant us access.
  - [DeleteCSPMAwsAccount](/api-reference/collections/cspm-registration/#deletecspmawsaccount): Deletes an existing AWS account or organization in our system.
  - [PatchCSPMAwsAccount](/api-reference/collections/cspm-registration/#patchcspmawsaccount): Patches a existing account in our system for a customer.
  - [GetCSPMAwsConsoleSetupURLs](/api-reference/collections/cspm-registration/#getcspmawsconsolesetupurls): Return a URL for customer to visit in their cloud environment to grant us access to their AWS environment.
  - [GetCSPMAwsAccountScriptsAttachment](/api-reference/collections/cspm-registration/#getcspmawsaccountscriptsattachment): Return a script for customer to run in their cloud environment to grant us access to their AWS environment as a downloadable attachment.
  - [GetCSPMAzureAccount](/api-reference/collections/cspm-registration/#getcspmazureaccount): Return information about Azure account registration
  - [CreateCSPMAzureAccount](/api-reference/collections/cspm-registration/#createcspmazureaccount): Creates a new account in our system for a customer and generates a script for them to run in their cloud environment to grant us access.
  - [DeleteCSPMAzureAccount](/api-reference/collections/cspm-registration/#deletecspmazureaccount): Deletes an Azure subscription from the system.
  - [UpdateCSPMAzureAccountClientID](/api-reference/collections/cspm-registration/#updatecspmazureaccountclientid): Update an Azure service account in our system by with the user-created client_id created with the public key we've provided
  - [UpdateCSPMAzureTenantDefaultSubscriptionID](/api-reference/collections/cspm-registration/#updatecspmazuretenantdefaultsubscriptionid): Update an Azure default subscription_id in our system for given tenant_id
  - [AzureDownloadCertificate](/api-reference/collections/cspm-registration/#azuredownloadcertificate): Returns JSON object(s) that contain the base64 encoded certificate for a service principal.
  - [AzureRefreshCertificate](/api-reference/collections/cspm-registration/#azurerefreshcertificate): Refresh certificate and returns JSON object(s) that contain the base64 encoded certificate for a service principal.
  - [GetCSPMAzureUserScriptsAttachment](/api-reference/collections/cspm-registration/#getcspmazureuserscriptsattachment): Return a script for customer to run in their cloud environment to grant us access to their Azure environment as a downloadable attachment
  - [GetBehaviorDetections](/api-reference/collections/cspm-registration/#getbehaviordetections): Retrieve list of detected behaviors.
  - [GetConfigurationDetections](/api-reference/collections/cspm-registration/#getconfigurationdetections): Retrieve list of detected behaviors.
  - [GetConfigurationDetectionEntities](/api-reference/collections/cspm-registration/#getconfigurationdetectionentities): Get misconfigurations based on the ID - including custom policy detections in addition to default policy detections.
  - [GetConfigurationDetectionIDsV2](/api-reference/collections/cspm-registration/#getconfigurationdetectionidsv2): Get a list of active misconfiguration ids - including custom policy detections in addition to default policy detections.
  - [GetCSPMPolicy](/api-reference/collections/cspm-registration/#getcspmpolicy): Given a policy ID, returns detailed policy information.
  - [GetCSPMPoliciesDetails](/api-reference/collections/cspm-registration/#getcspmpoliciesdetails): Given an array of policy IDs, returns detailed policies information.
  - [GetCSPMPolicySettings](/api-reference/collections/cspm-registration/#getcspmpolicysettings): Returns information about current policy settings.
  - [UpdateCSPMPolicySettings](/api-reference/collections/cspm-registration/#updatecspmpolicysettings): Updates a policy setting - can be used to override policy severity or to disable a policy entirely.
  - [GetCSPMScanSchedule](/api-reference/collections/cspm-registration/#getcspmscanschedule): Returns scan schedule configuration for one or more cloud platforms.
  - [UpdateCSPMScanSchedule](/api-reference/collections/cspm-registration/#updatecspmscanschedule): Updates scan schedule configuration for one or more cloud platforms.
  - [GetCSPMAzureManagementGroup](/api-reference/collections/cspm-registration/#getcspmazuremanagementgroup): Return information about Azure management group registration
  - [DeleteCSPMAzureManagementGroup](/api-reference/collections/cspm-registration/#deletecspmazuremanagementgroup): Deletes Azure management groups from the system.
  - [CreateCSPMAzureManagementGroup](/api-reference/collections/cspm-registration/#createcspmazuremanagementgroup): Creates a new management group in our system for a customer.
  - [CreateCSPMGCPAccount](/api-reference/collections/cspm-registration/#createcspmgcpaccount): Creates a new account and generates a new service account to add access to your GCP environment.
  - [DeleteCSPMGCPAccount](/api-reference/collections/cspm-registration/#deletecspmgcpaccount): Deletes a GCP account from the system.
  - [UpdateCSPMGCPAccount](/api-reference/collections/cspm-registration/#updatecspmgcpaccount): Updates an existing GCP account.
  - [ConnectCSPMGCPAccount](/api-reference/collections/cspm-registration/#connectcspmgcpaccount): Creates a new GCP account with newly-uploaded service account or connects with existing service account with only the following fields: `parent_id`, `parent_type` and `service_account_id`
  - [GetCSPMGCPServiceAccountsExt](/api-reference/collections/cspm-registration/#getcspmgcpserviceaccountsext): Returns the service account id and client email for external clients.
  - [UpdateCSPMGCPServiceAccountsExt](/api-reference/collections/cspm-registration/#updatecspmgcpserviceaccountsext): Updates an existing GCP service account.
  - [GetCSPMGCPUserScriptsAttachment](/api-reference/collections/cspm-registration/#getcspmgcpuserscriptsattachment): Return a script for customer to run in their cloud environment to grant us access to their GCP environment as a downloadable attachment
  - [GetCSPMGCPValidateAccountsExt](/api-reference/collections/cspm-registration/#getcspmgcpvalidateaccountsext): Run a synchronous health check.
  - [ValidateCSPMGCPServiceAccountExt](/api-reference/collections/cspm-registration/#validatecspmgcpserviceaccountext): Validates credentials for a service account
  - [GetCSPMCGPAccount](/api-reference/collections/cspm-registration/#getcspmcgpaccount): Returns information about the current status of an GCP account.
  - [UpdateCSPMAzureAccount](/api-reference/collections/cspm-registration/#updatecspmazureaccount): Patches a existing account in our system for a customer.
  - [getCloudEventIDs](/api-reference/collections/cspm-registration/#getcloudeventids): Get list of related cloud event LogScale IDs for a given IOA
- [Custom IOA](/api-reference/collections/custom-ioa/): 20 operations
  - [get_patterns](/api-reference/collections/custom-ioa/#get_patterns): Get pattern severities by ID.
  - [get_platformsMixin0](/api-reference/collections/custom-ioa/#get_platformsmixin0): Get platforms by ID.
  - [get_rule_groupsMixin0](/api-reference/collections/custom-ioa/#get_rule_groupsmixin0): Get rule groups by ID.
  - [create_rule_groupMixin0](/api-reference/collections/custom-ioa/#create_rule_groupmixin0): Create a rule group for a platform with a name and an optional description. Returns the rule group.
  - [delete_rule_groupsMixin0](/api-reference/collections/custom-ioa/#delete_rule_groupsmixin0): Delete rule groups by ID.
  - [update_rule_groupMixin0](/api-reference/collections/custom-ioa/#update_rule_groupmixin0): Update a rule group. The following properties can be modified: name, description, enabled.
  - [get_rule_types](/api-reference/collections/custom-ioa/#get_rule_types): Get rule types by ID.
  - [get_rules_get](/api-reference/collections/custom-ioa/#get_rules_get): Get rules by ID and optionally version in the following format: `ID[:version]`.
  - [get_rulesMixin0](/api-reference/collections/custom-ioa/#get_rulesmixin0): Get rules by ID and optionally version in the following format: `ID[:version]`. The max number of IDs is constrained by URL size.
  - [create_rule](/api-reference/collections/custom-ioa/#create_rule): Create a rule within a rule group. Returns the rule.
  - [delete_rules](/api-reference/collections/custom-ioa/#delete_rules): Delete rules from a rule group by ID.
  - [update_rules](/api-reference/collections/custom-ioa/#update_rules): Update rules within a rule group. Return the updated rules.
  - [update_rules_v2](/api-reference/collections/custom-ioa/#update_rules_v2): Update name, description, enabled or field_values for individual rules within a rule group. The v1 flavor of this call requires the caller to specify the complete state for all the rules in the rule group, instead the v2 flavor will accept the subset of rules in the rule group and apply the attribute updates to the subset of rules in the rule group. Returns the updated rules.
  - [validate](/api-reference/collections/custom-ioa/#validate): Validates field values and checks for matches if a test string is provided.
  - [query_patterns](/api-reference/collections/custom-ioa/#query_patterns): Get all pattern severity IDs.
  - [query_platformsMixin0](/api-reference/collections/custom-ioa/#query_platformsmixin0): Get all platform IDs.
  - [query_rule_groups_full](/api-reference/collections/custom-ioa/#query_rule_groups_full): Find all rule groups matching the query with optional filter.
  - [query_rule_groupsMixin0](/api-reference/collections/custom-ioa/#query_rule_groupsmixin0): Finds all rule group IDs matching the query with optional filter.
  - [query_rule_types](/api-reference/collections/custom-ioa/#query_rule_types): Get all rule type IDs.
  - [query_rulesMixin0](/api-reference/collections/custom-ioa/#query_rulesmixin0): Finds all rule IDs matching the query with optional filter.
- [Custom Storage](/api-reference/collections/custom-storage/): 18 operations
  - [ListCollections](/api-reference/collections/custom-storage/#listcollections): List available collection names in alphabetical order.
  - [DescribeCollections](/api-reference/collections/custom-storage/#describecollections): Fetch metadata about one or more existing collections.
  - [DescribeCollection](/api-reference/collections/custom-storage/#describecollection): Fetch metadata about an existing collection.
  - [ListObjects](/api-reference/collections/custom-storage/#listobjects): List the object keys in the specified collection in alphabetical order
  - [SearchObjects](/api-reference/collections/custom-storage/#searchobjects): Search for objects that match the specified filter criteria (returns metadata, not actual objects)
  - [GetObject](/api-reference/collections/custom-storage/#getobject): Get the bytes for the specified object
  - [PutObject](/api-reference/collections/custom-storage/#putobject): Put the specified new object at the given key or overwrite an existing object at the given key
  - [DeleteObject](/api-reference/collections/custom-storage/#deleteobject): Delete the specified object
  - [GetObjectMetadata](/api-reference/collections/custom-storage/#getobjectmetadata): Get the metadata for the specified object
  - [ListSchemas](/api-reference/collections/custom-storage/#listschemas): Get the list of schemas for the requested collection in reverse version order (latest first).
  - [GetSchema](/api-reference/collections/custom-storage/#getschema): Get the bytes of the specified schema of the requested collection.
  - [GetSchemaMetadata](/api-reference/collections/custom-storage/#getschemametadata): Get the metadata for the specified schema of the requested collection.
  - [ListObjectsByVersion](/api-reference/collections/custom-storage/#listobjectsbyversion): List the object keys in the specified collection in alphabetical order
  - [SearchObjectsByVersion](/api-reference/collections/custom-storage/#searchobjectsbyversion): Search for objects that match the specified filter criteria (returns metadata, not actual objects)
  - [GetVersionedObject](/api-reference/collections/custom-storage/#getversionedobject): Get the bytes for the specified object
  - [PutObjectByVersion](/api-reference/collections/custom-storage/#putobjectbyversion): Put the specified new object at the given key or overwrite an existing object at the given key
  - [DeleteVersionedObject](/api-reference/collections/custom-storage/#deleteversionedobject): Delete the specified versioned object
  - [GetVersionedObjectMetadata](/api-reference/collections/custom-storage/#getversionedobjectmetadata): Get the metadata for the specified object
- [D4C Registration](/api-reference/collections/d4c-registration/): 22 operations
  - [GetD4CAwsAccount](/api-reference/collections/d4c-registration/#getd4cawsaccount): Returns information about the current status of an AWS account.
  - [CreateD4CAwsAccount](/api-reference/collections/d4c-registration/#created4cawsaccount): Creates a new account in our system for a customer and generates a script for them to run in their AWS cloud environment to grant us access.
  - [DeleteD4CAwsAccount](/api-reference/collections/d4c-registration/#deleted4cawsaccount): Deletes an existing AWS account or organization in our system.
  - [GetD4CAwsConsoleSetupURLs](/api-reference/collections/d4c-registration/#getd4cawsconsolesetupurls): Return a URL for customer to visit in their cloud environment to grant us access to their AWS environment.
  - [GetD4CAWSAccountScriptsAttachment](/api-reference/collections/d4c-registration/#getd4cawsaccountscriptsattachment): Return a script for customer to run in their cloud environment to grant us access to their AWS environment as a downloadable attachment.
  - [GetDiscoverCloudAzureAccount](/api-reference/collections/d4c-registration/#getdiscovercloudazureaccount): Return information about Azure account registration.
  - [CreateDiscoverCloudAzureAccount](/api-reference/collections/d4c-registration/#creatediscovercloudazureaccount): Creates a new account in our system for a customer and generates a script for them to run in their cloud environment to grant us access.
  - [UpdateDiscoverCloudAzureAccountClientID](/api-reference/collections/d4c-registration/#updatediscovercloudazureaccountclientid): Update an Azure service account in our system by with the user-created client_id created with the public key we've provided.
  - [GetDiscoverCloudAzureUserScriptsAttachment](/api-reference/collections/d4c-registration/#getdiscovercloudazureuserscriptsattachment): Return a script for customer to run in their cloud environment to grant us access to their Azure environment as a downloadable attachment.
  - [GetDiscoverCloudAzureUserScripts](/api-reference/collections/d4c-registration/#getdiscovercloudazureuserscripts): Return a script for customer to run in their cloud environment to grant us access to their Azure environment.
  - [DiscoverCloudAzureDownloadCertificate](/api-reference/collections/d4c-registration/#discovercloudazuredownloadcertificate): Returns JSON object(s) that contain the base64 encoded certificate for a service principal.
  - [GetDiscoverCloudAzureTenantIDs](/api-reference/collections/d4c-registration/#getdiscovercloudazuretenantids): Return available tenant ids for discover for cloud. This operation has been deprecated and will be removed from the SDK when this endpoint is decommissioned.
  - [GetHorizonD4CScripts](/api-reference/collections/d4c-registration/#gethorizond4cscripts): Returns static install scripts for Horizon. This operation has been deprecated and will be removed from the SDK when this endpoint is decommissioned.
  - [DeleteD4CGCPAccount](/api-reference/collections/d4c-registration/#deleted4cgcpaccount): Deletes a GCP account from the system. This operation has been deprecated.
  - [ConnectD4CGCPAccount](/api-reference/collections/d4c-registration/#connectd4cgcpaccount): Creates a new GCP account with newly-uploaded service account or connects with existing service account with only the following fields: `parent_id`, `parent_type` and `service_account_id`. This operation has been deprecated.
  - [GetD4CGCPServiceAccountsExt](/api-reference/collections/d4c-registration/#getd4cgcpserviceaccountsext): Returns the service account id and client email for external clients. This operation has been deprecated.
  - [UpdateD4CGCPServiceAccountsExt](/api-reference/collections/d4c-registration/#updated4cgcpserviceaccountsext): Updates an existing GCP service account.
  - [GetD4CGCPUserScriptsAttachment](/api-reference/collections/d4c-registration/#getd4cgcpuserscriptsattachment): Return a script for customer to run in their cloud environment to grant us access to their GCP environment as a downloadable attachment. This operation has been deprecated.
  - [CreateD4CGCPAccount](/api-reference/collections/d4c-registration/#created4cgcpaccount): Creates a new account in our system for a customer and generates a new service account for them to add access to in their GCP environment to grant us access.
  - [GetCSPMGCPUserScriptsAttachment](/api-reference/collections/d4c-registration/#getcspmgcpuserscriptsattachment): Return a script for customer to run in their cloud environment to grant us access to their GCP environment as a downloadable attachment.
  - [GetD4CCGPAccount](/api-reference/collections/d4c-registration/#getd4ccgpaccount): Returns information about the current status of an GCP account.
  - [GetD4CGCPUserScripts](/api-reference/collections/d4c-registration/#getd4cgcpuserscripts): Return a script for customer to run in their cloud environment to grant us access to their GCP environment.
- [Data Protection Configuration](/api-reference/collections/data-protection-configuration/): 47 operations
  - [entities_classification_get_v2](/api-reference/collections/data-protection-configuration/#entities_classification_get_v2): Gets the classifications that match the provided ids
  - [entities_classification_post_v2](/api-reference/collections/data-protection-configuration/#entities_classification_post_v2): Create classifications
  - [entities_classification_patch_v2](/api-reference/collections/data-protection-configuration/#entities_classification_patch_v2): Update classifications
  - [entities_classification_delete_v2](/api-reference/collections/data-protection-configuration/#entities_classification_delete_v2): Deletes classifications that match the provided ids
  - [entities_cloud_application_get](/api-reference/collections/data-protection-configuration/#entities_cloud_application_get): Get a particular cloud-application
  - [entities_cloud_application_create](/api-reference/collections/data-protection-configuration/#entities_cloud_application_create): Persist the given cloud application for the provided entity instance
  - [entities_cloud_application_patch](/api-reference/collections/data-protection-configuration/#entities_cloud_application_patch): Update a cloud application.
  - [entities_cloud_application_delete](/api-reference/collections/data-protection-configuration/#entities_cloud_application_delete): Delete cloud application.
  - [entities_content_pattern_get](/api-reference/collections/data-protection-configuration/#entities_content_pattern_get): Get a particular content-pattern(s).
  - [entities_content_pattern_create](/api-reference/collections/data-protection-configuration/#entities_content_pattern_create): Persist the given content pattern for the provided entity instance.
  - [entities_content_pattern_patch](/api-reference/collections/data-protection-configuration/#entities_content_pattern_patch): Update a content pattern.
  - [entities_content_pattern_delete](/api-reference/collections/data-protection-configuration/#entities_content_pattern_delete): Delete content pattern.
  - [entities_policy_precedence_post_v1](/api-reference/collections/data-protection-configuration/#entities_policy_precedence_post_v1): Update Policy Precedence.
  - [entities_enterprise_account_get](/api-reference/collections/data-protection-configuration/#entities_enterprise_account_get): Get a particular enterprise-account(s).
  - [entities_enterprise_account_create](/api-reference/collections/data-protection-configuration/#entities_enterprise_account_create): Persist the given enterprise account for the provided entity instance.
  - [entities_enterprise_account_patch](/api-reference/collections/data-protection-configuration/#entities_enterprise_account_patch): Update a enterprise account.
  - [entities_enterprise_account_delete](/api-reference/collections/data-protection-configuration/#entities_enterprise_account_delete): Delete enterprise account.
  - [entities_file_type_get](/api-reference/collections/data-protection-configuration/#entities_file_type_get): Get a particular file-type.
  - [entities_sensitivity_label_get_v2](/api-reference/collections/data-protection-configuration/#entities_sensitivity_label_get_v2): Get sensitivity label matching the IDs (V2).
  - [entities_sensitivity_label_create_v2](/api-reference/collections/data-protection-configuration/#entities_sensitivity_label_create_v2): Create new sensitivity label (V2).
  - [entities_sensitivity_label_delete_v2](/api-reference/collections/data-protection-configuration/#entities_sensitivity_label_delete_v2): Delete sensitivity labels matching the IDs (V2).
  - [entities_local_application_group_get](/api-reference/collections/data-protection-configuration/#entities_local_application_group_get): Get particular local application groups.
  - [entities_local_application_group_create](/api-reference/collections/data-protection-configuration/#entities_local_application_group_create): Persist the given local application group for the provided entity instance.
  - [entities_local_application_group_patch](/api-reference/collections/data-protection-configuration/#entities_local_application_group_patch): Update a local application group.
  - [entities_local_application_group_delete](/api-reference/collections/data-protection-configuration/#entities_local_application_group_delete): Soft Delete local application. The application won't be visible anymore, but will still be in the database.
  - [entities_local_application_get](/api-reference/collections/data-protection-configuration/#entities_local_application_get): Get a particular local application.
  - [entities_local_application_create](/api-reference/collections/data-protection-configuration/#entities_local_application_create): Persist the given local application for the provided entity instance.
  - [entities_local_application_patch](/api-reference/collections/data-protection-configuration/#entities_local_application_patch): Update a local application.
  - [entities_local_application_delete](/api-reference/collections/data-protection-configuration/#entities_local_application_delete): Soft Delete local application. The application wont be visible anymore, but will still be in the database.
  - [entities_policy_get_v2](/api-reference/collections/data-protection-configuration/#entities_policy_get_v2): Get policies that match the provided ids.
  - [entities_policy_post_v2](/api-reference/collections/data-protection-configuration/#entities_policy_post_v2): Create policies.
  - [entities_policy_patch_v2](/api-reference/collections/data-protection-configuration/#entities_policy_patch_v2): Update policies.
  - [entities_policy_delete_v2](/api-reference/collections/data-protection-configuration/#entities_policy_delete_v2): Delete policies that match the provided ids.
  - [entities_web_location_get_v2](/api-reference/collections/data-protection-configuration/#entities_web_location_get_v2): Get web-location entities matching the provided ID(s).
  - [entities_web_location_create_v2](/api-reference/collections/data-protection-configuration/#entities_web_location_create_v2): Persist the given web-locations.
  - [entities_web_location_patch_v2](/api-reference/collections/data-protection-configuration/#entities_web_location_patch_v2): Update a web-location.
  - [entities_web_location_delete_v2](/api-reference/collections/data-protection-configuration/#entities_web_location_delete_v2): Delete web-location.
  - [queries_classification_get_v2](/api-reference/collections/data-protection-configuration/#queries_classification_get_v2): Search for classifications that match the provided criteria.
  - [queries_cloud_application_get_v2](/api-reference/collections/data-protection-configuration/#queries_cloud_application_get_v2): Get all cloud-application IDs matching the query with filter.
  - [queries_content_pattern_get_v2](/api-reference/collections/data-protection-configuration/#queries_content_pattern_get_v2): Get all content-pattern IDs matching the query with filter.
  - [queries_enterprise_account_get_v2](/api-reference/collections/data-protection-configuration/#queries_enterprise_account_get_v2): Get all enterprise-account IDs matching the query with filter.
  - [queries_file_type_get_v2](/api-reference/collections/data-protection-configuration/#queries_file_type_get_v2): Get all file-type IDs matching the query with filter.
  - [queries_sensitivity_label_get_v2](/api-reference/collections/data-protection-configuration/#queries_sensitivity_label_get_v2): Get all sensitivity label IDs matching the query with filter.
  - [queries_local_application_group_get](/api-reference/collections/data-protection-configuration/#queries_local_application_group_get): Get all local application group IDs matching the query with filter.
  - [queries_local_application_get](/api-reference/collections/data-protection-configuration/#queries_local_application_get): Get all local-application IDs matching the query with filter.
  - [queries_policy_get_v2](/api-reference/collections/data-protection-configuration/#queries_policy_get_v2): Search for policies that match the provided criteria.
  - [queries_web_location_get_v2](/api-reference/collections/data-protection-configuration/#queries_web_location_get_v2): Get web-location IDs matching the query with filter.
- [Delivery Settings](/api-reference/collections/delivery-settings/): 2 operations
  - [GetDeliverySettings](/api-reference/collections/delivery-settings/#getdeliverysettings): Get Delivery Settings
  - [PostDeliverySettings](/api-reference/collections/delivery-settings/#postdeliverysettings): Create Delivery Settings
- [Deployments](/api-reference/collections/deployments/): 6 operations
  - [CombinedReleaseNotesV1](/api-reference/collections/deployments/#combinedreleasenotesv1): Queries for release-notes resources and returns details.
  - [CombinedReleasesV1Mixin0](/api-reference/collections/deployments/#combinedreleasesv1mixin0): Queries for releases resources and returns details.
  - [GetDeploymentsExternalV1](/api-reference/collections/deployments/#getdeploymentsexternalv1): Get deployment resources by IDs.
  - [GetEntityIDsByQueryPOST](/api-reference/collections/deployments/#getentityidsbyquerypost): Returns the release notes for the IDs in the request.
  - [GetEntityIDsByQueryPOSTV2](/api-reference/collections/deployments/#getentityidsbyquerypostv2): Return the release notes for the IDs in the request.
  - [QueryReleaseNotesV1](/api-reference/collections/deployments/#queryreleasenotesv1): Queries for release-notes resources and returns IDs.
- [Detects](/api-reference/collections/detects/): 4 operations
  - [GetAggregateDetects](/api-reference/collections/detects/#getaggregatedetects): Get detect aggregates as specified via json in request body.
  - [UpdateDetectsByIdsV2](/api-reference/collections/detects/#updatedetectsbyidsv2): Modify the state, assignee, and visibility of detections. You can update one or more attributes of one or more detections with a single request.
  - [GetDetectSummaries](/api-reference/collections/detects/#getdetectsummaries): View information about detections.
  - [QueryDetects](/api-reference/collections/detects/#querydetects): Search for detection IDs that match a given query.
- [Device Content](/api-reference/collections/device-content/): 2 operations
  - [entities_states_v1](/api-reference/collections/device-content/#entities_states_v1): Retrieve the host content state for a number of IDs between 1 and 100.
  - [queries_states_v1](/api-reference/collections/device-content/#queries_states_v1): Query for the content state of the host.
- [Device Control Policies](/api-reference/collections/device-control-policies/): 18 operations
  - [queryCombinedDeviceControlPolicyMembers](/api-reference/collections/device-control-policies/#querycombineddevicecontrolpolicymembers): Search for members of a Device Control Policy in your environment by providing a FQL filter and paging details. Returns a set of host details which match the filter criteria.
  - [queryCombinedDeviceControlPolicies](/api-reference/collections/device-control-policies/#querycombineddevicecontrolpolicies): Search for Device Control Policies in your environment by providing a FQL filter and paging details. Returns a set of Device Control Policies which match the filter criteria.
  - [getDefaultDeviceControlPolicies](/api-reference/collections/device-control-policies/#getdefaultdevicecontrolpolicies): Retrieve the configuration for the Default Device Control Policy.
  - [updateDefaultDeviceControlPolicies](/api-reference/collections/device-control-policies/#updatedefaultdevicecontrolpolicies): Retrieve the configuration for the Default Device Control Policy.
  - [performDeviceControlPoliciesAction](/api-reference/collections/device-control-policies/#performdevicecontrolpoliciesaction): Perform the specified action on the Device Control Policies specified in the request.
  - [getDefaultDeviceControlSettings](/api-reference/collections/device-control-policies/#getdefaultdevicecontrolsettings): Get default device control settings (USB and Bluetooth).
  - [updateDefaultDeviceControlSettings](/api-reference/collections/device-control-policies/#updatedefaultdevicecontrolsettings): Update the configuration for Default Device Control Settings.
  - [setDeviceControlPoliciesPrecedence](/api-reference/collections/device-control-policies/#setdevicecontrolpoliciesprecedence): Sets the precedence of Device Control Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence.
  - [getDeviceControlPolicies](/api-reference/collections/device-control-policies/#getdevicecontrolpolicies): Retrieve a set of Device Control Policies by specifying their IDs.
  - [getDeviceControlPoliciesV2](/api-reference/collections/device-control-policies/#getdevicecontrolpoliciesv2): Get device control policies for the given filter criteria. Supports USB and Bluetooth.
  - [createDeviceControlPolicies](/api-reference/collections/device-control-policies/#createdevicecontrolpolicies): Create Device Control Policies by specifying details about the policy to create.
  - [postDeviceControlPoliciesV2](/api-reference/collections/device-control-policies/#postdevicecontrolpoliciesv2): Create Device Control Policies by specifying details about the policy to create.
  - [deleteDeviceControlPolicies](/api-reference/collections/device-control-policies/#deletedevicecontrolpolicies): Delete a set of Device Control Policies by specifying their IDs.
  - [patchDeviceControlPoliciesClassesV1](/api-reference/collections/device-control-policies/#patchdevicecontrolpoliciesclassesv1): Update device control policy's classes (USB and Bluetooth).
  - [updateDeviceControlPolicies](/api-reference/collections/device-control-policies/#updatedevicecontrolpolicies): Update Device Control Policies by specifying the ID of the policy and details to update.
  - [patchDeviceControlPoliciesV2](/api-reference/collections/device-control-policies/#patchdevicecontrolpoliciesv2): Update Device Control Policies by specifying the ID of the policy and details to update.
  - [queryDeviceControlPolicyMembers](/api-reference/collections/device-control-policies/#querydevicecontrolpolicymembers): Search for members of a Device Control Policy in your environment by providing a FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria.
  - [queryDeviceControlPolicies](/api-reference/collections/device-control-policies/#querydevicecontrolpolicies): Search for Device Control Policies in your environment by providing a FQL filter and paging details. Returns a set of Device Control Policy IDs which match the filter criteria.
- [Discover](/api-reference/collections/discover/): 13 operations
  - [combined_applications](/api-reference/collections/discover/#combined_applications): Search for applications in your environment by providing a FQL (Falcon Query Language) filter and paging details. Returns details on applications which match the filter criteria.
  - [combined_hosts](/api-reference/collections/discover/#combined_hosts): Search for assets in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns details on assets which match the filter criteria.
  - [get_accounts](/api-reference/collections/discover/#get_accounts): Get details on assets by providing one or more IDs.
  - [get_applications](/api-reference/collections/discover/#get_applications): Get details on applications by providing one or more IDs.
  - [get_hosts](/api-reference/collections/discover/#get_hosts): Get details on assets by providing one or more IDs.
  - [get_iot_hosts](/api-reference/collections/discover/#get_iot_hosts): Get details on IoT assets by providing one or more IDs.
  - [get_logins](/api-reference/collections/discover/#get_logins): Get details on assets by providing one or more IDs.
  - [query_accounts](/api-reference/collections/discover/#query_accounts): Search for accounts in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.
  - [query_applications](/api-reference/collections/discover/#query_applications): Search for applications in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of application IDs which match the filter criteria.
  - [query_hosts](/api-reference/collections/discover/#query_hosts): Search for assets in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.
  - [query_iot_hosts](/api-reference/collections/discover/#query_iot_hosts): Search for IoT assets in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.
  - [query_logins](/api-reference/collections/discover/#query_logins): Search for accounts in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.
  - [query_iot_hostsV2](/api-reference/collections/discover/#query_iot_hostsv2): Search for IoT assets in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.
- [Downloads](/api-reference/collections/downloads/): 4 operations
  - [DownloadFile](/api-reference/collections/downloads/#downloadfile): Gets pre-signed URL for the file.
  - [EnumerateFile](/api-reference/collections/downloads/#enumeratefile): Enumerates a list of files available for CID.
  - [FetchFilesDownloadInfo](/api-reference/collections/downloads/#fetchfilesdownloadinfo): Get files info and pre-signed download URLs
  - [FetchFilesDownloadInfoV2](/api-reference/collections/downloads/#fetchfilesdownloadinfov2): Get cloud security tools info and pre-signed download URLs
- [Drift Indicators](/api-reference/collections/drift-indicators/): 5 operations
  - [GetDriftIndicatorsValuesByDate](/api-reference/collections/drift-indicators/#getdriftindicatorsvaluesbydate): Returns the count of Drift Indicators by the date. by default it's for 7 days.
  - [ReadDriftIndicatorsCount](/api-reference/collections/drift-indicators/#readdriftindicatorscount): Returns the total count of Drift indicators over a time period
  - [SearchAndReadDriftIndicatorEntities](/api-reference/collections/drift-indicators/#searchandreaddriftindicatorentities): Retrieve Drift Indicators by the provided search criteria
  - [ReadDriftIndicatorEntities](/api-reference/collections/drift-indicators/#readdriftindicatorentities): Retrieve Drift Indicator entities identified by the provided IDs
  - [SearchDriftIndicators](/api-reference/collections/drift-indicators/#searchdriftindicators): Retrieve all drift indicators that match the given query
- [Event Streams](/api-reference/collections/event-streams/): 2 operations
  - [refreshActiveStreamSession](/api-reference/collections/event-streams/#refreshactivestreamsession): Refresh an active event stream. Use the URL shown in a [listAvailableStreamsOAuth2](#listavailablestreamsoauth2) response.
  - [listAvailableStreamsOAuth2](/api-reference/collections/event-streams/#listavailablestreamsoauth2): Discover all event streams in your environment
- [Exposure Management](/api-reference/collections/exposure-management/): 12 operations
  - [aggregate_external_assets](/api-reference/collections/exposure-management/#aggregate_external_assets): Returns external assets aggregates.
  - [combined_ecosystem_subsidiaries](/api-reference/collections/exposure-management/#combined_ecosystem_subsidiaries): Retrieves a list of ecosystem subsidiaries with their detailed information.
  - [blob_download_external_assets](/api-reference/collections/exposure-management/#blob_download_external_assets): Download the entire contents of the blob. The relative link to this endpoint is returned in the `get_external_assets` request.
  - [blob_preview_external_assets](/api-reference/collections/exposure-management/#blob_preview_external_assets): Download a preview of the blob. The relative link to this endpoint is returned in the `get_external_assets` request.
  - [get_ecosystem_subsidiaries](/api-reference/collections/exposure-management/#get_ecosystem_subsidiaries): Retrieves detailed information about ecosystem subsidiaries by ID.
  - [post_external_assets_inventory_v1](/api-reference/collections/exposure-management/#post_external_assets_inventory_v1): Add external assets for external asset scanning.
  - [get_external_assets](/api-reference/collections/exposure-management/#get_external_assets): Get details on external assets by providing one or more IDs.
  - [delete_external_assets](/api-reference/collections/exposure-management/#delete_external_assets): Delete multiple external assets.
  - [patch_external_assets](/api-reference/collections/exposure-management/#patch_external_assets): Update the details of external assets.
  - [query_ecosystem_subsidiaries](/api-reference/collections/exposure-management/#query_ecosystem_subsidiaries): Retrieves a list of IDs for ecosystem subsidiaries.
  - [query_external_assets](/api-reference/collections/exposure-management/#query_external_assets): Get a list of external asset IDs that match the provided filter conditions. Use these IDs with the GET and PATCH endpoints.
  - [query_external_assets_v2](/api-reference/collections/exposure-management/#query_external_assets_v2): Get a list of external asset IDs that match the provided filter conditions.
- [FaaS Execution](/api-reference/collections/faas-execution/): 1 operations
  - [ReadRequestBody](/api-reference/collections/faas-execution/#readrequestbody): Retrieve a large request body, such as a file, that has spilled into object storage.
- [Falcon Complete Dashboard](/api-reference/collections/falcon-complete-dashboard/): 19 operations
  - [AggregateAlerts](/api-reference/collections/falcon-complete-dashboard/#aggregatealerts): Retrieve aggregate alerts values based on the matched filter
  - [AggregateAllowList](/api-reference/collections/falcon-complete-dashboard/#aggregateallowlist): Retrieve aggregate allowlist ticket values based on the matched filter
  - [AggregateBlockList](/api-reference/collections/falcon-complete-dashboard/#aggregateblocklist): Retrieve aggregate blocklist ticket values based on the matched filter
  - [AggregateDeviceCountCollection](/api-reference/collections/falcon-complete-dashboard/#aggregatedevicecountcollection): Retrieve aggregate host/devices count based on the matched filter
  - [AggregateEscalations](/api-reference/collections/falcon-complete-dashboard/#aggregateescalations): Retrieve aggregate escalation ticket values based on the matched filter
  - [AggregateFCIncidents](/api-reference/collections/falcon-complete-dashboard/#aggregatefcincidents): Retrieve aggregate incident values based on the matched filter
  - [AggregateRemediations](/api-reference/collections/falcon-complete-dashboard/#aggregateremediations): Retrieve aggregate remediation ticket values based on the matched filter
  - [AggregatePreventionPolicy](/api-reference/collections/falcon-complete-dashboard/#aggregatepreventionpolicy): Retrieve aggregate prevention policy values based on the matched filter
  - [AggregateSensorUpdatePolicy](/api-reference/collections/falcon-complete-dashboard/#aggregatesensorupdatepolicy): Retrieve aggregate sensor update policy values based on the matched filter
  - [AggregateSupportIssues](/api-reference/collections/falcon-complete-dashboard/#aggregatesupportissues): Retrieve aggregate support issue values based on the matched filter
  - [AggregateTotalDeviceCounts](/api-reference/collections/falcon-complete-dashboard/#aggregatetotaldevicecounts): Retrieve aggregate total host/devices based on the matched filter
  - [QueryAlertIdsByFilter](/api-reference/collections/falcon-complete-dashboard/#queryalertidsbyfilter): Retrieve Alert IDs that match the provided FQL filter criteria with scrolling enabled.
  - [QueryAlertIdsByFilterV2](/api-reference/collections/falcon-complete-dashboard/#queryalertidsbyfilterv2): Retrieve Alert IDs that match the provided FQL filter criteria with scrolling enabled.
  - [QueryAllowListFilter](/api-reference/collections/falcon-complete-dashboard/#queryallowlistfilter): Retrieve allowlist tickets that match the provided filter criteria with scrolling enabled
  - [QueryBlockListFilter](/api-reference/collections/falcon-complete-dashboard/#queryblocklistfilter): Retrieve block listtickets that match the provided filter criteria with scrolling enabled
  - [GetDeviceCountCollectionQueriesByFilter](/api-reference/collections/falcon-complete-dashboard/#getdevicecountcollectionqueriesbyfilter): Retrieve device count collection Ids that match the provided FQL filter, criteria with scrolling enabled
  - [QueryEscalationsFilter](/api-reference/collections/falcon-complete-dashboard/#queryescalationsfilter): Retrieve escalation tickets that match the provided filter criteria with scrolling enabled
  - [QueryIncidentIdsByFilter](/api-reference/collections/falcon-complete-dashboard/#queryincidentidsbyfilter): Retrieve incidents that match the provided filter criteria with scrolling enabled
  - [QueryRemediationsFilter](/api-reference/collections/falcon-complete-dashboard/#queryremediationsfilter): Retrieve remediation tickets that match the provided filter criteria with scrolling enabled
- [Falcon Container](/api-reference/collections/falcon-container/): 20 operations
  - [DownloadExportFile](/api-reference/collections/falcon-container/#downloadexportfile): Download an export file.
  - [ReadExportJobs](/api-reference/collections/falcon-container/#readexportjobs): Read export jobs entities.
  - [LaunchExportJob](/api-reference/collections/falcon-container/#launchexportjob): Launch an export job of a Container Security resource. Maximum of 1 job in progress per resource.
  - [QueryExportJobs](/api-reference/collections/falcon-container/#queryexportjobs): Query export jobs entities.
  - [GetCombinedImages](/api-reference/collections/falcon-container/#getcombinedimages): Get image assessment results by providing an FQL filter and paging details.
  - [GetCredentials](/api-reference/collections/falcon-container/#getcredentials): Gets the registry credentials.
  - [GetImageAssessmentReport](/api-reference/collections/falcon-container/#getimageassessmentreport): Retrieve an assessment report for an image by specifying image ID and digest or repository and tag.
  - [HeadImageScanInventory](/api-reference/collections/falcon-container/#headimagescaninventory): Get headers for POST request for image scan inventory.
  - [DeleteImageDetails](/api-reference/collections/falcon-container/#deleteimagedetails): Delete image details from the CrowdStrike registry.
  - [ImageMatchesPolicy](/api-reference/collections/falcon-container/#imagematchespolicy): Check if an image matches a policy by specifying repository and tag.
  - [PostImageScanInventory](/api-reference/collections/falcon-container/#postimagescaninventory): Post image scan inventory.
  - [ReadImageVulnerabilities](/api-reference/collections/falcon-container/#readimagevulnerabilities): Retrieve known vulnerabilities by specifying repository and tag.
  - [ReadRegistryEntities](/api-reference/collections/falcon-container/#readregistryentities): Retrieve registry entities associated with the client ID.
  - [ReadRegistryEntitiesByUUID](/api-reference/collections/falcon-container/#readregistryentitiesbyuuid): Retrieve registry entities associated with a specific UUID.
  - [DeleteRegistryEntities](/api-reference/collections/falcon-container/#deleteregistryentities): Delete registry entities by UUID.
  - [CreateRegistryEntities](/api-reference/collections/falcon-container/#createregistryentities): Create registry entities using the provided detail.
  - [UpdateRegistryEntities](/api-reference/collections/falcon-container/#updateregistryentities): Update the registry entity, as identified by the entity UUID, using the provided details.
  - [PolicyChecks](/api-reference/collections/falcon-container/#policychecks): Check image prevention policies
  - [GetReportByReference](/api-reference/collections/falcon-container/#getreportbyreference): Get image assessment scan report by image reference (v2)
  - [GetReportByScanID](/api-reference/collections/falcon-container/#getreportbyscanid): Get image assessment scan report by scan UUID (v2)
- [Falconx Sandbox](/api-reference/collections/falconx-sandbox/): 15 operations
  - [GetArtifacts](/api-reference/collections/falconx-sandbox/#getartifacts): Download IOC packs, PCAP files, and other analysis artifacts.
  - [GetMemoryDumpExtractedStrings](/api-reference/collections/falconx-sandbox/#getmemorydumpextractedstrings): Get extracted strings from a memory dump.
  - [GetMemoryDumpHexDump](/api-reference/collections/falconx-sandbox/#getmemorydumphexdump): Get the hex view of a memory dump.
  - [GetMemoryDump](/api-reference/collections/falconx-sandbox/#getmemorydump): Get memory dump content, as a binary.
  - [GetSummaryReports](/api-reference/collections/falconx-sandbox/#getsummaryreports): Get a short summary version of a sandbox report.
  - [GetReports](/api-reference/collections/falconx-sandbox/#getreports): Get a full sandbox report.
  - [DeleteReport](/api-reference/collections/falconx-sandbox/#deletereport): Delete report based on the report ID. Operation can be checked for success by polling for the report ID on the report-summaries endpoint.
  - [GetSubmissions](/api-reference/collections/falconx-sandbox/#getsubmissions): Check the status of a sandbox analysis. Time required for analysis varies but is usually less than 15 minutes.
  - [Submit](/api-reference/collections/falconx-sandbox/#submit): Submit an uploaded file or a URL for sandbox analysis. Time required for analysis varies but is usually less than 15 minutes.
  - [QueryReports](/api-reference/collections/falconx-sandbox/#queryreports): Find sandbox reports by providing a FQL filter and paging details. Returns a set of report IDs that match your criteria.
  - [QuerySubmissions](/api-reference/collections/falconx-sandbox/#querysubmissions): Find submission IDs for uploaded files by providing a FQL filter and paging details. Returns a set of submission IDs that match your criteria.
  - [GetSampleV2](/api-reference/collections/falconx-sandbox/#getsamplev2): Retrieves the file associated with the given ID (SHA256)
  - [UploadSampleV2](/api-reference/collections/falconx-sandbox/#uploadsamplev2): Upload a file for sandbox analysis. After uploading, use `/falconx/entities/submissions/v1` to start analyzing the file.
  - [DeleteSampleV2](/api-reference/collections/falconx-sandbox/#deletesamplev2): Removes a sample, including file, meta and submissions from the collection
  - [QuerySampleV1](/api-reference/collections/falconx-sandbox/#querysamplev1): Retrieves a list with sha256 of samples that exist and customer has rights to access them, maximum number of accepted items is 200
- [FDR](/api-reference/collections/fdr/): 5 operations
  - [fdrschema_combined_event_get](/api-reference/collections/fdr/#fdrschema_combined_event_get): Fetch the combined schema.
  - [fdrschema_entities_event_get](/api-reference/collections/fdr/#fdrschema_entities_event_get): Fetch event schema by ID.
  - [fdrschema_queries_event_get](/api-reference/collections/fdr/#fdrschema_queries_event_get): Get a list of event IDs given a particular query.
  - [fdrschema_entities_field_get](/api-reference/collections/fdr/#fdrschema_entities_field_get): Fetch field schema by ID.
  - [fdrschema_queries_field_get](/api-reference/collections/fdr/#fdrschema_queries_field_get): Get a list of field IDs given a particular query.
- [Federated Connections](/api-reference/collections/federated-connections/): 3 operations
  - [post_federated_connections_config](/api-reference/collections/federated-connections/#post_federated_connections_config): Create configuration for a federated connection
  - [delete_federated_connections_config](/api-reference/collections/federated-connections/#delete_federated_connections_config): Delete configuration for a federated connection
  - [patch_federated_connections_config](/api-reference/collections/federated-connections/#patch_federated_connections_config): Update configuration for a federated connection
- [FileVantage](/api-reference/collections/filevantage/): 31 operations
  - [getActionsMixin0](/api-reference/collections/filevantage/#getactionsmixin0): Retrieves the processing results for one or more actions.
  - [startActions](/api-reference/collections/filevantage/#startactions): Initiates the specified action on the provided change IDs.
  - [getContents](/api-reference/collections/filevantage/#getcontents): Retrieves the content captured for the provided change ID.
  - [getChanges](/api-reference/collections/filevantage/#getchanges): Retrieve information on changes.
  - [updatePolicyHostGroups](/api-reference/collections/filevantage/#updatepolicyhostgroups): Manage host groups assigned to a policy.
  - [updatePolicyPrecedence](/api-reference/collections/filevantage/#updatepolicyprecedence): Updates the policy precedence for all policies of a specific type.
  - [updatePolicyRuleGroups](/api-reference/collections/filevantage/#updatepolicyrulegroups): Manage the rule groups assigned to the policy or set the rule group precedence for all rule groups within the policy.
  - [getPolicies](/api-reference/collections/filevantage/#getpolicies): Retrieves the configuration for 1 or more policies.
  - [createPolicies](/api-reference/collections/filevantage/#createpolicies): Creates a new policy of the specified type. New policies are always added at the end of the precedence list for the provided policy type.
  - [deletePolicies](/api-reference/collections/filevantage/#deletepolicies): Deletes 1 or more policies.
  - [updatePolicies](/api-reference/collections/filevantage/#updatepolicies): Updates the general information of the provided policy.
  - [getScheduledExclusions](/api-reference/collections/filevantage/#getscheduledexclusions): Retrieves the configuration of 1 or more scheduled exclusions from the provided policy id.
  - [createScheduledExclusions](/api-reference/collections/filevantage/#createscheduledexclusions): Creates a new scheduled exclusion configuration for the provided policy id.
  - [deleteScheduledExclusions](/api-reference/collections/filevantage/#deletescheduledexclusions): Deletes 1 or more scheduled exclusions from the provided policy id.
  - [updateScheduledExclusions](/api-reference/collections/filevantage/#updatescheduledexclusions): Updates the provided scheduled exclusion configuration within the provided policy.
  - [updateRuleGroupPrecedence](/api-reference/collections/filevantage/#updaterulegroupprecedence): Updates the rule precedence for all rules in the identified rule group.
  - [getRules](/api-reference/collections/filevantage/#getrules): Retrieves the configuration for 1 or more rules.
  - [createRules](/api-reference/collections/filevantage/#createrules): Creates a new rule configuration within the specified rule group.
  - [deleteRules](/api-reference/collections/filevantage/#deleterules): Deletes 1 or more rules from the specified rule group.
  - [updateRules](/api-reference/collections/filevantage/#updaterules): Updates the provided rule configuration within the specified rule group.
  - [getRuleGroups](/api-reference/collections/filevantage/#getrulegroups): Retrieves the rule group details for 1 or more rule groups.
  - [createRuleGroups](/api-reference/collections/filevantage/#createrulegroups): Creates a new rule group of the specified type.
  - [deleteRuleGroups](/api-reference/collections/filevantage/#deleterulegroups): Deletes 1 or more rule groups.
  - [updateRuleGroups](/api-reference/collections/filevantage/#updaterulegroups): Updates the provided rule group.
  - [signalChangesExternal](/api-reference/collections/filevantage/#signalchangesexternal): Initiates workflows for the provided change IDs.
  - [queryActionsMixin0](/api-reference/collections/filevantage/#queryactionsmixin0): Returns one or more action IDs.
  - [queryChanges](/api-reference/collections/filevantage/#querychanges): Returns 1 or more change ids.
  - [highVolumeQueryChanges](/api-reference/collections/filevantage/#highvolumequerychanges): Returns 1 or more change ids.
  - [queryPolicies](/api-reference/collections/filevantage/#querypolicies): Retrieve the ids of all policies that are assigned the provided policy type.
  - [queryScheduledExclusions](/api-reference/collections/filevantage/#queryscheduledexclusions): Retrieve the ids of all scheduled exclusions contained within the provided policy id.
  - [queryRuleGroups](/api-reference/collections/filevantage/#queryrulegroups): Retrieve the ids of all rule groups that are of the provided rule group type.
- [Firewall Management](/api-reference/collections/firewall-management/): 33 operations
  - [aggregate_events](/api-reference/collections/firewall-management/#aggregate_events): Aggregate events for customer
  - [aggregate_policy_rules](/api-reference/collections/firewall-management/#aggregate_policy_rules): Aggregate rules within a policy for customer
  - [aggregate_rule_groups](/api-reference/collections/firewall-management/#aggregate_rule_groups): Aggregate rule groups for customer
  - [aggregate_rules](/api-reference/collections/firewall-management/#aggregate_rules): Aggregate rules for customer
  - [get_events](/api-reference/collections/firewall-management/#get_events): Get events entities by ID and optionally version
  - [get_firewall_fields](/api-reference/collections/firewall-management/#get_firewall_fields): Get the firewall field specifications by ID
  - [get_network_locations_details](/api-reference/collections/firewall-management/#get_network_locations_details): Get network locations entities by ID
  - [update_network_locations_metadata](/api-reference/collections/firewall-management/#update_network_locations_metadata): Updates the network locations metadata such as polling_intervals for the cid
  - [update_network_locations_precedence](/api-reference/collections/firewall-management/#update_network_locations_precedence): Updates the network locations precedence according to the list of ids provided.
  - [get_network_locations](/api-reference/collections/firewall-management/#get_network_locations): Get a summary of network locations entities by ID
  - [upsert_network_locations](/api-reference/collections/firewall-management/#upsert_network_locations): Updates the network locations provided, and return the ID.
  - [create_network_locations](/api-reference/collections/firewall-management/#create_network_locations): Create new network locations provided, and return the ID.
  - [delete_network_locations](/api-reference/collections/firewall-management/#delete_network_locations): Delete network location entities by ID.
  - [update_network_locations](/api-reference/collections/firewall-management/#update_network_locations): Updates the network locations provided, and return the ID.
  - [get_platforms](/api-reference/collections/firewall-management/#get_platforms): Get platforms by ID, e.g., windows or mac or droid
  - [get_policy_containers](/api-reference/collections/firewall-management/#get_policy_containers): Get policy container entities by policy ID
  - [update_policy_container_v1](/api-reference/collections/firewall-management/#update_policy_container_v1): Update an identified policy container.
  - [update_policy_container](/api-reference/collections/firewall-management/#update_policy_container): Update an identified policy container
  - [get_rule_groups](/api-reference/collections/firewall-management/#get_rule_groups): Get rule group entities by ID. These groups do not contain their rule entites, just the rule IDs in precedence order.
  - [create_rule_group](/api-reference/collections/firewall-management/#create_rule_group): Create new rule group on a platform for a customer with a name and description, and return the ID
  - [delete_rule_groups](/api-reference/collections/firewall-management/#delete_rule_groups): Delete rule group entities by ID
  - [update_rule_group](/api-reference/collections/firewall-management/#update_rule_group): Update name, description, or enabled status of a rule group, or create, edit, delete, or reorder rules
  - [create_rule_group_validation](/api-reference/collections/firewall-management/#create_rule_group_validation): Validates the request of creating a new rule group on a platform for a customer with a name and description
  - [update_rule_group_validation](/api-reference/collections/firewall-management/#update_rule_group_validation): Validates the request of updating name, description, or enabled status of a rule group, or create, edit, delete, or reorder rules
  - [get_rules](/api-reference/collections/firewall-management/#get_rules): Get rule entities by ID (64-bit unsigned int as decimal string) or Family ID (32-character hexadecimal string)
  - [validate_filepath_pattern](/api-reference/collections/firewall-management/#validate_filepath_pattern): Validates that the test pattern matches the executable filepath glob pattern.
  - [query_events](/api-reference/collections/firewall-management/#query_events): Find all event IDs matching the query with filter
  - [query_firewall_fields](/api-reference/collections/firewall-management/#query_firewall_fields): Get the firewall field specification IDs for the provided platform
  - [query_network_locations](/api-reference/collections/firewall-management/#query_network_locations): Get a list of network location IDs
  - [query_platforms](/api-reference/collections/firewall-management/#query_platforms): Get the list of platform names
  - [query_policy_rules](/api-reference/collections/firewall-management/#query_policy_rules): Find all firewall rule IDs matching the query with filter, and return them in precedence order
  - [query_rule_groups](/api-reference/collections/firewall-management/#query_rule_groups): Find all rule group IDs matching the query with filter
  - [query_rules](/api-reference/collections/firewall-management/#query_rules): Find all rule IDs matching the query with filter
- [Firewall Policies](/api-reference/collections/firewall-policies/): 10 operations
  - [queryCombinedFirewallPolicyMembers](/api-reference/collections/firewall-policies/#querycombinedfirewallpolicymembers): Search for members of a Firewall Policy in your environment by providing a FQL filter and paging details. Returns a set of host details which match the filter criteria
  - [queryCombinedFirewallPolicies](/api-reference/collections/firewall-policies/#querycombinedfirewallpolicies): Search for Firewall Policies in your environment by providing a FQL filter and paging details. Returns a set of Firewall Policies which match the filter criteria
  - [performFirewallPoliciesAction](/api-reference/collections/firewall-policies/#performfirewallpoliciesaction): Perform the specified action on the Firewall Policies specified in the request
  - [setFirewallPoliciesPrecedence](/api-reference/collections/firewall-policies/#setfirewallpoliciesprecedence): Sets the precedence of Firewall Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence
  - [getFirewallPolicies](/api-reference/collections/firewall-policies/#getfirewallpolicies): Retrieve a set of Firewall Policies by specifying their IDs
  - [createFirewallPolicies](/api-reference/collections/firewall-policies/#createfirewallpolicies): Create Firewall Policies by specifying details about the policy to create
  - [deleteFirewallPolicies](/api-reference/collections/firewall-policies/#deletefirewallpolicies): Delete a set of Firewall Policies by specifying their IDs
  - [updateFirewallPolicies](/api-reference/collections/firewall-policies/#updatefirewallpolicies): Update Firewall Policies by specifying the ID of the policy and details to update
  - [queryFirewallPolicyMembers](/api-reference/collections/firewall-policies/#queryfirewallpolicymembers): Search for members of a Firewall Policy in your environment by providing a FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria
  - [queryFirewallPolicies](/api-reference/collections/firewall-policies/#queryfirewallpolicies): Search for Firewall Policies in your environment by providing a FQL filter and paging details. Returns a set of Firewall Policy IDs which match the filter criteria
- [Foundry LogScale](/api-reference/collections/foundry-logscale/): 11 operations
  - [ListReposV1](/api-reference/collections/foundry-logscale/#listreposv1): Lists available repositories and views
  - [IngestDataAsyncV1](/api-reference/collections/foundry-logscale/#ingestdataasyncv1): Ingest data into the application repository asynchronously
  - [IngestDataV1](/api-reference/collections/foundry-logscale/#ingestdatav1): Ingest data into the application repository
  - [CreateFileV1](/api-reference/collections/foundry-logscale/#createfilev1): Creates a lookup file.
  - [UpdateFileV1](/api-reference/collections/foundry-logscale/#updatefilev1): Updates a lookup file.
  - [CreateSavedSearchesDynamicExecuteV1](/api-reference/collections/foundry-logscale/#createsavedsearchesdynamicexecutev1): Execute a dynamic saved search
  - [GetSavedSearchesExecuteV1](/api-reference/collections/foundry-logscale/#getsavedsearchesexecutev1): Get the results of a saved search
  - [CreateSavedSearchesExecuteV1](/api-reference/collections/foundry-logscale/#createsavedsearchesexecutev1): Execute a saved search
  - [CreateSavedSearchesIngestV1](/api-reference/collections/foundry-logscale/#createsavedsearchesingestv1): Populate a saved search
  - [GetSavedSearchesJobResultsDownloadV1](/api-reference/collections/foundry-logscale/#getsavedsearchesjobresultsdownloadv1): Get the results of a saved search as a file
  - [ListViewV1](/api-reference/collections/foundry-logscale/#listviewv1): List views
- [Host Group](/api-reference/collections/host-group/): 9 operations
  - [queryCombinedGroupMembers](/api-reference/collections/host-group/#querycombinedgroupmembers): Search for members of a Host Group in your environment by providing a FQL filter and paging details. Returns a set of host details which match the filter criteria
  - [queryCombinedHostGroups](/api-reference/collections/host-group/#querycombinedhostgroups): Search for Host Groups in your environment by providing a FQL filter and paging details. Returns a set of Host Groups which match the filter criteria
  - [performGroupAction](/api-reference/collections/host-group/#performgroupaction): Perform the specified action on the Host Groups specified in the request
  - [getHostGroups](/api-reference/collections/host-group/#gethostgroups): Retrieve a set of Host Groups by specifying their IDs
  - [createHostGroups](/api-reference/collections/host-group/#createhostgroups): Create Host Groups by specifying details about the group to create
  - [deleteHostGroups](/api-reference/collections/host-group/#deletehostgroups): Delete a set of Host Groups by specifying their IDs
  - [updateHostGroups](/api-reference/collections/host-group/#updatehostgroups): Update Host Groups by specifying the ID of the group and details to update
  - [queryGroupMembers](/api-reference/collections/host-group/#querygroupmembers): Search for members of a Host Group in your environment by providing a FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria
  - [queryHostGroups](/api-reference/collections/host-group/#queryhostgroups): Search for Host Groups in your environment by providing a FQL filter and paging details. Returns a set of Host Group IDs which match the filter criteria
- [Host Migration](/api-reference/collections/host-migration/): 10 operations
  - [HostMigrationAggregatesV1](/api-reference/collections/host-migration/#hostmigrationaggregatesv1): Get host migration aggregates as specified via json in request body.
  - [MigrationAggregatesV1](/api-reference/collections/host-migration/#migrationaggregatesv1): Get migration aggregates as specified via json in request body.
  - [HostMigrationsActionsV1](/api-reference/collections/host-migration/#hostmigrationsactionsv1): Perform an action on host migrations.
  - [GetHostMigrationsV1](/api-reference/collections/host-migration/#gethostmigrationsv1): Get host migration details.
  - [GetMigrationDestinationsV1](/api-reference/collections/host-migration/#getmigrationdestinationsv1): Get destinations for a migration.
  - [MigrationsActionsV1](/api-reference/collections/host-migration/#migrationsactionsv1): Perform an action on a migration job.
  - [GetMigrationsV1](/api-reference/collections/host-migration/#getmigrationsv1): Get migration job details.
  - [CreateMigrationV1](/api-reference/collections/host-migration/#createmigrationv1): Create a device migration job.
  - [GetHostMigrationIDsV1](/api-reference/collections/host-migration/#gethostmigrationidsv1): Query host migration IDs.
  - [GetMigrationIDsV1](/api-reference/collections/host-migration/#getmigrationidsv1): Query migration jobs.
- [Hosts](/api-reference/collections/hosts/): 16 operations
  - [CombinedDevicesByFilter](/api-reference/collections/hosts/#combineddevicesbyfilter): Search for hosts in your environment by platform, hostname, IP, and other criteria. Returns full device records.
  - [CombinedHiddenDevicesByFilter](/api-reference/collections/hosts/#combinedhiddendevicesbyfilter): Search for hidden hosts in your environment by platform, hostname, IP, and other criteria. Returns full device records.
  - [entities_perform_action](/api-reference/collections/hosts/#entities_perform_action): Performs the specified action on the provided prevention policy IDs.
  - [GetDeviceDetails](/api-reference/collections/hosts/#getdevicedetails): Get details on one or more hosts by providing agent IDs (AID). redirect recommended
  - [GetDeviceDetailsV1](/api-reference/collections/hosts/#getdevicedetailsv1): Get details on one or more hosts by providing agent IDs (AID). deprecated
  - [GetDeviceDetailsV2](/api-reference/collections/hosts/#getdevicedetailsv2): Get details on one or more hosts by providing agent IDs (AID).
  - [GetOnlineState_V1](/api-reference/collections/hosts/#getonlinestate_v1): Get the online status for one or more hosts by specifying each host's unique ID.
  - [PerformActionV2](/api-reference/collections/hosts/#performactionv2): Take various actions on the hosts in your environment. Contain or lift containment on a host. Delete or restore a host.
  - [PostDeviceDetailsV2](/api-reference/collections/hosts/#postdevicedetailsv2): Get details on one or more hosts by providing agent IDs (AID).
  - [QueryDeviceLoginHistory](/api-reference/collections/hosts/#querydeviceloginhistory): Retrieve details about recent login sessions for a set of devices (v1).
  - [QueryDeviceLoginHistoryV2](/api-reference/collections/hosts/#querydeviceloginhistoryv2): Retrieve details about recent login sessions for a set of devices.
  - [QueryDevicesByFilter](/api-reference/collections/hosts/#querydevicesbyfilter): Search for hosts in your environment by platform, hostname, IP, and other criteria.
  - [QueryDevicesByFilterScroll](/api-reference/collections/hosts/#querydevicesbyfilterscroll): Search for hosts in your environment by platform, hostname, IP, and other criteria with continuous pagination capability (based on offset pointer which expires after 2 minutes with no maximum limit).
  - [QueryGetNetworkAddressHistoryV1](/api-reference/collections/hosts/#querygetnetworkaddresshistoryv1): Retrieve history of IP and MAC addresses of devices.
  - [QueryHiddenDevices](/api-reference/collections/hosts/#queryhiddendevices): Retrieve hidden hosts that match the provided filter criteria.
  - [UpdateDeviceTags](/api-reference/collections/hosts/#updatedevicetags): Append or remove one or more Falcon Grouping Tags on one or more hosts.
- [Identity Protection](/api-reference/collections/identity-protection/): 8 operations
  - [GetSensorAggregates](/api-reference/collections/identity-protection/#getsensoraggregates): Get sensor aggregates as specified via json in request body.
  - [GetSensorDetails](/api-reference/collections/identity-protection/#getsensordetails): Get details on one or more sensors by providing device IDs in a POST body. Supports up to a maximum of 5000 IDs.
  - [QuerySensorsByFilter](/api-reference/collections/identity-protection/#querysensorsbyfilter): Search for sensors in your environment by hostname, IP, and other criteria.
  - [api_preempt_proxy_post_graphql](/api-reference/collections/identity-protection/#api_preempt_proxy_post_graphql): Identity Protection GraphQL API. Allows to retrieve entities, timeline activities, identity-based incidents and security assessment. Allows to perform actions on entities and identity-based incidents.
  - [get_policy_rules](/api-reference/collections/identity-protection/#get_policy_rules): Get policy rules.
  - [post_policy_rules](/api-reference/collections/identity-protection/#post_policy_rules): Create policy rules.
  - [delete_policy_rules](/api-reference/collections/identity-protection/#delete_policy_rules): Delete policy rules.
  - [get_policy_rules_query](/api-reference/collections/identity-protection/#get_policy_rules_query): Query policy rule IDs.
- [Image Assessment Policies](/api-reference/collections/image-assessment-policies/): 11 operations
  - [ReadPolicies](/api-reference/collections/image-assessment-policies/#readpolicies): Get all Image Assessment policies.
  - [CreatePolicies](/api-reference/collections/image-assessment-policies/#createpolicies): Create Image Assessment policies.
  - [DeletePolicy](/api-reference/collections/image-assessment-policies/#deletepolicy): Delete Image Assessment Policy by policy UUID.
  - [UpdatePolicies](/api-reference/collections/image-assessment-policies/#updatepolicies): Update Image Assessment Policy entities.
  - [ReadPolicyExclusions](/api-reference/collections/image-assessment-policies/#readpolicyexclusions): Retrieve Image Assessment Policy Exclusion entities.
  - [UpdatePolicyExclusions](/api-reference/collections/image-assessment-policies/#updatepolicyexclusions): Update Image Assessment Policy Exclusion entities.
  - [ReadPolicyGroups](/api-reference/collections/image-assessment-policies/#readpolicygroups): Retrieve Image Assessment Policy Group entities.
  - [CreatePolicyGroups](/api-reference/collections/image-assessment-policies/#createpolicygroups): Create Image Assessment Policy Group entities.
  - [DeletePolicyGroup](/api-reference/collections/image-assessment-policies/#deletepolicygroup): Delete Image Assessment Policy Group entities
  - [UpdatePolicyGroups](/api-reference/collections/image-assessment-policies/#updatepolicygroups): Update Image Assessment Policy Group entities
  - [UpdatePolicyPrecedence](/api-reference/collections/image-assessment-policies/#updatepolicyprecedence): Update Image Assessment Policy precedence
- [Installation Tokens](/api-reference/collections/installation-tokens/): 9 operations
  - [audit_events_read](/api-reference/collections/installation-tokens/#audit_events_read): Gets the details of one or more audit events by id.
  - [customer_settings_read](/api-reference/collections/installation-tokens/#customer_settings_read): Check current installation token settings.
  - [customer_settings_update](/api-reference/collections/installation-tokens/#customer_settings_update): Update installation token settings.
  - [tokens_read](/api-reference/collections/installation-tokens/#tokens_read): Gets the details of one or more tokens by id.
  - [tokens_create](/api-reference/collections/installation-tokens/#tokens_create): Creates a token.
  - [tokens_delete](/api-reference/collections/installation-tokens/#tokens_delete): Deletes a token immediately. To revoke a token, use [tokens_update](#tokens_update) instead.
  - [tokens_update](/api-reference/collections/installation-tokens/#tokens_update): Updates one or more tokens. Use this endpoint to edit labels, change expiration, revoke, or restore.
  - [audit_events_query](/api-reference/collections/installation-tokens/#audit_events_query): Search for audit events by providing a FQL filter and paging details.
  - [tokens_query](/api-reference/collections/installation-tokens/#tokens_query): Search for tokens by providing a FQL filter and paging details.
- [Intel](/api-reference/collections/intel/): 24 operations
  - [QueryIntelActorEntities](/api-reference/collections/intel/#queryintelactorentities): Get info about actors that match provided FQL filters.
  - [QueryMalwareEntities](/api-reference/collections/intel/#querymalwareentities): Get malware entities that match provided FQL filters.
  - [QueryIntelIndicatorEntities](/api-reference/collections/intel/#queryintelindicatorentities): Get info about indicators that match provided FQL filters.
  - [QueryIntelReportEntities](/api-reference/collections/intel/#queryintelreportentities): Get info about reports that match provided FQL filters.
  - [GetMalwareMitreReport](/api-reference/collections/intel/#getmalwaremitrereport): Export Mitre ATT&CK information for a given malware family.
  - [GetIntelActorEntities](/api-reference/collections/intel/#getintelactorentities): Retrieve specific actors using their actor IDs.
  - [GetIntelIndicatorEntities](/api-reference/collections/intel/#getintelindicatorentities): Retrieve specific indicators using their indicator IDs.
  - [GetMalwareEntities](/api-reference/collections/intel/#getmalwareentities): Get malware entities for specified IDs.
  - [GetMitreReport](/api-reference/collections/intel/#getmitrereport): Export Mitre ATT&CK information for a given actor.
  - [PostMitreAttacks](/api-reference/collections/intel/#postmitreattacks): Retrieves report and observable IDs associated with the given actor and attacks.
  - [GetIntelReportPDF](/api-reference/collections/intel/#getintelreportpdf): Return a Report PDF attachment
  - [GetIntelReportEntities](/api-reference/collections/intel/#getintelreportentities): Retrieve specific reports using their report IDs.
  - [GetIntelRuleFile](/api-reference/collections/intel/#getintelrulefile): Download earlier rule sets.
  - [GetLatestIntelRuleFile](/api-reference/collections/intel/#getlatestintelrulefile): Download the latest rule set.
  - [GetIntelRuleEntities](/api-reference/collections/intel/#getintelruleentities): Retrieve details for rule sets for the specified ids.
  - [GetVulnerabilities](/api-reference/collections/intel/#getvulnerabilities): Get vulnerabilities by ID(s).
  - [QueryIntelActorIds](/api-reference/collections/intel/#queryintelactorids): Get actor IDs that match provided FQL filters.
  - [QueryIntelIndicatorIds](/api-reference/collections/intel/#queryintelindicatorids): Get indicators IDs that match provided FQL filters.
  - [QueryMalware](/api-reference/collections/intel/#querymalware): Get malware family names that match provided FQL filters.
  - [QueryMitreAttacksForMalware](/api-reference/collections/intel/#querymitreattacksformalware): Gets MITRE tactics and techniques for the given malware.
  - [QueryMitreAttacks](/api-reference/collections/intel/#querymitreattacks): Gets MITRE tactics and techniques for the given actor.
  - [QueryIntelReportIds](/api-reference/collections/intel/#queryintelreportids): Get report IDs that match provided FQL filters.
  - [QueryIntelRuleIds](/api-reference/collections/intel/#queryintelruleids): Search for rule IDs that match provided filter criteria.
  - [QueryVulnerabilities](/api-reference/collections/intel/#queryvulnerabilities): Query for vulnerabilities IDs.
- [Intelligence Feeds](/api-reference/collections/intelligence-feeds/): 3 operations
  - [DownloadFeedArchive](/api-reference/collections/intelligence-feeds/#downloadfeedarchive): Download feed file contents as a zip archive.
  - [ListFeedTypes](/api-reference/collections/intelligence-feeds/#listfeedtypes): List the accessible feeds for a given customer.
  - [QueryFeedArchives](/api-reference/collections/intelligence-feeds/#queryfeedarchives): Query the accessible feeds for a customer.
- [Intelligence Indicator Graph](/api-reference/collections/intelligence-indicator-graph/): 2 operations
  - [LookupIndicators](/api-reference/collections/intelligence-indicator-graph/#lookupindicators): Get indicators based on their value.
  - [SearchIndicators](/api-reference/collections/intelligence-indicator-graph/#searchindicators): Search indicators based on FQL filter.
- [IOA Exclusions](/api-reference/collections/ioa-exclusions/): 14 operations
  - [getIOAExclusionsV1](/api-reference/collections/ioa-exclusions/#getioaexclusionsv1): Get a set of IOA Exclusions by specifying their IDs
  - [createIOAExclusionsV1](/api-reference/collections/ioa-exclusions/#createioaexclusionsv1): Create the IOA exclusions
  - [deleteIOAExclusionsV1](/api-reference/collections/ioa-exclusions/#deleteioaexclusionsv1): Delete the IOA exclusions by id
  - [updateIOAExclusionsV1](/api-reference/collections/ioa-exclusions/#updateioaexclusionsv1): Update the IOA exclusions
  - [queryIOAExclusionsV1](/api-reference/collections/ioa-exclusions/#queryioaexclusionsv1): Search for IOA exclusions.
  - [ss_ioa_exclusions_aggregates_v2](/api-reference/collections/ioa-exclusions/#ss_ioa_exclusions_aggregates_v2): Get Self Service IOA Exclusion aggregates as specified via json in the request body.
  - [ss_ioa_exclusions_get_reports_v2](/api-reference/collections/ioa-exclusions/#ss_ioa_exclusions_get_reports_v2): Create a report of Self Service IOA Exclusions scoped by the given filters.
  - [ss_ioa_exclusions_get_v2](/api-reference/collections/ioa-exclusions/#ss_ioa_exclusions_get_v2): Get the Self Service IOA Exclusions rules by id.
  - [ss_ioa_exclusions_create_v2](/api-reference/collections/ioa-exclusions/#ss_ioa_exclusions_create_v2): Create new Self Service IOA Exclusions.
  - [ss_ioa_exclusions_update_v2](/api-reference/collections/ioa-exclusions/#ss_ioa_exclusions_update_v2): Update the Self Service IOA Exclusions rule by id.
  - [ss_ioa_exclusions_delete_v2](/api-reference/collections/ioa-exclusions/#ss_ioa_exclusions_delete_v2): Delete the Self Service IOA Exclusions rule by id.
  - [ss_ioa_exclusions_matched_rule_v2](/api-reference/collections/ioa-exclusions/#ss_ioa_exclusions_matched_rule_v2): Get Self Service IOA Exclusions rules for matched IFN/CLI for child, parent and grandparent.
  - [ss_ioa_exclusions_new_rules_v2](/api-reference/collections/ioa-exclusions/#ss_ioa_exclusions_new_rules_v2): Get defaults for Self Service IOA Exclusions based on provided IFN/CLI for child, parent and grandparent.
  - [ss_ioa_exclusions_search_v2](/api-reference/collections/ioa-exclusions/#ss_ioa_exclusions_search_v2): Search for Self Service IOA Exclusions.
- [IOC](/api-reference/collections/ioc/): 17 operations
  - [indicator_aggregate_v1](/api-reference/collections/ioc/#indicator_aggregate_v1): Get Indicators aggregates as specified via json in the request body.
  - [indicator_combined_v1](/api-reference/collections/ioc/#indicator_combined_v1): Get Combined for Indicators.
  - [action_get_v1](/api-reference/collections/ioc/#action_get_v1): Get Actions by ids.
  - [GetIndicatorsReport](/api-reference/collections/ioc/#getindicatorsreport): Launch an indicators report creation job
  - [indicator_get_v1](/api-reference/collections/ioc/#indicator_get_v1): Get Indicators by ids.
  - [indicator_create_v1](/api-reference/collections/ioc/#indicator_create_v1): Create Indicators.
  - [indicator_delete_v1](/api-reference/collections/ioc/#indicator_delete_v1): Delete Indicators by ids or a filter.
  - [indicator_update_v1](/api-reference/collections/ioc/#indicator_update_v1): Update Indicators.
  - [action_query_v1](/api-reference/collections/ioc/#action_query_v1): Query Actions.
  - [indicator_search_v1](/api-reference/collections/ioc/#indicator_search_v1): Search for Indicators.
  - [ioc_type_query_v1](/api-reference/collections/ioc/#ioc_type_query_v1): Query IOC Types.
  - [platform_query_v1](/api-reference/collections/ioc/#platform_query_v1): Query Platforms.
  - [severity_query_v1](/api-reference/collections/ioc/#severity_query_v1): Query Severities.
  - [indicator_get_device_count_v1](/api-reference/collections/ioc/#indicator_get_device_count_v1): Number of hosts in your customer account that have observed a given custom IOC
  - [indicator_get_devices_ran_on_v1](/api-reference/collections/ioc/#indicator_get_devices_ran_on_v1): Find hosts that have observed a given custom IOC.
  - [indicator_get_processes_ran_on_v1](/api-reference/collections/ioc/#indicator_get_processes_ran_on_v1): Search for processes associated with a custom IOC
  - [entities_processes](/api-reference/collections/ioc/#entities_processes): For the provided ProcessID retrieve the process details
- [IOCs](/api-reference/collections/iocs/): 9 operations
  - [DevicesCount](/api-reference/collections/iocs/#devicescount): Number of hosts in your customer account that have observed a given custom IOC.
  - [GetIOC](/api-reference/collections/iocs/#getioc): This operation has been superseded by the IOC.indicator_get_v1 operation and is no longer used.
  - [CreateIOC](/api-reference/collections/iocs/#createioc): This operation has been superseded by the IOC.indicator_create_v1 operation and is no longer used.
  - [DeleteIOC](/api-reference/collections/iocs/#deleteioc): This operation has been superseded by the IOC.indicator_delete_v1 operation and is no longer used.
  - [UpdateIOC](/api-reference/collections/iocs/#updateioc): This operation has been superseded by the IOC.indicator_update_v1 operation and is no longer used.
  - [DevicesRanOn](/api-reference/collections/iocs/#devicesranon): Find hosts that have observed a given custom IOC. For details about those hosts, use GET /devices/entities/devices/v1.
  - [QueryIOCs](/api-reference/collections/iocs/#queryiocs): This operation has been superseded by the IOC.indicator_search_v1 operation and is no longer used.
  - [ProcessesRanOn](/api-reference/collections/iocs/#processesranon): Search for processes associated with a custom IOC.
  - [entities_processes](/api-reference/collections/iocs/#entities_processes): For the provided ProcessID retrieve the process details.
- [IT Automation](/api-reference/collections/it-automation/): 42 operations
  - [ITAutomationGetAssociatedTasks](/api-reference/collections/it-automation/#itautomationgetassociatedtasks): Retrieve tasks associated with the provided file ID
  - [ITAutomationCombinedScheduledTasks](/api-reference/collections/it-automation/#itautomationcombinedscheduledtasks): Returns full details of scheduled tasks matching the filter query parameter
  - [ITAutomationRunLiveQuery](/api-reference/collections/it-automation/#itautomationrunlivequery): Start a new task execution from the provided query data in the request and return the initiated task executions
  - [ITAutomationGetTaskExecutionsByQuery](/api-reference/collections/it-automation/#itautomationgettaskexecutionsbyquery): Retrieve task executions by query
  - [ITAutomationGetTaskGroupsByQuery](/api-reference/collections/it-automation/#itautomationgettaskgroupsbyquery): Retrieve task groups by query
  - [ITAutomationGetTasksByQuery](/api-reference/collections/it-automation/#itautomationgettasksbyquery): Retrieve tasks by query
  - [ITAutomationGetPolicies](/api-reference/collections/it-automation/#itautomationgetpolicies): Retrieve policies
  - [ITAutomationCreatePolicy](/api-reference/collections/it-automation/#itautomationcreatepolicy): Create a new policy of the specified type
  - [ITAutomationUpdatePolicies](/api-reference/collections/it-automation/#itautomationupdatepolicies): Update a new policy of the specified type
  - [ITAutomationDeletePolicy](/api-reference/collections/it-automation/#itautomationdeletepolicy): Delete a policy
  - [ITAutomationUpdatePolicyHostGroups](/api-reference/collections/it-automation/#itautomationupdatepolicyhostgroups): Update policy host groups
  - [ITAutomationUpdatePoliciesPrecedence](/api-reference/collections/it-automation/#itautomationupdatepoliciesprecedence): Update policies precedence
  - [ITAutomationGetScheduledTasks](/api-reference/collections/it-automation/#itautomationgetscheduledtasks): Retrieve scheduled tasks
  - [ITAutomationCreateScheduledTask](/api-reference/collections/it-automation/#itautomationcreatescheduledtask): Create a scheduled task from the given request
  - [ITAutomationUpdateScheduledTask](/api-reference/collections/it-automation/#itautomationupdatescheduledtask): Update an existing scheduled task with the supplied info
  - [ITAutomationDeleteScheduledTasks](/api-reference/collections/it-automation/#itautomationdeletescheduledtasks): Delete scheduled tasks
  - [ITAutomationCancelTaskExecution](/api-reference/collections/it-automation/#itautomationcanceltaskexecution): Cancel a task execution
  - [ITAutomationGetTaskExecutionHostStatus](/api-reference/collections/it-automation/#itautomationgettaskexecutionhoststatus): Retrieve task execution host status
  - [ITAutomationRerunTaskExecution](/api-reference/collections/it-automation/#itautomationreruntaskexecution): Rerun the task execution specified in the request
  - [ITAutomationGetExecutionResultsSearchStatus](/api-reference/collections/it-automation/#itautomationgetexecutionresultssearchstatus): Retrieve execution results search status
  - [ITAutomationStartExecutionResultsSearch](/api-reference/collections/it-automation/#itautomationstartexecutionresultssearch): Start an asynchronous task execution results search
  - [ITAutomationGetExecutionResults](/api-reference/collections/it-automation/#itautomationgetexecutionresults): Retrieve execution results
  - [ITAutomationGetTaskExecution](/api-reference/collections/it-automation/#itautomationgettaskexecution): Retrieve a task execution
  - [ITAutomationStartTaskExecution](/api-reference/collections/it-automation/#itautomationstarttaskexecution): Start a new task execution from an existing task provided in the request and returns the initiated task executions
  - [ITAutomationGetTaskGroups](/api-reference/collections/it-automation/#itautomationgettaskgroups): Retrieve task groups
  - [ITAutomationCreateTaskGroup](/api-reference/collections/it-automation/#itautomationcreatetaskgroup): Create a task group
  - [ITAutomationUpdateTaskGroup](/api-reference/collections/it-automation/#itautomationupdatetaskgroup): Update a task group for a given ID
  - [ITAutomationDeleteTaskGroups](/api-reference/collections/it-automation/#itautomationdeletetaskgroups): Delete task groups
  - [ITAutomationGetTasks](/api-reference/collections/it-automation/#itautomationgettasks): Retrieve tasks
  - [ITAutomationCreateTask](/api-reference/collections/it-automation/#itautomationcreatetask): Create a task with details from the given request
  - [ITAutomationUpdateTask](/api-reference/collections/it-automation/#itautomationupdatetask): Update a task with details from the given request
  - [ITAutomationDeleteTask](/api-reference/collections/it-automation/#itautomationdeletetask): Delete a task
  - [ITAutomationQueryPolicies](/api-reference/collections/it-automation/#itautomationquerypolicies): Query policies
  - [ITAutomationSearchScheduledTasks](/api-reference/collections/it-automation/#itautomationsearchscheduledtasks): Search scheduled tasks
  - [ITAutomationSearchTaskExecutions](/api-reference/collections/it-automation/#itautomationsearchtaskexecutions): Search task executions
  - [ITAutomationSearchTaskGroups](/api-reference/collections/it-automation/#itautomationsearchtaskgroups): Search task groups
  - [ITAutomationSearchTasks](/api-reference/collections/it-automation/#itautomationsearchtasks): Search tasks
  - [ITAutomationGetUserGroup](/api-reference/collections/it-automation/#itautomationgetusergroup): Returns user groups for each provided id
  - [ITAutomationCreateUserGroup](/api-reference/collections/it-automation/#itautomationcreateusergroup): Creates a user group from the given request
  - [ITAutomationUpdateUserGroup](/api-reference/collections/it-automation/#itautomationupdateusergroup): Update a user group for a given id
  - [ITAutomationDeleteUserGroup](/api-reference/collections/it-automation/#itautomationdeleteusergroup): Deletes user groups for each provided ids
  - [ITAutomationSearchUserGroup](/api-reference/collections/it-automation/#itautomationsearchusergroup): Returns the list of user group ids matching the filter query parameter. It can be used together with the entities endpoint to retrieve full information on user groups
- [Knowledge Base Audit Events](/api-reference/collections/knowledge-base-audit-events/): 4 operations
  - [aggregates_knowledge_base_audit_events_v1](/api-reference/collections/knowledge-base-audit-events/#aggregates_knowledge_base_audit_events_v1): Aggregate knowledge base audit events based on the provided msa criteria.
  - [combined_knowledge_base_audit_events_v1](/api-reference/collections/knowledge-base-audit-events/#combined_knowledge_base_audit_events_v1): Get knowledge base audit events with full event details and pagination.
  - [entities_knowledge_base_audit_events_v1](/api-reference/collections/knowledge-base-audit-events/#entities_knowledge_base_audit_events_v1): Retrieve knowledge base audit event entities by their IDs.
  - [queries_knowledge_base_audit_events_v1](/api-reference/collections/knowledge-base-audit-events/#queries_knowledge_base_audit_events_v1): Query knowledge base audit event IDs with pagination and filtering.
- [Knowledge Base Files](/api-reference/collections/knowledge-base-files/): 6 operations
  - [entities_knowledge_base_files_download_v1](/api-reference/collections/knowledge-base-files/#entities_knowledge_base_files_download_v1): Download knowledge base file entities for the provided id.
  - [entities_knowledge_base_files_v1](/api-reference/collections/knowledge-base-files/#entities_knowledge_base_files_v1): Retrieve knowledge base file entities for the provided id.
  - [entities_knowledge_base_files_update_v1](/api-reference/collections/knowledge-base-files/#entities_knowledge_base_files_update_v1): Update an existing file in a knowledge base. Supports updating file content and optionally its description.
  - [entities_knowledge_base_files_create_v1](/api-reference/collections/knowledge-base-files/#entities_knowledge_base_files_create_v1): Upload a file to a knowledge base.
  - [entities_knowledge_base_files_delete_v1](/api-reference/collections/knowledge-base-files/#entities_knowledge_base_files_delete_v1): Delete document from knowledge base.
  - [queries_knowledge_base_files_v1](/api-reference/collections/knowledge-base-files/#queries_knowledge_base_files_v1): Query knowledge base files based on the provided filters.
- [Knowledge Bases](/api-reference/collections/knowledge-bases/): 5 operations
  - [aggregates_knowledge_bases_v1](/api-reference/collections/knowledge-bases/#aggregates_knowledge_bases_v1): Aggregate knowledge bases based on the provided msa criteria.
  - [entities_knowledge_bases_v1](/api-reference/collections/knowledge-bases/#entities_knowledge_bases_v1): Retrieve knowledge base entities for the provided id.
  - [entities_knowledge_bases_create_v1](/api-reference/collections/knowledge-bases/#entities_knowledge_bases_create_v1): Create or update a knowledge base. For deletion, provide knowledge base with IsDeleted=true.
  - [entities_knowledge_bases_update_v1](/api-reference/collections/knowledge-bases/#entities_knowledge_bases_update_v1): Update an existing knowledge base.
  - [queries_knowledge_bases_v1](/api-reference/collections/knowledge-bases/#queries_knowledge_bases_v1): Query knowledge bases based on the provided filters.
- [Kubernetes Container Compliance](/api-reference/collections/kubernetes-container-compliance/): 10 operations
  - [AggregateAssessmentsGroupedByClustersV2](/api-reference/collections/kubernetes-container-compliance/#aggregateassessmentsgroupedbyclustersv2): Returns cluster details along with aggregated assessment results organized by cluster, including pass/fail assessment counts for various asset types.
  - [AggregateComplianceByAssetType](/api-reference/collections/kubernetes-container-compliance/#aggregatecompliancebyassettype): Provides aggregated compliance assessment metrics and rule status information, organized by asset type.
  - [AggregateComplianceByClusterType](/api-reference/collections/kubernetes-container-compliance/#aggregatecompliancebyclustertype): Provides aggregated compliance assessment metrics and rule status information, organized by Kubernetes cluster type.
  - [AggregateComplianceByFramework](/api-reference/collections/kubernetes-container-compliance/#aggregatecompliancebyframework): Provides aggregated compliance assessment metrics and rule status information, organized by compliance framework.
  - [AggregateFailedRulesByClustersV3](/api-reference/collections/kubernetes-container-compliance/#aggregatefailedrulesbyclustersv3): Retrieves the most non-compliant clusters, ranked in descending order based on the number of failed compliance rules across severity levels (critical, high, medium, and low).
  - [AggregateAssessmentsGroupedByRulesV2](/api-reference/collections/kubernetes-container-compliance/#aggregateassessmentsgroupedbyrulesv2): Returns rule details along with aggregated assessment results organized by compliance rule, including pass/fail assessment counts.
  - [AggregateTopFailedImages](/api-reference/collections/kubernetes-container-compliance/#aggregatetopfailedimages): Retrieves the most non-compliant container images, ranked in descending order based on the number of failed assessments across severity levels (critical, high, medium, and low).
  - [CombinedImagesFindings](/api-reference/collections/kubernetes-container-compliance/#combinedimagesfindings): Returns detailed compliance assessment results for container images, providing the information needed to identify compliance violations.
  - [CombinedNodesFindings](/api-reference/collections/kubernetes-container-compliance/#combinednodesfindings): Returns detailed compliance assessment results for kubernetes nodes, providing the information needed to identify compliance violations.
  - [getRulesMetadataByID](/api-reference/collections/kubernetes-container-compliance/#getrulesmetadatabyid): Retrieve detailed compliance rule information by ID.
- [Kubernetes Protection](/api-reference/collections/kubernetes-protection/): 63 operations
  - [ReadClustersByDateRangeCount](/api-reference/collections/kubernetes-protection/#readclustersbydaterangecount): Retrieve clusters by date range counts
  - [ReadClustersByKubernetesVersionCount](/api-reference/collections/kubernetes-protection/#readclustersbykubernetesversioncount): Bucket clusters by kubernetes version
  - [ReadClustersByStatusCount](/api-reference/collections/kubernetes-protection/#readclustersbystatuscount): Bucket clusters by status
  - [ReadClusterCount](/api-reference/collections/kubernetes-protection/#readclustercount): Retrieve cluster counts
  - [ReadContainersByDateRangeCount](/api-reference/collections/kubernetes-protection/#readcontainersbydaterangecount): Retrieve containers by date range counts
  - [ReadContainerCountByRegistry](/api-reference/collections/kubernetes-protection/#readcontainercountbyregistry): Retrieve top container image registries
  - [FindContainersCountAffectedByZeroDayVulnerabilities](/api-reference/collections/kubernetes-protection/#findcontainerscountaffectedbyzerodayvulnerabilities): Retrieve containers count affected by zero day vulnerabilities
  - [ReadVulnerableContainerImageCount](/api-reference/collections/kubernetes-protection/#readvulnerablecontainerimagecount): Retrieve count of vulnerable images running on containers
  - [ReadContainerCount](/api-reference/collections/kubernetes-protection/#readcontainercount): Retrieve container counts
  - [FindContainersByContainerRunTimeVersion](/api-reference/collections/kubernetes-protection/#findcontainersbycontainerruntimeversion): Retrieve containers by container_runtime_version
  - [GroupContainersByManaged](/api-reference/collections/kubernetes-protection/#groupcontainersbymanaged): Group the containers by Managed
  - [ReadContainerImageDetectionsCountByDate](/api-reference/collections/kubernetes-protection/#readcontainerimagedetectionscountbydate): Retrieve count of image assessment detections on running containers over a period of time
  - [ReadContainerImagesByState](/api-reference/collections/kubernetes-protection/#readcontainerimagesbystate): Retrieve count of image states running on containers
  - [ReadContainersSensorCoverage](/api-reference/collections/kubernetes-protection/#readcontainerssensorcoverage): Bucket containers by agent type and calculate sensor coverage
  - [ReadContainerVulnerabilitiesBySeverityCount](/api-reference/collections/kubernetes-protection/#readcontainervulnerabilitiesbyseveritycount): Retrieve container vulnerabilities by severity counts
  - [ReadDeploymentsByDateRangeCount](/api-reference/collections/kubernetes-protection/#readdeploymentsbydaterangecount): Retrieve deployments by date range counts
  - [ReadDeploymentCount](/api-reference/collections/kubernetes-protection/#readdeploymentcount): Retrieve deployment counts
  - [ReadClusterEnrichment](/api-reference/collections/kubernetes-protection/#readclusterenrichment): Retrieve cluster enrichment data
  - [ReadContainerEnrichment](/api-reference/collections/kubernetes-protection/#readcontainerenrichment): Retrieve container enrichment data
  - [ReadDeploymentEnrichment](/api-reference/collections/kubernetes-protection/#readdeploymentenrichment): Retrieve deployment enrichment data
  - [ReadNodeEnrichment](/api-reference/collections/kubernetes-protection/#readnodeenrichment): Retrieve node enrichment data
  - [ReadPodEnrichment](/api-reference/collections/kubernetes-protection/#readpodenrichment): Retrieve pod enrichment data
  - [ReadDistinctContainerImageCount](/api-reference/collections/kubernetes-protection/#readdistinctcontainerimagecount): Retrieve count of distinct images running on containers
  - [ReadContainerImagesByMostUsed](/api-reference/collections/kubernetes-protection/#readcontainerimagesbymostused): Bucket container by image-digest
  - [ReadKubernetesIomByDateRange](/api-reference/collections/kubernetes-protection/#readkubernetesiombydaterange): Returns the count of Kubernetes IOMs by the date. by default it's for 7 days.
  - [ReadNamespacesByDateRangeCount](/api-reference/collections/kubernetes-protection/#readnamespacesbydaterangecount): Retrieve namespaces by date range counts
  - [ReadNamespaceCount](/api-reference/collections/kubernetes-protection/#readnamespacecount): Retrieve namespace counts
  - [ReadKubernetesIomCount](/api-reference/collections/kubernetes-protection/#readkubernetesiomcount): Returns the total count of Kubernetes IOMs over the past seven days
  - [ReadNodesByCloudCount](/api-reference/collections/kubernetes-protection/#readnodesbycloudcount): Bucket nodes by cloud providers
  - [ReadNodesByContainerEngineVersionCount](/api-reference/collections/kubernetes-protection/#readnodesbycontainerengineversioncount): Bucket nodes by their container engine version
  - [ReadNodesByDateRangeCount](/api-reference/collections/kubernetes-protection/#readnodesbydaterangecount): Retrieve nodes by date range counts
  - [ReadNodeCount](/api-reference/collections/kubernetes-protection/#readnodecount): Retrieve node counts
  - [ReadPodsByDateRangeCount](/api-reference/collections/kubernetes-protection/#readpodsbydaterangecount): Retrieve pods by date range counts
  - [ReadPodCount](/api-reference/collections/kubernetes-protection/#readpodcount): Retrieve pod counts
  - [ReadClusterCombined](/api-reference/collections/kubernetes-protection/#readclustercombined): Retrieve kubernetes clusters identified by the provided filter criteria
  - [ReadClusterCombinedV2](/api-reference/collections/kubernetes-protection/#readclustercombinedv2): Retrieve kubernetes clusters identified by the provided filter criteria
  - [ReadRunningContainerImages](/api-reference/collections/kubernetes-protection/#readrunningcontainerimages): Retrieve images on running containers
  - [ReadContainerCombined](/api-reference/collections/kubernetes-protection/#readcontainercombined): Retrieve containers identified by the provided filter criteria
  - [ReadDeploymentCombined](/api-reference/collections/kubernetes-protection/#readdeploymentcombined): Retrieve kubernetes deployments identified by the provided filter criteria
  - [SearchAndReadKubernetesIomEntities](/api-reference/collections/kubernetes-protection/#searchandreadkubernetesiomentities): Search Kubernetes IOM by the provided search criteria
  - [ReadNodeCombined](/api-reference/collections/kubernetes-protection/#readnodecombined): Retrieve kubernetes nodes identified by the provided filter criteria
  - [ReadPodCombined](/api-reference/collections/kubernetes-protection/#readpodcombined): Retrieve kubernetes pods identified by the provided filter criteria
  - [ReadKubernetesIomEntities](/api-reference/collections/kubernetes-protection/#readkubernetesiomentities): Retrieve Kubernetes IOM entities identified by the provided IDs
  - [SearchKubernetesIoms](/api-reference/collections/kubernetes-protection/#searchkubernetesioms): Search Kubernetes IOMs by the provided search criteria. this endpoint returns a list of Kubernetes IOM UUIDs matching the query
  - [GetAWSAccounts](/api-reference/collections/kubernetes-protection/#getawsaccounts): Provides a list of AWS accounts.
  - [CreateAWSAccount](/api-reference/collections/kubernetes-protection/#createawsaccount): Creates a new AWS account in our system for a customer and generates the installation script
  - [DeleteAWSAccountsMixin0](/api-reference/collections/kubernetes-protection/#deleteawsaccountsmixin0): Delete AWS accounts.
  - [UpdateAWSAccount](/api-reference/collections/kubernetes-protection/#updateawsaccount): Updates the AWS account per the query parameters provided
  - [ListAzureAccounts](/api-reference/collections/kubernetes-protection/#listazureaccounts): Provides the azure subscriptions registered to Kubernetes Protection.
  - [CreateAzureSubscription](/api-reference/collections/kubernetes-protection/#createazuresubscription): Creates a new Azure Subscription in our system
  - [DeleteAzureSubscription](/api-reference/collections/kubernetes-protection/#deleteazuresubscription): Delete an Azure Subscription from the system.
  - [GetLocations](/api-reference/collections/kubernetes-protection/#getlocations): Provides the cloud locations acknowledged by the Kubernetes Protection service
  - [GetCombinedCloudClusters](/api-reference/collections/kubernetes-protection/#getcombinedcloudclusters): Returns a combined list of provisioned cloud accounts and known kubernetes clusters.
  - [GetAzureTenantConfig](/api-reference/collections/kubernetes-protection/#getazuretenantconfig): Returns the Azure tenant config.
  - [GetStaticScripts](/api-reference/collections/kubernetes-protection/#getstaticscripts): Get static bash scripts that are used during registration.
  - [GetAzureTenantIDs](/api-reference/collections/kubernetes-protection/#getazuretenantids): Provides all the azure subscriptions and tenants IDs.
  - [GetAzureInstallScript](/api-reference/collections/kubernetes-protection/#getazureinstallscript): Provide the script to run for a given tenant id and subscription IDs.
  - [GetHelmValuesYaml](/api-reference/collections/kubernetes-protection/#gethelmvaluesyaml): Provides a sample Helm values.yaml file for a customer to install alongside the agent Helm chart
  - [RegenerateAPIKey](/api-reference/collections/kubernetes-protection/#regenerateapikey): Regenerate API key for docker registry integrations.
  - [GetClusters](/api-reference/collections/kubernetes-protection/#getclusters): Provides the clusters acknowledged by the Kubernetes Protection service
  - [TriggerScan](/api-reference/collections/kubernetes-protection/#triggerscan): Triggers a dry run or a full scan of a customer's kubernetes footprint.
  - [PostSearchKubernetesIOMEntities](/api-reference/collections/kubernetes-protection/#postsearchkubernetesiomentities): Search Kubernetes IOM entities by filter criteria
  - [PatchAzureServicePrincipal](/api-reference/collections/kubernetes-protection/#patchazureserviceprincipal): Adds the client ID for the given tenant ID to our system.
- [MalQuery](/api-reference/collections/malquery/): 9 operations
  - [GetMalQueryQuotasV1](/api-reference/collections/malquery/#getmalqueryquotasv1): Get information about search and download quotas in your environment
  - [PostMalQueryFuzzySearchV1](/api-reference/collections/malquery/#postmalqueryfuzzysearchv1): Search Falcon MalQuery quickly, but with more potential for false positives. Search for a combination of hex patterns and strings in order to identify samples based upon file content at byte level granularity.
  - [GetMalQueryDownloadV1](/api-reference/collections/malquery/#getmalquerydownloadv1): Download a file indexed by MalQuery. Specify the file using its SHA256. Only one file is supported at this time
  - [GetMalQueryMetadataV1](/api-reference/collections/malquery/#getmalquerymetadatav1): Retrieve indexed files metadata by their hash
  - [GetMalQueryRequestV1](/api-reference/collections/malquery/#getmalqueryrequestv1): Check the status and results of an asynchronous request, such as hunt or exact-search. Supports a single request id at this time.
  - [GetMalQueryEntitiesSamplesFetchV1](/api-reference/collections/malquery/#getmalqueryentitiessamplesfetchv1): Fetch a zip archive with password 'infected' containing the samples. Call this once the /entities/samples-multidownload request has finished processing
  - [PostMalQueryEntitiesSamplesMultidownloadV1](/api-reference/collections/malquery/#postmalqueryentitiessamplesmultidownloadv1): Schedule samples for download. Use the result id with the /request endpoint to check if the download is ready after which you can call the /entities/samples-fetch to get the zip
  - [PostMalQueryExactSearchV1](/api-reference/collections/malquery/#postmalqueryexactsearchv1): Search Falcon MalQuery for a combination of hex patterns and strings in order to identify samples based upon file content at byte level granularity. You can filter results on criteria such as file type, file size and first seen date. Returns a request id which can be used with the /request endpoint
  - [PostMalQueryHuntV1](/api-reference/collections/malquery/#postmalqueryhuntv1): Schedule a YARA-based search for execution. Returns a request id which can be used with the /request endpoint
- [Message Center](/api-reference/collections/message-center/): 9 operations
  - [AggregateCases](/api-reference/collections/message-center/#aggregatecases): Retrieve aggregate case values based on the matched filter
  - [GetCaseActivityByIds](/api-reference/collections/message-center/#getcaseactivitybyids): Retrieve activities for given id's
  - [CaseAddActivity](/api-reference/collections/message-center/#caseaddactivity): Add an activity to case. Only activities of type comment are allowed via API
  - [CaseDownloadAttachment](/api-reference/collections/message-center/#casedownloadattachment): retrieves an attachment for the case, given the attachment id
  - [CaseAddAttachment](/api-reference/collections/message-center/#caseaddattachment): Upload an attachment for the case.
  - [CreateCaseV2](/api-reference/collections/message-center/#createcasev2): create a new case
  - [GetCaseEntitiesByIDs](/api-reference/collections/message-center/#getcaseentitiesbyids): Retrieve message center cases
  - [QueryActivityByCaseID](/api-reference/collections/message-center/#queryactivitybycaseid): Retrieve activities id's for a case
  - [QueryCasesIdsByFilter](/api-reference/collections/message-center/#querycasesidsbyfilter): Retrieve case id's that match the provided filter criteria
- [ML Exclusions](/api-reference/collections/ml-exclusions/): 14 operations
  - [getMLExclusionsV1](/api-reference/collections/ml-exclusions/#getmlexclusionsv1): Get a set of ML Exclusions by specifying their IDs
  - [createMLExclusionsV1](/api-reference/collections/ml-exclusions/#createmlexclusionsv1): Create the ML exclusions
  - [deleteMLExclusionsV1](/api-reference/collections/ml-exclusions/#deletemlexclusionsv1): Delete the ML exclusions by id
  - [updateMLExclusionsV1](/api-reference/collections/ml-exclusions/#updatemlexclusionsv1): Update the ML exclusions
  - [queryMLExclusionsV1](/api-reference/collections/ml-exclusions/#querymlexclusionsv1): Search for ML exclusions.
  - [exclusions_aggregates_v2](/api-reference/collections/ml-exclusions/#exclusions_aggregates_v2): Get exclusion aggregates as specified via json in request body.
  - [exclusions_get_all_v2](/api-reference/collections/ml-exclusions/#exclusions_get_all_v2): Get all exclusions.
  - [exclusions_perform_action_v2](/api-reference/collections/ml-exclusions/#exclusions_perform_action_v2): Actions used to manipulate the content of exclusions, with ancestor fields.
  - [exclusions_get_reports_v2](/api-reference/collections/ml-exclusions/#exclusions_get_reports_v2): Create a report of ML exclusions scoped by the given filters.
  - [exclusions_get_v2](/api-reference/collections/ml-exclusions/#exclusions_get_v2): Get the exclusions by id, with ancestor fields.
  - [exclusions_create_v2](/api-reference/collections/ml-exclusions/#exclusions_create_v2): Create the exclusions, with ancestor fields.
  - [exclusions_update_v2](/api-reference/collections/ml-exclusions/#exclusions_update_v2): Update the exclusions by id, with ancestor fields.
  - [exclusions_delete_v2](/api-reference/collections/ml-exclusions/#exclusions_delete_v2): Delete the exclusions by id, with ancestor fields.
  - [exclusions_search_v2](/api-reference/collections/ml-exclusions/#exclusions_search_v2): Search for exclusions, with ancestor fields.
- [Mobile Enrollment](/api-reference/collections/mobile-enrollment/): 2 operations
  - [RequestDeviceEnrollmentV3](/api-reference/collections/mobile-enrollment/#requestdeviceenrollmentv3): Trigger on-boarding process for a mobile device.
  - [RequestDeviceEnrollmentV4](/api-reference/collections/mobile-enrollment/#requestdeviceenrollmentv4): Trigger on-boarding process for a mobile device.
- [MSSP (Flight Control)](/api-reference/collections/mssp/): 31 operations
  - [getChildrenV2](/api-reference/collections/mssp/#getchildrenv2): Get link to child customer by child CID(s)
  - [getChildren](/api-reference/collections/mssp/#getchildren): Get link to child customer by child CID(s)
  - [getCIDGroupMembersBy](/api-reference/collections/mssp/#getcidgroupmembersby): Get CID group members by CID Group ID.
  - [getCIDGroupMembersByV1](/api-reference/collections/mssp/#getcidgroupmembersbyv1): Get CID Group members by CID Group IDs.
  - [addCIDGroupMembers](/api-reference/collections/mssp/#addcidgroupmembers): Add new CID Group member.
  - [deleteCIDGroupMembers](/api-reference/collections/mssp/#deletecidgroupmembers): Delete CID Group members entry.
  - [getCIDGroupByIdV1](/api-reference/collections/mssp/#getcidgroupbyidv1): Get CID Group(s) by ID(s).
  - [getCIDGroupById](/api-reference/collections/mssp/#getcidgroupbyid): Get CID Groups by ID.
  - [createCIDGroups](/api-reference/collections/mssp/#createcidgroups): Create new CID Group(s). Maximum 500 CID Group(s) allowed.
  - [deleteCIDGroups](/api-reference/collections/mssp/#deletecidgroups): Delete CID Group(s) by ID(s).
  - [updateCIDGroups](/api-reference/collections/mssp/#updatecidgroups): Update existing CID Group(s). CID Group ID is expected for each CID Group definition provided in request body. CID Group member(s) remain unaffected.
  - [getRolesByID](/api-reference/collections/mssp/#getrolesbyid): Get MSSP Role assignment(s).
  - [addRole](/api-reference/collections/mssp/#addrole): Assign new MSSP Role(s) between User Group and CID Group.
  - [deletedRoles](/api-reference/collections/mssp/#deletedroles): Delete MSSP Role assignment(s) between User Group and CID Group.
  - [getUserGroupMembersByID](/api-reference/collections/mssp/#getusergroupmembersbyid): Get User Group members by User Group ID(s).
  - [getUserGroupMembersByIDV1](/api-reference/collections/mssp/#getusergroupmembersbyidv1): Get User Group members by User Group ID(s). deprecated
  - [addUserGroupMembers](/api-reference/collections/mssp/#addusergroupmembers): Add new User Group member. Maximum 500 members allowed per User Group.
  - [deleteUserGroupMembers](/api-reference/collections/mssp/#deleteusergroupmembers): Delete User Group members entry.
  - [getUserGroupsByID](/api-reference/collections/mssp/#getusergroupsbyid): Get User Group by ID(s).
  - [getUserGroupsByIDV1](/api-reference/collections/mssp/#getusergroupsbyidv1): Get user groups by ID. deprecated
  - [createUserGroups](/api-reference/collections/mssp/#createusergroups): Create new User Group(s). Maximum 500 User Group(s) allowed per customer.
  - [deleteUserGroups](/api-reference/collections/mssp/#deleteusergroups): Delete User Group(s) by ID(s).
  - [updateUserGroups](/api-reference/collections/mssp/#updateusergroups): Update existing User Group(s). User Group ID is expected for each User Group definition provided in request body. User Group member(s) remain unaffected.
  - [getUserGroupsByID](/api-reference/collections/mssp/#getusergroupsbyid): Get user groups by ID.
  - [queryChildren](/api-reference/collections/mssp/#querychildren): Query for customers linked as children
  - [queryCIDGroupMembers](/api-reference/collections/mssp/#querycidgroupmembers): Query a CID Groups members by associated CID.
  - [queryCIDGroups](/api-reference/collections/mssp/#querycidgroups): Query CID Groups.
  - [queryRoles](/api-reference/collections/mssp/#queryroles): Query links between user groups and CID groups. At least one of CID Group ID or User Group ID should also be provided. Role ID is optional.
  - [queryUserGroupMembers](/api-reference/collections/mssp/#queryusergroupmembers): Query User Group member by User UUID.
  - [queryUserGroups](/api-reference/collections/mssp/#queryusergroups): Query User Groups.
  - [deleteCIDGroupMembersV1](/api-reference/collections/mssp/#deletecidgroupmembersv1): Deprecated: Please use deleteCIDGroupMembersV2.
- [Network Scan Global Configs](/api-reference/collections/network-scan-global-configs/): 2 operations
  - [get_global_configs](/api-reference/collections/network-scan-global-configs/#get_global_configs): Get "global-configs" for the CID
  - [update_global_configs](/api-reference/collections/network-scan-global-configs/#update_global_configs): Update "global-configs" using provided specifications
- [Network Scan Networks](/api-reference/collections/network-scan-networks/): 6 operations
  - [aggregate_networks](/api-reference/collections/network-scan-networks/#aggregate_networks): Returns "networks" aggregations
  - [get_networks](/api-reference/collections/network-scan-networks/#get_networks): Get "networks" by their IDs
  - [create_networks](/api-reference/collections/network-scan-networks/#create_networks): Create "networks" using provided specifications
  - [delete_networks](/api-reference/collections/network-scan-networks/#delete_networks): Delete "networks" by their IDs
  - [update_networks](/api-reference/collections/network-scan-networks/#update_networks): Update "networks" using provided specifications
  - [query_networks](/api-reference/collections/network-scan-networks/#query_networks): Get "networks IDs" by filter
- [Network Scan Scan Run Reports](/api-reference/collections/network-scan-scan-run-reports/): 1 operations
  - [get_scan_run_reports](/api-reference/collections/network-scan-scan-run-reports/#get_scan_run_reports): Downloads scan run report in CSV format
- [Network Scan Scan Runs](/api-reference/collections/network-scan-scan-runs/): 5 operations
  - [aggregate_scan_runs](/api-reference/collections/network-scan-scan-runs/#aggregate_scan_runs): Returns "scan-runs" aggregations
  - [get_scan_runs](/api-reference/collections/network-scan-scan-runs/#get_scan_runs): Get "scan-runs" by their IDs
  - [create_scan_runs](/api-reference/collections/network-scan-scan-runs/#create_scan_runs): Create "scan-runs" using provided specifications
  - [update_scan_runs](/api-reference/collections/network-scan-scan-runs/#update_scan_runs): Update "scan-runs" using provided specifications
  - [query_scan_runs](/api-reference/collections/network-scan-scan-runs/#query_scan_runs): Get "scan-runs IDs" by filter
- [Network Scan Scanners](/api-reference/collections/network-scan-scanners/): 4 operations
  - [aggregate_scanners](/api-reference/collections/network-scan-scanners/#aggregate_scanners): Returns "scanners" aggregations
  - [get_scanners](/api-reference/collections/network-scan-scanners/#get_scanners): Get "scanners" by their IDs
  - [update_scanners](/api-reference/collections/network-scan-scanners/#update_scanners): Update "scanners" using provided specifications
  - [query_scanners](/api-reference/collections/network-scan-scanners/#query_scanners): Get "scanners IDs" by filter
- [Network Scan Scans](/api-reference/collections/network-scan-scans/): 6 operations
  - [aggregate_scansMixin0](/api-reference/collections/network-scan-scans/#aggregate_scansmixin0): Returns "scans" aggregations
  - [get_scans](/api-reference/collections/network-scan-scans/#get_scans): Get "scans" by their IDs
  - [create_scans](/api-reference/collections/network-scan-scans/#create_scans): Create "scans" using provided specifications
  - [delete_scans](/api-reference/collections/network-scan-scans/#delete_scans): Delete "scans" by their IDs
  - [update_scans](/api-reference/collections/network-scan-scans/#update_scans): Update "scans" using provided specifications
  - [query_scansMixin0](/api-reference/collections/network-scan-scans/#query_scansmixin0): Get "scans IDs" by filter
- [Network Scan Templates](/api-reference/collections/network-scan-templates/): 6 operations
  - [get_template_configs](/api-reference/collections/network-scan-templates/#get_template_configs): Get details on the network scan template configurations
  - [get_templates](/api-reference/collections/network-scan-templates/#get_templates): Get "templates" by their IDs
  - [create_templates](/api-reference/collections/network-scan-templates/#create_templates): Create "templates" using provided specifications
  - [delete_templates](/api-reference/collections/network-scan-templates/#delete_templates): Delete "templates" by their IDs
  - [update_templates](/api-reference/collections/network-scan-templates/#update_templates): Update "templates" using provided specifications
  - [query_templates](/api-reference/collections/network-scan-templates/#query_templates): Get "templates IDs" by filter
- [Network Scan Zones](/api-reference/collections/network-scan-zones/): 7 operations
  - [aggregate_zones](/api-reference/collections/network-scan-zones/#aggregate_zones): Returns "zones" aggregations
  - [combined_zones](/api-reference/collections/network-scan-zones/#combined_zones): Get "zones" by filter
  - [get_zones](/api-reference/collections/network-scan-zones/#get_zones): Get "zones" by their IDs
  - [create_zones](/api-reference/collections/network-scan-zones/#create_zones): Create "zones" using provided specifications
  - [delete_zones](/api-reference/collections/network-scan-zones/#delete_zones): Delete "zones" by their IDs
  - [update_zones](/api-reference/collections/network-scan-zones/#update_zones): Update "zones" using provided specifications
  - [query_zones](/api-reference/collections/network-scan-zones/#query_zones): Get "zones IDs" by filter
- [NGSIEM](/api-reference/collections/ngsiem/): 48 operations
  - [UploadLookupV1](/api-reference/collections/ngsiem/#uploadlookupv1): Upload a lookup file to NGSIEM.
  - [GetLookupV1](/api-reference/collections/ngsiem/#getlookupv1): Download lookup file from NGSIEM.
  - [GetLookupFromPackageWithNamespaceV1](/api-reference/collections/ngsiem/#getlookupfrompackagewithnamespacev1): Download lookup file in namespaced package from NGSIEM.
  - [GetLookupFromPackageV1](/api-reference/collections/ngsiem/#getlookupfrompackagev1): Download lookup file in package from NGSIEM.
  - [StartSearchV1](/api-reference/collections/ngsiem/#startsearchv1): Initiate a NGSIEM search.
  - [GetSearchStatusV1](/api-reference/collections/ngsiem/#getsearchstatusv1): Get status of a NGSIEM search.
  - [StopSearchV1](/api-reference/collections/ngsiem/#stopsearchv1): Stop a NGSIEM search.
  - [GetDashboardTemplate](/api-reference/collections/ngsiem/#getdashboardtemplate): Get dashboard template by ID.
  - [CreateDashboardFromTemplate](/api-reference/collections/ngsiem/#createdashboardfromtemplate): Create Dashboard from LogScale YAML Template in NGSIEM.
  - [UpdateDashboardFromTemplate](/api-reference/collections/ngsiem/#updatedashboardfromtemplate): Update Dashboard from LogScale YAML Template in NGSIEM. Please note a successful update will result in a new ID value being returned.
  - [DeleteDashboard](/api-reference/collections/ngsiem/#deletedashboard): Delete Dashboard in NGSIEM.
  - [GetLookupFile](/api-reference/collections/ngsiem/#getlookupfile): Retrieve Lookup File in NGSIEM.
  - [CreateLookupFile](/api-reference/collections/ngsiem/#createlookupfile): Create Lookup File in NGSIEM.
  - [UpdateLookupFile](/api-reference/collections/ngsiem/#updatelookupfile): Update Lookup File in NGSIEM.
  - [DeleteLookupFile](/api-reference/collections/ngsiem/#deletelookupfile): Delete Lookup File in NGSIEM.
  - [ListDashboards](/api-reference/collections/ngsiem/#listdashboards): List dashboards.
  - [ListLookupFiles](/api-reference/collections/ngsiem/#listlookupfiles): List lookup files.
  - [ListParsers](/api-reference/collections/ngsiem/#listparsers): List parsers.
  - [ListSavedQueries](/api-reference/collections/ngsiem/#listsavedqueries): List saved queries.
  - [UpdateLookupFileEntries](/api-reference/collections/ngsiem/#updatelookupfileentries): Update entries in an existing Lookup File in NGSIEM.
  - [ExternalListDataConnections](/api-reference/collections/ngsiem/#externallistdataconnections): List and search data connections.
  - [ExternalListDataConnectors](/api-reference/collections/ngsiem/#externallistdataconnectors): List available data connectors.
  - [ExternalGetDataConnectionStatus](/api-reference/collections/ngsiem/#externalgetdataconnectionstatus): Get data connection provisioning status.
  - [ExternalUpdateDataConnectionStatus](/api-reference/collections/ngsiem/#externalupdatedataconnectionstatus): Update data connection status.
  - [ExternalGetDataConnectionToken](/api-reference/collections/ngsiem/#externalgetdataconnectiontoken): Get Ingest token for data connection.
  - [ExternalRegenerateDataConnectionToken](/api-reference/collections/ngsiem/#externalregeneratedataconnectiontoken): Regenerate Ingest token for data connection.
  - [ExternalGetDataConnectionByID](/api-reference/collections/ngsiem/#externalgetdataconnectionbyid): Get data connection by ID.
  - [ExternalCreateDataConnection](/api-reference/collections/ngsiem/#externalcreatedataconnection): Create a new data connection.
  - [ExternalUpdateDataConnection](/api-reference/collections/ngsiem/#externalupdatedataconnection): Update a data connection.
  - [ExternalDeleteDataConnection](/api-reference/collections/ngsiem/#externaldeletedataconnection): Delete a data connection.
  - [ExternalListConnectorConfigs](/api-reference/collections/ngsiem/#externallistconnectorconfigs): List configurations for a data connector.
  - [ExternalCreateConnectorConfig](/api-reference/collections/ngsiem/#externalcreateconnectorconfig): Create a new configuration for a data connector.
  - [ExternalPatchConnectorConfig](/api-reference/collections/ngsiem/#externalpatchconnectorconfig): Patch configurations for a data connector.
  - [ExternalDeleteConnectorConfigs](/api-reference/collections/ngsiem/#externaldeleteconnectorconfigs): Delete data connection config.
  - [UpdateParserFromTemplate](/api-reference/collections/ngsiem/#updateparserfromtemplate): Update Parser in NGSIEM from YAML Template. Please note that name changes are not supported, but rather should be created as a new parser.
  - [GetParserTemplate](/api-reference/collections/ngsiem/#getparsertemplate): Retrieve Parser in NGSIEM as LogScale YAML Template.
  - [CreateParserFromTemplate](/api-reference/collections/ngsiem/#createparserfromtemplate): Create Parser from LogScale YAML Template in NGSIEM.
  - [GetParser](/api-reference/collections/ngsiem/#getparser): Retrieve Parser in NGSIEM.
  - [CreateParser](/api-reference/collections/ngsiem/#createparser): Create Parser in NGSIEM.
  - [UpdateParser](/api-reference/collections/ngsiem/#updateparser): Update Parser in NGSIEM. Please note that name changes are not supported, but rather should be created as a new parser.
  - [DeleteParser](/api-reference/collections/ngsiem/#deleteparser): Delete Parser in NGSIEM.
  - [UpdateParserAutoUpdatePolicy](/api-reference/collections/ngsiem/#updateparserautoupdatepolicy): Update a parser auto update policy.
  - [InstallParser](/api-reference/collections/ngsiem/#installparser): Install a CrowdStrike-managed out-of-the-box (OOTB) parser.
  - [BulkInstallParsers](/api-reference/collections/ngsiem/#bulkinstallparsers): Install multiple CrowdStrike-managed out-of-the-box (OOTB) parsers.
  - [GetSavedQueryTemplate](/api-reference/collections/ngsiem/#getsavedquerytemplate): Retrieve Saved Query in NGSIEM as LogScale YAML Template by ID.
  - [CreateSavedQuery](/api-reference/collections/ngsiem/#createsavedquery): Create Saved Query from LogScale YAML Template in NGSIEM.
  - [UpdateSavedQueryFromTemplate](/api-reference/collections/ngsiem/#updatesavedqueryfromtemplate): Update Saved Query from LogScale YAML Template in NGSIEM.
  - [DeleteSavedQuery](/api-reference/collections/ngsiem/#deletesavedquery): Delete Saved Query in NGSIEM.
- [OAuth2](/api-reference/collections/oauth2/): 2 operations
  - [oauth2RevokeToken](/api-reference/collections/oauth2/#oauth2revoketoken): Revoke a previously issued OAuth2 access token before the end of its standard 30-minute lifespan.
  - [oauth2AccessToken](/api-reference/collections/oauth2/#oauth2accesstoken): Generate an OAuth2 access token
- [ODS (On Demand Scan)](/api-reference/collections/ods/): 16 operations
  - [aggregate_query_scan_host_metadata](/api-reference/collections/ods/#aggregate_query_scan_host_metadata): Get aggregates on ODS scan-hosts data.
  - [aggregate_scans](/api-reference/collections/ods/#aggregate_scans): Get aggregates on ODS scan data.
  - [aggregate_scheduled_scans](/api-reference/collections/ods/#aggregate_scheduled_scans): Get aggregates on ODS scheduled-scan data.
  - [get_malicious_files_by_ids](/api-reference/collections/ods/#get_malicious_files_by_ids): Get malicious files by ids.
  - [cancel_scans](/api-reference/collections/ods/#cancel_scans): Cancel ODS scans for the given scan ids.
  - [get_scan_host_metadata_by_ids](/api-reference/collections/ods/#get_scan_host_metadata_by_ids): Get scan hosts by ids.
  - [get_scans_by_scan_ids_v1](/api-reference/collections/ods/#get_scans_by_scan_ids_v1): Get Scans by IDs.
  - [get_scans_by_scan_ids_v2](/api-reference/collections/ods/#get_scans_by_scan_ids_v2): Get Scans by IDs.
  - [create_scan](/api-reference/collections/ods/#create_scan): Create ODS scan and start or schedule scan for the given scan request.
  - [get_scheduled_scans_by_scan_ids](/api-reference/collections/ods/#get_scheduled_scans_by_scan_ids): Get ScheduledScans by IDs.
  - [schedule_scan](/api-reference/collections/ods/#schedule_scan): Create ODS scan and start or schedule scan for the given scan request.
  - [delete_scheduled_scans](/api-reference/collections/ods/#delete_scheduled_scans): Delete ODS scheduled-scans for the given scheduled-scan ids.
  - [query_malicious_files](/api-reference/collections/ods/#query_malicious_files): Query malicious files.
  - [query_scan_host_metadata](/api-reference/collections/ods/#query_scan_host_metadata): Query scan hosts.
  - [query_scans](/api-reference/collections/ods/#query_scans): Query Scans.
  - [query_scheduled_scans](/api-reference/collections/ods/#query_scheduled_scans): Query ScheduledScans.
- [Overwatch Dashboard](/api-reference/collections/overwatch-dashboard/): 5 operations
  - [AggregatesDetectionsGlobalCounts](/api-reference/collections/overwatch-dashboard/#aggregatesdetectionsglobalcounts): Get the total number of detections pushed across all customers.
  - [AggregatesEventsCollections](/api-reference/collections/overwatch-dashboard/#aggregateseventscollections): Get OverWatch detection event collection info by providing an aggregate query.
  - [AggregatesEvents](/api-reference/collections/overwatch-dashboard/#aggregatesevents): Get aggregate OverWatch detection event info by providing an aggregate query.
  - [AggregatesIncidentsGlobalCounts](/api-reference/collections/overwatch-dashboard/#aggregatesincidentsglobalcounts): Get the total number of incidents pushed across all customers.
  - [AggregatesOWEventsGlobalCounts](/api-reference/collections/overwatch-dashboard/#aggregatesoweventsglobalcounts): Get the total number of OverWatch events across all customers.
- [Prevention Policy](/api-reference/collections/prevention-policy/): 10 operations
  - [queryCombinedPreventionPolicyMembers](/api-reference/collections/prevention-policy/#querycombinedpreventionpolicymembers): Search for members of a Prevention Policy in your environment by providing a FQL filter and paging details. Returns a set of host details which match the filter criteria
  - [queryCombinedPreventionPolicies](/api-reference/collections/prevention-policy/#querycombinedpreventionpolicies): Search for Prevention Policies in your environment by providing a FQL filter and paging details. Returns a set of Prevention Policies which match the filter criteria
  - [performPreventionPoliciesAction](/api-reference/collections/prevention-policy/#performpreventionpoliciesaction): Perform the specified action on the Prevention Policies specified in the request
  - [setPreventionPoliciesPrecedence](/api-reference/collections/prevention-policy/#setpreventionpoliciesprecedence): Sets the precedence of Prevention Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence
  - [getPreventionPolicies](/api-reference/collections/prevention-policy/#getpreventionpolicies): Retrieve a set of Prevention Policies by specifying their IDs
  - [createPreventionPolicies](/api-reference/collections/prevention-policy/#createpreventionpolicies): Create Prevention Policies by specifying details about the policy to create
  - [deletePreventionPolicies](/api-reference/collections/prevention-policy/#deletepreventionpolicies): Delete a set of Prevention Policies by specifying their IDs
  - [updatePreventionPolicies](/api-reference/collections/prevention-policy/#updatepreventionpolicies): Update Prevention Policies by specifying the ID of the policy and details to update
  - [queryPreventionPolicyMembers](/api-reference/collections/prevention-policy/#querypreventionpolicymembers): Search for members of a Prevention Policy in your environment by providing a FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria
  - [queryPreventionPolicies](/api-reference/collections/prevention-policy/#querypreventionpolicies): Search for Prevention Policies in your environment by providing a FQL filter and paging details. Returns a set of Prevention Policy IDs which match the filter criteria
- [Quarantine](/api-reference/collections/quarantine/): 6 operations
  - [ActionUpdateCount](/api-reference/collections/quarantine/#actionupdatecount): Returns count of potentially affected quarantined files for each action.
  - [GetAggregateFiles](/api-reference/collections/quarantine/#getaggregatefiles): Get quarantine file aggregates as specified via json in request body.
  - [GetQuarantineFiles](/api-reference/collections/quarantine/#getquarantinefiles): Get quarantine file metadata for specified ids.
  - [UpdateQuarantinedDetectsByIds](/api-reference/collections/quarantine/#updatequarantineddetectsbyids): Apply action by quarantine file ids.
  - [QueryQuarantineFiles](/api-reference/collections/quarantine/#queryquarantinefiles): Get quarantine file ids that match the provided filter criteria.
  - [UpdateQfByQuery](/api-reference/collections/quarantine/#updateqfbyquery): Apply quarantine file actions by query.
- [Quick Scan](/api-reference/collections/quick-scan/): 4 operations
  - [GetScansAggregates](/api-reference/collections/quick-scan/#getscansaggregates): Get scans aggregations as specified via json in request body.
  - [GetScans](/api-reference/collections/quick-scan/#getscans): Check the status of a volume scan. Time required for analysis increases with the number of samples in a volume but usually it should take less than 1 minute
  - [ScanSamples](/api-reference/collections/quick-scan/#scansamples): Submit a volume of files for ml scanning. Time required for analysis increases with the number of samples in a volume but usually it should take less than 1 minute
  - [QuerySubmissionsMixin0](/api-reference/collections/quick-scan/#querysubmissionsmixin0): Find IDs for submitted scans by providing a FQL filter and paging details. Returns a set of volume IDs that match your criteria.
- [Quick Scan Pro](/api-reference/collections/quick-scan-pro/): 6 operations
  - [UploadFileQuickScanPro](/api-reference/collections/quick-scan-pro/#uploadfilequickscanpro): Uploads a file to be further analyzed with QuickScan Pro. The samples expire after 90 days.
  - [DeleteFile](/api-reference/collections/quick-scan-pro/#deletefile): Deletes file by its SHA256 identifier.
  - [GetScanResult](/api-reference/collections/quick-scan-pro/#getscanresult): Gets the result of an QuickScan Pro scan.
  - [LaunchScan](/api-reference/collections/quick-scan-pro/#launchscan): Starts scanning a file uploaded through '/quickscanpro/entities/files/v1'.
  - [DeleteScanResult](/api-reference/collections/quick-scan-pro/#deletescanresult): Deletes the result of an QuickScan Pro scan.
  - [QueryScanResults](/api-reference/collections/quick-scan-pro/#queryscanresults): Gets QuickScan Pro scan jobs for a given FQL filter.
- [Real Time Response](/api-reference/collections/real-time-response/): 23 operations
  - [RTR_AggregateSessions](/api-reference/collections/real-time-response/#rtr_aggregatesessions): Get aggregates on session data.
  - [BatchActiveResponderCmd](/api-reference/collections/real-time-response/#batchactiverespondercmd): Batch executes a RTR active-responder command across the hosts mapped to the given batch ID.
  - [BatchCmd](/api-reference/collections/real-time-response/#batchcmd): Batch executes a RTR read-only command across the hosts mapped to the given batch ID.
  - [BatchGetCmdStatus](/api-reference/collections/real-time-response/#batchgetcmdstatus): Retrieves the status of the specified batch get command. Will return successful files when they are finished processing.
  - [BatchGetCmd](/api-reference/collections/real-time-response/#batchgetcmd): Batch executes `get` command across hosts to retrieve files. After this call is made [BatchGetCmdStatus](#batchgetcmdstatus) is used to query for the results.
  - [BatchInitSessions](/api-reference/collections/real-time-response/#batchinitsessions): Batch initialize a RTR session on multiple hosts. Before any RTR commands can be used, an active session is needed on the host.
  - [BatchRefreshSessions](/api-reference/collections/real-time-response/#batchrefreshsessions): Batch refresh a RTR session on multiple hosts. RTR sessions will expire after 5 minutes unless refreshed.
  - [RTR_CheckActiveResponderCommandStatus](/api-reference/collections/real-time-response/#rtr_checkactiverespondercommandstatus): Get status of an executed active-responder command on a single host.
  - [RTR_ExecuteActiveResponderCommand](/api-reference/collections/real-time-response/#rtr_executeactiverespondercommand): Execute an active responder command on a single host.
  - [RTR_CheckCommandStatus](/api-reference/collections/real-time-response/#rtr_checkcommandstatus): Get status of an executed command on a single host.
  - [RTR_ExecuteCommand](/api-reference/collections/real-time-response/#rtr_executecommand): Execute a command on a single host.
  - [RTR_GetExtractedFileContents](/api-reference/collections/real-time-response/#rtr_getextractedfilecontents): Get RTR extracted file contents for specified session and sha256.
  - [RTR_ListFiles](/api-reference/collections/real-time-response/#rtr_listfiles): Get a list of files for the specified RTR session.
  - [RTR_ListFilesV2](/api-reference/collections/real-time-response/#rtr_listfilesv2): Get a list of files for the specified RTR session.
  - [RTR_DeleteFile](/api-reference/collections/real-time-response/#rtr_deletefile): Delete a RTR session file.
  - [RTR_DeleteFileV2](/api-reference/collections/real-time-response/#rtr_deletefilev2): Delete a RTR session file.
  - [RTR_ListQueuedSessions](/api-reference/collections/real-time-response/#rtr_listqueuedsessions): Get queued session metadata by session ID.
  - [RTR_DeleteQueuedSession](/api-reference/collections/real-time-response/#rtr_deletequeuedsession): Delete a queued session command.
  - [RTR_PulseSession](/api-reference/collections/real-time-response/#rtr_pulsesession): Refresh a session timeout on a single host.
  - [RTR_ListSessions](/api-reference/collections/real-time-response/#rtr_listsessions): Get session metadata by session id.
  - [RTR_InitSession](/api-reference/collections/real-time-response/#rtr_initsession): Initialize a new session with the RTR cloud.
  - [RTR_DeleteSession](/api-reference/collections/real-time-response/#rtr_deletesession): Delete a session.
  - [RTR_ListAllSessions](/api-reference/collections/real-time-response/#rtr_listallsessions): Get a list of session_ids.
- [Real Time Response Admin](/api-reference/collections/real-time-response-admin/): 20 operations
  - [BatchAdminCmd](/api-reference/collections/real-time-response-admin/#batchadmincmd): Batch executes a RTR administrator command across the hosts mapped to the given batch ID.
  - [RTR_CheckAdminCommandStatus](/api-reference/collections/real-time-response-admin/#rtr_checkadmincommandstatus): Get status of an executed RTR administrator command on a single host.
  - [RTR_ExecuteAdminCommand](/api-reference/collections/real-time-response-admin/#rtr_executeadmincommand): Execute a RTR administrator command on a single host.
  - [RTR_GetFalconScripts](/api-reference/collections/real-time-response-admin/#rtr_getfalconscripts): Get Falcon scripts with metadata and content of script
  - [RTR_GetPut_Files](/api-reference/collections/real-time-response-admin/#rtr_getput_files): Get put-files based on the ID's given. These are used for the RTR `put` command.
  - [RTR_GetPut_FilesV2](/api-reference/collections/real-time-response-admin/#rtr_getput_filesv2): Get put-files based on the ID's given. These are used for the RTR `put` command.
  - [RTR_GetPutFileContents](/api-reference/collections/real-time-response-admin/#rtr_getputfilecontents): Get the contents of a put-file based on the ID given.
  - [RTR_CreatePut_Files](/api-reference/collections/real-time-response-admin/#rtr_createput_files): Upload a new put-file to use for the RTR `put` command.
  - [RTR_CreatePut_FilesV2](/api-reference/collections/real-time-response-admin/#rtr_createput_filesv2): Upload a new put-file to use for the RTR `put` command.
  - [RTR_DeletePut_Files](/api-reference/collections/real-time-response-admin/#rtr_deleteput_files): Delete a put-file based on the ID given.  Can only delete one file at a time.
  - [RTR_GetScripts](/api-reference/collections/real-time-response-admin/#rtr_getscripts): Get custom-scripts based on the ID's given. These are used for the RTR `runscript` command.
  - [RTR_GetScriptsV2](/api-reference/collections/real-time-response-admin/#rtr_getscriptsv2): Get custom-scripts based on the ID's given. These are used for the RTR `runscript` command.
  - [RTR_ListFalconScripts](/api-reference/collections/real-time-response-admin/#rtr_listfalconscripts): Get a list of Falcon script IDs available to the user to run
  - [RTR_CreateScripts](/api-reference/collections/real-time-response-admin/#rtr_createscripts): Upload a new custom-script to use for the RTR `runscript` command.
  - [RTR_CreateScriptsV2](/api-reference/collections/real-time-response-admin/#rtr_createscriptsv2): Upload a new custom-script to use for the RTR `runscript` command.
  - [RTR_DeleteScripts](/api-reference/collections/real-time-response-admin/#rtr_deletescripts): Delete a custom-script based on the ID given.  Can only delete one script at a time.
  - [RTR_UpdateScripts](/api-reference/collections/real-time-response-admin/#rtr_updatescripts): Upload a new scripts to replace an existing one.
  - [RTR_UpdateScriptsV2](/api-reference/collections/real-time-response-admin/#rtr_updatescriptsv2): Upload a new scripts to replace an existing one.
  - [RTR_ListPut_Files](/api-reference/collections/real-time-response-admin/#rtr_listput_files): Get a list of put-file ID's that are available to the user for the `put` command.
  - [RTR_ListScripts](/api-reference/collections/real-time-response-admin/#rtr_listscripts): Get a list of custom-script ID's that are available to the user for the `runscript` command.
- [Real Time Response Audit](/api-reference/collections/real-time-response-audit/): 1 operations
  - [RTRAuditSessions](/api-reference/collections/real-time-response-audit/#rtrauditsessions): Get all the RTR sessions created for a customer in a specified duration
- [Recon](/api-reference/collections/recon/): 26 operations
  - [AggregateNotificationsExposedDataRecordsV1](/api-reference/collections/recon/#aggregatenotificationsexposeddatarecordsv1): Get notification exposed data record aggregates as specified via JSON in request body.
  - [AggregateNotificationsV1](/api-reference/collections/recon/#aggregatenotificationsv1): Get notification aggregates as specified via JSON in request body.
  - [PreviewRuleV1](/api-reference/collections/recon/#previewrulev1): Preview rules notification count and distribution. This will return aggregations on: channel, count, site.
  - [GetActionsV1](/api-reference/collections/recon/#getactionsv1): Get actions based on their IDs. IDs can be retrieved using the [QueryActionsV1](#queryactionsv1) operation.
  - [CreateActionsV1](/api-reference/collections/recon/#createactionsv1): Create actions for a monitoring rule. Accepts a list of actions that will be attached to the monitoring rule.
  - [DeleteActionV1](/api-reference/collections/recon/#deleteactionv1): Delete an action from a monitoring rule based on the action ID.
  - [UpdateActionV1](/api-reference/collections/recon/#updateactionv1): Update an action for a monitoring rule.
  - [GetFileContentForExportJobsV1](/api-reference/collections/recon/#getfilecontentforexportjobsv1): Download the file associated with a job ID.
  - [GetExportJobsV1](/api-reference/collections/recon/#getexportjobsv1): Get the status of export jobs based on their IDs. Export jobs can be launched by calling [CreateExportJobsV1](#createexportjobsv1). When a job is complete, use the job ID to download the file(s) associated with it using [GetFileContentForExportJobsV1](#getfilecontentforexportjobsv1).
  - [CreateExportJobsV1](/api-reference/collections/recon/#createexportjobsv1): Launch asynchronous export job. Use the job ID to poll the status of the job using [GetExportJobsV1](#getexportjobsv1).
  - [DeleteExportJobsV1](/api-reference/collections/recon/#deleteexportjobsv1): Delete export jobs (and their associated file(s)) based on their IDs.
  - [GetNotificationsDetailedTranslatedV1](/api-reference/collections/recon/#getnotificationsdetailedtranslatedv1): Get detailed notifications based on their IDs. These include the raw intelligence content that generated the match. This endpoint will return translated notification content. The only target language available is English. A single notification can be translated per request.
  - [GetNotificationsDetailedV1](/api-reference/collections/recon/#getnotificationsdetailedv1): Get detailed notifications based on their IDs. These include the raw intelligence content that generated the match.
  - [GetNotificationsExposedDataRecordsV1](/api-reference/collections/recon/#getnotificationsexposeddatarecordsv1): Get notifications exposed data records based on their IDs. IDs can be retrieved using the [QueryNotificationsExposedDataRecordsV1](#querynotificationsexposeddatarecordsv1) operation. The associated notification can be fetched using the notifications operations.
  - [GetNotificationsTranslatedV1](/api-reference/collections/recon/#getnotificationstranslatedv1): Get notifications based on their IDs. IDs can be retrieved using the [QueryNotificationsV1](#querynotificationsv1) operation. This endpoint will return translated notification content. The only target language available is English.
  - [GetNotificationsV1](/api-reference/collections/recon/#getnotificationsv1): Get notifications based on their IDs. IDs can be retrieved using the [QueryNotificationsV1](#querynotificationsv1) operation.
  - [DeleteNotificationsV1](/api-reference/collections/recon/#deletenotificationsv1): Delete notifications based on IDs. Notifications cannot be recovered after they are deleted.
  - [UpdateNotificationsV1](/api-reference/collections/recon/#updatenotificationsv1): Update notification status or assignee. Accepts bulk requests.
  - [GetRulesV1](/api-reference/collections/recon/#getrulesv1): Get monitoring rules rules by provided IDs.
  - [CreateRulesV1](/api-reference/collections/recon/#createrulesv1): Create monitoring rules.
  - [DeleteRulesV1](/api-reference/collections/recon/#deleterulesv1): Delete monitoring rules.
  - [UpdateRulesV1](/api-reference/collections/recon/#updaterulesv1): Update monitoring rules.
  - [QueryActionsV1](/api-reference/collections/recon/#queryactionsv1): Query actions based on provided criteria. Use the IDs from this response to get the action entities on [GetActionsV1](#getactionsv1).
  - [QueryNotificationsExposedDataRecordsV1](/api-reference/collections/recon/#querynotificationsexposeddatarecordsv1): Query notifications exposed data records based on provided criteria. Use the IDs from this response to get the notification entities on [GetNotificationsExposedDataRecordsV1](#getnotificationsexposeddatarecordsv1).
  - [QueryNotificationsV1](/api-reference/collections/recon/#querynotificationsv1): Query notifications based on provided criteria. Use the IDs from this response to get the notification entities on [GetNotificationsV1](#getnotificationsv1) or [GetNotificationsDetailedV1](#getnotificationsdetailedv1).
  - [QueryRulesV1](/api-reference/collections/recon/#queryrulesv1): Query monitoring rules based on provided criteria. Use the IDs from this response to fetch the rules on [GetRulesV1](#getrulesv1).
- [Report Executions](/api-reference/collections/report-executions/): 4 operations
  - [report_executions_download_get](/api-reference/collections/report-executions/#report_executions_download_get): Get report entity download
  - [report_executions_retry](/api-reference/collections/report-executions/#report_executions_retry): Retry the execution of a report by ID.
  - [report_executions_get](/api-reference/collections/report-executions/#report_executions_get): Retrieve report details for the provided report IDs.
  - [report_executions_query](/api-reference/collections/report-executions/#report_executions_query): Find all report execution IDs matching the query with filter
- [Response Policies](/api-reference/collections/response-policies/): 10 operations
  - [queryCombinedRTResponsePolicyMembers](/api-reference/collections/response-policies/#querycombinedrtresponsepolicymembers): Search for members of a Response policy in your environment by providing a FQL filter and paging details. Returns a set of host details which match the filter criteria
  - [queryCombinedRTResponsePolicies](/api-reference/collections/response-policies/#querycombinedrtresponsepolicies): Search for Response Policies in your environment by providing a FQL filter and paging details. Returns a set of Response Policies which match the filter criteria
  - [performRTResponsePoliciesAction](/api-reference/collections/response-policies/#performrtresponsepoliciesaction): Perform the specified action on the Response Policies specified in the request
  - [setRTResponsePoliciesPrecedence](/api-reference/collections/response-policies/#setrtresponsepoliciesprecedence): Sets the precedence of Response Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence
  - [getRTResponsePolicies](/api-reference/collections/response-policies/#getrtresponsepolicies): Retrieve a set of Response Policies by specifying their IDs
  - [createRTResponsePolicies](/api-reference/collections/response-policies/#creatertresponsepolicies): Create Response Policies by specifying details about the policy to create
  - [deleteRTResponsePolicies](/api-reference/collections/response-policies/#deletertresponsepolicies): Delete a set of Response Policies by specifying their IDs
  - [updateRTResponsePolicies](/api-reference/collections/response-policies/#updatertresponsepolicies): Update Response Policies by specifying the ID of the policy and details to update
  - [queryRTResponsePolicyMembers](/api-reference/collections/response-policies/#queryrtresponsepolicymembers): Search for members of a Response policy in your environment by providing a FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria
  - [queryRTResponsePolicies](/api-reference/collections/response-policies/#queryrtresponsepolicies): Search for Response Policies in your environment by providing a FQL filter with sort and/or paging details. This returns a set of Response Policy IDs that match the given criteria.
- [SaaS Security](/api-reference/collections/saas-security/): 21 operations
  - [DismissAffectedEntityV3](/api-reference/collections/saas-security/#dismissaffectedentityv3): Dismiss affected entity for a security check.
  - [DismissSecurityCheckV3](/api-reference/collections/saas-security/#dismisssecuritycheckv3): Dismiss security check by ID.
  - [GetActivityMonitorV3](/api-reference/collections/saas-security/#getactivitymonitorv3): Get activity monitor data for SaaS security monitoring.
  - [GetAlertsV3](/api-reference/collections/saas-security/#getalertsv3): Get alerts for SaaS security monitoring.
  - [GetAppInventory](/api-reference/collections/saas-security/#getappinventory): Get application inventory data.
  - [GetAppInventoryUsers](/api-reference/collections/saas-security/#getappinventoryusers): Get application inventory users for a specific application.
  - [GetAssetInventoryV3](/api-reference/collections/saas-security/#getassetinventoryv3): Get data inventory from SaaS security monitoring.
  - [GetDeviceInventoryV3](/api-reference/collections/saas-security/#getdeviceinventoryv3): Get device inventory from SaaS security monitoring.
  - [GetIntegrationsV3](/api-reference/collections/saas-security/#getintegrationsv3): Get integrations configured for SaaS security monitoring.
  - [GetMetricsV3](/api-reference/collections/saas-security/#getmetricsv3): Get metrics for SaaS security checks and exposures.
  - [GetSecurityCheckAffectedV3](/api-reference/collections/saas-security/#getsecuritycheckaffectedv3): Get affected resources for security checks.
  - [GetSecurityCheckComplianceV3](/api-reference/collections/saas-security/#getsecuritycheckcompliancev3): Get security check compliance information.
  - [GetSecurityChecksV3](/api-reference/collections/saas-security/#getsecuritychecksv3): Get security checks from SaaS security monitoring.
  - [GetSupportedSaasV3](/api-reference/collections/saas-security/#getsupportedsaasv3): Get supported SaaS applications for security monitoring.
  - [GetSystemLogsV3](/api-reference/collections/saas-security/#getsystemlogsv3): Get system logs from SaaS security monitoring.
  - [GetSystemUsersV3](/api-reference/collections/saas-security/#getsystemusersv3): Get system users from SaaS security monitoring.
  - [GetUserInventoryV3](/api-reference/collections/saas-security/#getuserinventoryv3): Get user inventory from SaaS security monitoring.
  - [IntegrationBuilderEndTransactionV3](/api-reference/collections/saas-security/#integrationbuilderendtransactionv3): End data upload transaction for custom integration.
  - [IntegrationBuilderGetStatusV3](/api-reference/collections/saas-security/#integrationbuildergetstatusv3): Get status of custom integration builder.
  - [IntegrationBuilderResetV3](/api-reference/collections/saas-security/#integrationbuilderresetv3): Reset custom integration builder.
  - [IntegrationBuilderUploadV3](/api-reference/collections/saas-security/#integrationbuilderuploadv3): Upload data for custom integration builder.
- [Sample Uploads](/api-reference/collections/sample-uploads/): 11 operations
  - [ArchiveListV1](/api-reference/collections/sample-uploads/#archivelistv1): Retrieves the archives files in chunks.
  - [ArchiveGetV1](/api-reference/collections/sample-uploads/#archivegetv1): Retrieves the archives upload operation statuses. Status `done` means that archive was processed successfully. Status `error` means that archive was not processed successfully.
  - [ArchiveUploadV1](/api-reference/collections/sample-uploads/#archiveuploadv1): Uploads an archive and extracts files list from it. Operation is asynchronous use [ArchiveGetV1](#archivegetv1) to check the status. After uploading, use [ExtractionCreateV1](#extractioncreatev1) to copy the file to internal storage making it available for content analysis.
  - [ArchiveDeleteV1](/api-reference/collections/sample-uploads/#archivedeletev1): Delete an archive that was uploaded previously
  - [ArchiveUploadV2](/api-reference/collections/sample-uploads/#archiveuploadv2): Uploads an archive and extracts files list from it. Operation is asynchronous use [ArchiveGetV1](#archivegetv1) to check the status. After uploading, use [ExtractionCreateV1](#extractioncreatev1) to copy the file to internal storage making it available for content analysis.
  - [ExtractionListV1](/api-reference/collections/sample-uploads/#extractionlistv1): Retrieves the files extractions in chunks. Status `done` means that all files were processed successfully. Status `error` means that at least one of the file could not be processed.
  - [ExtractionGetV1](/api-reference/collections/sample-uploads/#extractiongetv1): Retrieves the files extraction operation statuses. Status `done` means that all files were processed successfully. Status `error` means that at least one of the file could not be processed.
  - [ExtractionCreateV1](/api-reference/collections/sample-uploads/#extractioncreatev1): Extracts files from an uploaded archive and copies them to internal storage making it available for content analysis.
  - [GetSampleV3](/api-reference/collections/sample-uploads/#getsamplev3): Retrieves the file associated with the given ID (SHA256).
  - [UploadSampleV3](/api-reference/collections/sample-uploads/#uploadsamplev3): Upload a file for further cloud analysis. After uploading, call the specific analysis API endpoint.
  - [DeleteSampleV3](/api-reference/collections/sample-uploads/#deletesamplev3): Removes a sample, including file, meta and submissions from the collection.
- [Scheduled Reports](/api-reference/collections/scheduled-reports/): 3 operations
  - [scheduled_reports_launch](/api-reference/collections/scheduled-reports/#scheduled_reports_launch): Launch scheduled report executions for the provided ID(s).
  - [scheduled_reports_get](/api-reference/collections/scheduled-reports/#scheduled_reports_get): Retrieve scheduled reports for the provided report IDs.
  - [scheduled_reports_query](/api-reference/collections/scheduled-reports/#scheduled_reports_query): Find all report IDs matching the query with filter
- [Sensor Download](/api-reference/collections/sensor-download/): 13 operations
  - [GetCombinedSensorInstallersByQuery](/api-reference/collections/sensor-download/#getcombinedsensorinstallersbyquery): Get sensor installer details by provided query
  - [GetCombinedSensorInstallersByQueryV2](/api-reference/collections/sensor-download/#getcombinedsensorinstallersbyqueryv2): Get sensor installer details by provided query
  - [GetCombinedSensorInstallersByQueryV3](/api-reference/collections/sensor-download/#getcombinedsensorinstallersbyqueryv3): Get sensor installer details by provided query
  - [DownloadSensorInstallerById](/api-reference/collections/sensor-download/#downloadsensorinstallerbyid): Download sensor installer by SHA256 ID
  - [DownloadSensorInstallerByIdV2](/api-reference/collections/sensor-download/#downloadsensorinstallerbyidv2): Download sensor installer by SHA256 ID
  - [DownloadSensorInstallerByIdV3](/api-reference/collections/sensor-download/#downloadsensorinstallerbyidv3): Download sensor installer by SHA256 ID
  - [GetSensorInstallersEntities](/api-reference/collections/sensor-download/#getsensorinstallersentities): Get sensor installer details by provided SHA256 IDs
  - [GetSensorInstallersEntitiesV2](/api-reference/collections/sensor-download/#getsensorinstallersentitiesv2): Get sensor installer details by provided SHA256 IDs
  - [GetSensorInstallersEntitiesV3](/api-reference/collections/sensor-download/#getsensorinstallersentitiesv3): Get sensor installer details by provided SHA256 IDs
  - [GetSensorInstallersCCIDByQuery](/api-reference/collections/sensor-download/#getsensorinstallersccidbyquery): Get CCID to use with sensor installers
  - [GetSensorInstallersByQuery](/api-reference/collections/sensor-download/#getsensorinstallersbyquery): Get sensor installer IDs by provided query
  - [GetSensorInstallersByQueryV2](/api-reference/collections/sensor-download/#getsensorinstallersbyqueryv2): Get sensor installer IDs by provided query
  - [GetSensorInstallersByQueryV3](/api-reference/collections/sensor-download/#getsensorinstallersbyqueryv3): Get sensor installer IDs by provided query
- [Sensor Update Policy](/api-reference/collections/sensor-update-policy/): 19 operations
  - [revealUninstallToken](/api-reference/collections/sensor-update-policy/#revealuninstalltoken): Reveals an uninstall token for a specific device or the bulk maintenance token.
  - [incrementUninstallToken](/api-reference/collections/sensor-update-policy/#incrementuninstalltoken): Increment a bulk maintenance token.
  - [queryCombinedSensorUpdateBuilds](/api-reference/collections/sensor-update-policy/#querycombinedsensorupdatebuilds): Retrieve available builds for use with Sensor Update Policies.
  - [queryCombinedSensorUpdateKernels](/api-reference/collections/sensor-update-policy/#querycombinedsensorupdatekernels): Retrieve kernel compatibility info for Sensor Update Builds.
  - [queryCombinedSensorUpdatePolicyMembers](/api-reference/collections/sensor-update-policy/#querycombinedsensorupdatepolicymembers): Search for members of a Sensor Update Policy in your environment by providing a FQL filter and paging details. Returns a set of host details which match the filter criteria.
  - [queryCombinedSensorUpdatePolicies](/api-reference/collections/sensor-update-policy/#querycombinedsensorupdatepolicies): Search for Sensor Update Policies in your environment by providing a FQL filter and paging details. Returns a set of Sensor Update Policies which match the filter criteria.
  - [queryCombinedSensorUpdatePoliciesV2](/api-reference/collections/sensor-update-policy/#querycombinedsensorupdatepoliciesv2): Search for Sensor Update Policies with additional support for uninstall protection in your environment by providing a FQL filter and paging details. Returns a set of Sensor Update Policies which match the filter criteria.
  - [performSensorUpdatePoliciesAction](/api-reference/collections/sensor-update-policy/#performsensorupdatepoliciesaction): Perform the specified action on the Sensor Update Policies specified in the request.
  - [setSensorUpdatePoliciesPrecedence](/api-reference/collections/sensor-update-policy/#setsensorupdatepoliciesprecedence): Sets the precedence of Sensor Update Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence.
  - [getSensorUpdatePolicies](/api-reference/collections/sensor-update-policy/#getsensorupdatepolicies): Retrieve a set of Sensor Update Policies by specifying their IDs.
  - [createSensorUpdatePolicies](/api-reference/collections/sensor-update-policy/#createsensorupdatepolicies): Create Sensor Update Policies by specifying details about the policy to create.
  - [deleteSensorUpdatePolicies](/api-reference/collections/sensor-update-policy/#deletesensorupdatepolicies): Delete a set of Sensor Update Policies by specifying their IDs.
  - [updateSensorUpdatePolicies](/api-reference/collections/sensor-update-policy/#updatesensorupdatepolicies): Update Sensor Update Policies by specifying the ID of the policy and details to update.
  - [getSensorUpdatePoliciesV2](/api-reference/collections/sensor-update-policy/#getsensorupdatepoliciesv2): Retrieve a set of Sensor Update Policies with additional support for uninstall protection by specifying their IDs.
  - [createSensorUpdatePoliciesV2](/api-reference/collections/sensor-update-policy/#createsensorupdatepoliciesv2): Create Sensor Update Policies by specifying details about the policy to create with additional support for uninstall protection.
  - [updateSensorUpdatePoliciesV2](/api-reference/collections/sensor-update-policy/#updatesensorupdatepoliciesv2): Update Sensor Update Policies by specifying the ID of the policy and details to update with additional support for uninstall protection.
  - [querySensorUpdateKernelsDistinct](/api-reference/collections/sensor-update-policy/#querysensorupdatekernelsdistinct): Retrieve kernel compatibility info for Sensor Update Builds.
  - [querySensorUpdatePolicyMembers](/api-reference/collections/sensor-update-policy/#querysensorupdatepolicymembers): Search for members of a Sensor Update Policy in your environment by providing a FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria.
  - [querySensorUpdatePolicies](/api-reference/collections/sensor-update-policy/#querysensorupdatepolicies): Search for Sensor Update Policies in your environment by providing a FQL filter and paging details. Returns a set of Sensor Update Policy IDs which match the filter criteria.
- [Sensor Usage](/api-reference/collections/sensor-usage/): 2 operations
  - [GetSensorUsageHourly](/api-reference/collections/sensor-usage/#getsensorusagehourly): Fetches hourly average. Each data point represents the average of how many unique AIDs were seen per hour for the previous 28 days.
  - [GetSensorUsageWeekly](/api-reference/collections/sensor-usage/#getsensorusageweekly): Fetches weekly average. Each data point represents the average of how many unique AIDs were seen per week for the previous 28 days.
- [Sensor Visibility Exclusions](/api-reference/collections/sensor-visibility-exclusions/): 5 operations
  - [getSensorVisibilityExclusionsV1](/api-reference/collections/sensor-visibility-exclusions/#getsensorvisibilityexclusionsv1): Get a set of Sensor Visibility Exclusions by specifying their IDs
  - [createSVExclusionsV1](/api-reference/collections/sensor-visibility-exclusions/#createsvexclusionsv1): Create the sensor visibility exclusions
  - [deleteSensorVisibilityExclusionsV1](/api-reference/collections/sensor-visibility-exclusions/#deletesensorvisibilityexclusionsv1): Delete the sensor visibility exclusions by id
  - [updateSensorVisibilityExclusionsV1](/api-reference/collections/sensor-visibility-exclusions/#updatesensorvisibilityexclusionsv1): Update the sensor visibility exclusions
  - [querySensorVisibilityExclusionsV1](/api-reference/collections/sensor-visibility-exclusions/#querysensorvisibilityexclusionsv1): Search for sensor visibility exclusions.
- [Serverless Exports](/api-reference/collections/serverless-exports/): 4 operations
  - [ReadExportJobsMixin0](/api-reference/collections/serverless-exports/#readexportjobsmixin0): Read export jobs entities.
  - [QueryExportJobsMixin0](/api-reference/collections/serverless-exports/#queryexportjobsmixin0): Query export jobs entities.
  - [DownloadExportFileMixin0](/api-reference/collections/serverless-exports/#downloadexportfilemixin0): Download an export file.
  - [LaunchExportJobMixin0](/api-reference/collections/serverless-exports/#launchexportjobmixin0): Launch an export job of a Lambda Security resource. Maximum of 1 job in progress per resource. Use expand_vulnerabilities=true to get detailed vulnerability information.
- [Serverless Vulnerabilities](/api-reference/collections/serverless-vulnerabilities/): 1 operations
  - [GetCombinedVulnerabilitiesSARIF](/api-reference/collections/serverless-vulnerabilities/#getcombinedvulnerabilitiessarif): Retrieve all lambda vulnerabilities that match the given query and return in the SARIF format.
- [Spotlight Evaluation Logic](/api-reference/collections/spotlight-evaluation-logic/): 4 operations
  - [combinedQueryEvaluationLogic](/api-reference/collections/spotlight-evaluation-logic/#combinedqueryevaluationlogic): Search for evaluation logic in your environment by providing a FQL filter and paging details. Returns a set of evaluation logic entities which match the filter criteria.
  - [combinedSupportedEvaluationExt](/api-reference/collections/spotlight-evaluation-logic/#combinedsupportedevaluationext): Perform a combined query and get for RiskSupportedEvaluation entities.
  - [getEvaluationLogic](/api-reference/collections/spotlight-evaluation-logic/#getevaluationlogic): Get details on evaluation logic items by providing one or more IDs.
  - [queryEvaluationLogic](/api-reference/collections/spotlight-evaluation-logic/#queryevaluationlogic): Search for evaluation logic in your environment by providing a FQL filter and paging details. Returns a set of evaluation logic IDs which match the filter criteria.
- [Spotlight Vulnerabilities](/api-reference/collections/spotlight-vulnerabilities/): 5 operations
  - [combinedQueryVulnerabilities](/api-reference/collections/spotlight-vulnerabilities/#combinedqueryvulnerabilities): Search for Vulnerabilities in your environment by providing a FQL filter and paging details. Returns a set of Vulnerability entities which match the filter criteria.
  - [getRemediationsV2](/api-reference/collections/spotlight-vulnerabilities/#getremediationsv2): Get details on remediation by providing one or more IDs.
  - [getVulnerabilities](/api-reference/collections/spotlight-vulnerabilities/#getvulnerabilities): Get details on vulnerabilities by providing one or more IDs.
  - [queryVulnerabilities](/api-reference/collections/spotlight-vulnerabilities/#queryvulnerabilities): Search for Vulnerabilities in your environment by providing a FQL filter and paging details. Returns a set of Vulnerability IDs which match the filter criteria.
  - [getRemediations](/api-reference/collections/spotlight-vulnerabilities/#getremediations): Get details on remediations by providing one or more IDs.
- [Spotlight Vulnerability Metadata](/api-reference/collections/spotlight-vulnerability-metadata/): 1 operations
  - [combineVulnMetadataExt](/api-reference/collections/spotlight-vulnerability-metadata/#combinevulnmetadataext): Perform a combined query and get operation for retrieving Risk (vulnerability metadata) entities.
- [Tailored Intelligence](/api-reference/collections/tailored-intelligence/): 5 operations
  - [GetEventsBody](/api-reference/collections/tailored-intelligence/#geteventsbody): Get event body for the provided event ID.
  - [GetEventsEntities](/api-reference/collections/tailored-intelligence/#geteventsentities): Get events entities for specified ids.
  - [QueryEvents](/api-reference/collections/tailored-intelligence/#queryevents): Get events ids that match the provided filter criteria.
  - [GetRulesEntities](/api-reference/collections/tailored-intelligence/#getrulesentities): Get rules entities for specified ids.
  - [QueryRules](/api-reference/collections/tailored-intelligence/#queryrules): Get rules ids that match the provided filter criteria.
- [ThreatGraph](/api-reference/collections/threatgraph/): 6 operations
  - [combined_edges_get](/api-reference/collections/threatgraph/#combined_edges_get): Retrieve edges for a given vertex id.  One edge type must be specified.
  - [combined_ran_on_get](/api-reference/collections/threatgraph/#combined_ran_on_get): Look up instances of indicators such as hashes, domain names, and ip addresses that have been seen on devices in your environment.
  - [combined_summary_get](/api-reference/collections/threatgraph/#combined_summary_get): Retrieve summary for a given vertex ID.
  - [entities_vertices_get](/api-reference/collections/threatgraph/#entities_vertices_get): Retrieve metadata for a given vertex ID.
  - [entities_vertices_getv2](/api-reference/collections/threatgraph/#entities_vertices_getv2): Retrieve metadata for a given vertex ID.
  - [queries_edgetypes_get](/api-reference/collections/threatgraph/#queries_edgetypes_get): Show all available edge types.
- [Unidentified Containers](/api-reference/collections/unidentified-containers/): 3 operations
  - [ReadUnidentifiedContainersByDateRangeCount](/api-reference/collections/unidentified-containers/#readunidentifiedcontainersbydaterangecount): Returns the count of Unidentified Containers over the last 7 days
  - [ReadUnidentifiedContainersCount](/api-reference/collections/unidentified-containers/#readunidentifiedcontainerscount): Returns the total count of Unidentified Containers over a time period
  - [SearchAndReadUnidentifiedContainers](/api-reference/collections/unidentified-containers/#searchandreadunidentifiedcontainers): Search Unidentified Containers by the provided search criteria
- [User Management](/api-reference/collections/user-management/): 25 operations
  - [aggregateUsersV1](/api-reference/collections/user-management/#aggregateusersv1): Get user aggregates as specified via json in request body.
  - [GetRoles](/api-reference/collections/user-management/#getroles): Get info about a role
  - [combinedUserRolesV1](/api-reference/collections/user-management/#combineduserrolesv1): Get User Grant(s). This operation lists both direct as well as flight control grants between a User and a Customer.
  - [CombinedUserRolesV2](/api-reference/collections/user-management/#combineduserrolesv2): Get User Grant(s). This endpoint lists both direct as well as flight control grants between a User and a Customer.
  - [queriesRolesV1](/api-reference/collections/user-management/#queriesrolesv1): Show role IDs for all roles available in your customer account. Supports Flight Control.
  - [queryUserV1](/api-reference/collections/user-management/#queryuserv1): List user IDs for all users in your customer account.
  - [entitiesRolesV1](/api-reference/collections/user-management/#entitiesrolesv1): **DEPRECATED** : Please use [entitiesRolesGETV2](#entitiesrolesgetv2). Get information about a role, supports Flight Control.
  - [entitiesRolesGETV2](/api-reference/collections/user-management/#entitiesrolesgetv2): Get info about a role.
  - [userActionV1](/api-reference/collections/user-management/#useractionv1): Apply actions to one or more users.
  - [userRolesActionV1](/api-reference/collections/user-management/#userrolesactionv1): Grant or Revoke one or more role(s) to a user against a CID.
  - [GrantUserRoleIds](/api-reference/collections/user-management/#grantuserroleids): Assign one or more roles to a user
  - [RevokeUserRoleIds](/api-reference/collections/user-management/#revokeuserroleids): Revoke one or more roles from a user
  - [GetAvailableRoleIds](/api-reference/collections/user-management/#getavailableroleids): Show role IDs for all roles available in your customer account. For more information on each role, provide the role ID to [GetRoles](#getroles).
  - [GetUserRoleIds](/api-reference/collections/user-management/#getuserroleids): Show role IDs of roles assigned to a user. For more information on each role, provide the role ID to [GetRoles](#getroles).
  - [RetrieveUser](/api-reference/collections/user-management/#retrieveuser): Get info about a user
  - [retrieveUsersGETV1](/api-reference/collections/user-management/#retrieveusersgetv1): Get info about users including their name, UID and CID by providing user UUIDs.
  - [CreateUser](/api-reference/collections/user-management/#createuser): Create a new user. After creating a user, assign one or more roles with [GrantUserRoleIds](#grantuserroleids).
  - [createUserV1](/api-reference/collections/user-management/#createuserv1): Create a new user. Supports Flight Control. After creating a user, assign one or more roles with [userRolesActionV1](#userRolesActionV1).
  - [DeleteUser](/api-reference/collections/user-management/#deleteuser): Delete a user permanently
  - [deleteUserV1](/api-reference/collections/user-management/#deleteuserv1): Delete a user permanently. Supports Flight Control.
  - [UpdateUser](/api-reference/collections/user-management/#updateuser): Modify an existing user's first or last name
  - [updateUserV1](/api-reference/collections/user-management/#updateuserv1): Modify an existing user's first or last name. Supports Flight Control.
  - [RetrieveEmailsByCID](/api-reference/collections/user-management/#retrieveemailsbycid): List the usernames (usually an email address) for all users in your customer account
  - [RetrieveUserUUIDsByCID](/api-reference/collections/user-management/#retrieveuseruuidsbycid): List user IDs for all users in your customer account. For more information on each user, provide the user ID to [RetrieveUser](#retrieveuser).
  - [RetrieveUserUUID](/api-reference/collections/user-management/#retrieveuseruuid): Get a user's ID by providing a username (usually an email address)
- [Workflows](/api-reference/collections/workflows/): 20 operations
  - [WorkflowActivitiesCombined](/api-reference/collections/workflows/#workflowactivitiescombined): Search for activities by name. Returns all supported activities if no filter is specified.
  - [WorkflowActivitiesContentCombined](/api-reference/collections/workflows/#workflowactivitiescontentcombined): Search for activities by name. Returns all supported activities if no filter specified.
  - [WorkflowExecute](/api-reference/collections/workflows/#workflowexecute): Execute an on-demand workflow. Response will contain the execution ID.
  - [WorkflowExecuteInternal](/api-reference/collections/workflows/#workflowexecuteinternal): Execute an on-demand workflow. Response will contain the execution ID.
  - [WorkflowMockExecute](/api-reference/collections/workflows/#workflowmockexecute): Execute an on-demand workflow with mocks.
  - [WorkflowExecutionsAction](/api-reference/collections/workflows/#workflowexecutionsaction): Allows a user to resume/retry a failed workflow execution.
  - [WorkflowExecutionResults](/api-reference/collections/workflows/#workflowexecutionresults): Get execution result of a given execution
  - [WorkflowSystemDefinitionsDeProvision](/api-reference/collections/workflows/#workflowsystemdefinitionsdeprovision): Deprovisions a system definition that was previously provisioned on the target CID.
  - [WorkflowSystemDefinitionsPromote](/api-reference/collections/workflows/#workflowsystemdefinitionspromote): Promote a version of a system definition.
  - [WorkflowSystemDefinitionsProvision](/api-reference/collections/workflows/#workflowsystemdefinitionsprovision): Provisions a system definition onto the target CID by using the template and provided parameters.
  - [WorkflowDefinitionsCombined](/api-reference/collections/workflows/#workflowdefinitionscombined): Search workflow definitions based on the provided filter.
  - [WorkflowTriggersCombined](/api-reference/collections/workflows/#workflowtriggerscombined): Search for triggers by namespaced identifier, i.e. `FalconAudit`, `Detection`, or `FalconAudit/Detection/Status`. Returns all triggers if no filter is specified.
  - [WorkflowExecutionsCombined](/api-reference/collections/workflows/#workflowexecutionscombined): Search workflow executions based on the provided filter.
  - [WorkflowDefinitionsExport](/api-reference/collections/workflows/#workflowdefinitionsexport): Exports a workflow definition for the given definition ID.
  - [WorkflowDefinitionsImport](/api-reference/collections/workflows/#workflowdefinitionsimport): Imports a workflow definition based on the provided model
  - [WorkflowDefinitionsAction](/api-reference/collections/workflows/#workflowdefinitionsaction): Enable or disable a workflow definition, or stop all executions for a definition.
  - [WorkflowDefinitionsUpdate](/api-reference/collections/workflows/#workflowdefinitionsupdate): Updates a workflow definition based on the provided model.
  - [WorkflowGetHumanInputV1](/api-reference/collections/workflows/#workflowgethumaninputv1): Gets one or more specific human inputs by their IDs.
  - [WorkflowUpdateHumanInputV1](/api-reference/collections/workflows/#workflowupdatehumaninputv1): Provides an input in response to a human input action. Depending on action configuration, one or more of Approve, Decline, and/or Escalate are permitted.
  - [v1_child_executions_query](/api-reference/collections/workflows/#v1_child_executions_query): Search for child executions by providing a FQL filter and paging details. Returns the set of child workflow execution IDs which match the filter criteria.
- [Zero Trust Assessment](/api-reference/collections/zero-trust-assessment/): 4 operations
  - [getAssessmentV1](/api-reference/collections/zero-trust-assessment/#getassessmentv1): Get Zero Trust Assessment data for one or more hosts by providing agent IDs (AID) and a customer ID (CID).
  - [getAuditV1](/api-reference/collections/zero-trust-assessment/#getauditv1): Get the Zero Trust Assessment audit report for one customer ID (CID).
  - [getAssessmentsByScoreV1](/api-reference/collections/zero-trust-assessment/#getassessmentsbyscorev1): Get Zero Trust Assessment data for one or more hosts by providing a customer ID (CID) and a range of scores.
  - [getCombinedAssessmentsQuery](/api-reference/collections/zero-trust-assessment/#getcombinedassessmentsquery): Search for assessments in your environment by providing an FQL filter and paging details. Returns a set of HostFinding entities which match the filter criteria

## Use Cases

- [Automate Response](/accomplish/automate-response/): Execute commands on endpoints in real time, contain compromised hosts, and orchestrate response workflows at scale.
- [Deploy the Sensor](/accomplish/deploy-the-sensor/): Install, configure, and manage the CrowdStrike Falcon sensor across your infrastructure using configuration management, deployment automation, and scripted installation.
- [Hunt Vulnerabilities](/accomplish/hunt-vulnerabilities/): Pull CVE data from Spotlight, prioritize remediation with ExPRT ratings, and track exposure risk across your estate.
- [Investigate Threats](/accomplish/investigate-threats/): Triage alerts, search CrowdStrike threat intelligence, and correlate adversary behaviors across your environment using the CrowdStrike Falcon API.
- [Manage Your Fleet](/accomplish/manage-your-fleet/): Query hosts, track sensor health, manage device groups, and enforce policies across thousands of endpoints.
- [Secure the Cloud](/accomplish/secure-the-cloud/): Register cloud accounts, monitor containers, assess Kubernetes workloads, and track cloud security posture.
- [Stream & Analyze Data](/accomplish/stream-and-analyze-data/): Ingest events with NGSIEM, build real-time pipelines with Event Streams and FDR, and query petabytes of security telemetry with LogScale.

## Software Development Kits

- [Getting Started](/sdks/go/getting-started/): Installation, authentication, and quick start guide for the goFalcon Go SDK.
- [Go](/sdks/go/): goFalcon is the CrowdStrike Falcon SDK for Go.
- [Software Development Kits](/sdks/): Official CrowdStrike Falcon SDKs. Six languages, full API coverage.
- [Authentication](/sdks/powershell/authentication/): OAuth2 token management for the PSFalcon PowerShell module.
- [Filtering](/sdks/powershell/filtering/): Using Falcon Query Language (FQL) with PSFalcon commands.
- [PowerShell](/sdks/powershell/): PSFalcon is the CrowdStrike Falcon module for PowerShell.
- [Installation](/sdks/powershell/installation/): Installing, upgrading, and removing the PSFalcon PowerShell module.
- [Usage](/sdks/powershell/usage/): Importing, syntax, output handling, and pagination for the PSFalcon PowerShell module.
- [Authentication](/sdks/python/authentication/): Authentication methods for the FalconPy Python SDK.
- [Configuration](/sdks/python/configuration/): Environment configuration options for the FalconPy Python SDK.
- [Extensibility](/sdks/python/extensibility/): Extending and customizing FalconPy SDK functionality.
- [Colorize Text](/sdks/python/helpers/colorize-text/): ANSI color helper for terminal text output in the FalconPy Python SDK.
- [Lookup API Operation](/sdks/python/helpers/find-operation/): Search for CrowdStrike API operations by ID, route, or service collection.
- [HTTP Event Collector](/sdks/python/helpers/hec/): FalconPy helper class for ingesting data into Falcon Next-Gen SIEM.
- [Random String](/sdks/python/helpers/random-string/): Generate random strings with the FalconPy Python SDK.
- [Wait Indicator](/sdks/python/helpers/wait-indicator/): Terminal wait indicator animations for the FalconPy Python SDK.
- [Python](/sdks/python/): FalconPy is the CrowdStrike Falcon SDK for Python.
- [Installation](/sdks/python/installation/): Installing, upgrading, and removing the FalconPy Python SDK.
- [Logging](/sdks/python/logging/): Debug logging for the FalconPy Python SDK.
- [Payloads](/sdks/python/payloads/): Payload types and handling in the FalconPy Python SDK.
- [Responses](/sdks/python/responses/): Consuming API responses from the CrowdStrike Falcon API with the FalconPy Python SDK.
- [Service Classes](/sdks/python/service-classes/): Using FalconPy Service Classes for one-to-one API service collection access.
- [Glossary of Terms](/sdks/python/terminology/): Glossary of terms used in the FalconPy Python SDK documentation.
- [Uber Class](/sdks/python/uber-class/): Using the FalconPy Uber Class for all-in-one CrowdStrike API access.
- [Getting Started](/sdks/ruby/getting-started/): Installation, authentication, and quick start guide for the Crimson Falcon Ruby SDK.
- [Ruby](/sdks/ruby/): Crimson Falcon is the CrowdStrike Falcon SDK for Ruby.
- [Getting Started](/sdks/rust/getting-started/): Installation, authentication, and quick start guide for the Rusty Falcon Rust SDK.
- [Rust](/sdks/rust/): Rusty Falcon is the CrowdStrike Falcon SDK for Rust.
- [Getting Started](/sdks/typescript/getting-started/): Installation, authentication, and quick start guide for the FalconJS TypeScript SDK.
- [TypeScript](/sdks/typescript/): FalconJS is the CrowdStrike Falcon SDK for TypeScript and JavaScript.

## Falcon Foundry

- [App Catalog](/foundry/app-lifecycle/app-catalog/): View, install, update, and uninstall Foundry apps from the App Catalog.
- [Creating Apps](/foundry/app-lifecycle/creating-apps/): Create a new Foundry app from the Falcon console or the Foundry CLI.
- [Dependency Management](/foundry/app-lifecycle/dependency-management/): How Foundry manages dependencies between app artifacts and handles breaking changes.
- [Deploying Apps](/foundry/app-lifecycle/deploying-apps/): Deploy your Foundry app to the Falcon platform.
- [Import & Export](/foundry/app-lifecycle/import-export/): Export Foundry apps for source control and import them into other CIDs.
- [Managing Apps](/foundry/app-lifecycle/managing-apps/): View app details, manage deployments, and control app state.
- [Releasing Apps](/foundry/app-lifecycle/releasing-apps/): Release a deployed Foundry app to make it available for installation.
- [Versioning](/foundry/app-lifecycle/versioning/): How Foundry app versioning works and when updates are applied automatically.
- [About Authorization](/foundry/authorization/about-authorization/): How authorization works for Foundry apps — RBAC and API scopes.
- [API Scopes](/foundry/authorization/api-scopes/): Configure API scopes for Foundry app functions and workflows.
- [Role-Based Access Control](/foundry/authorization/rbac/): Foundry roles, permissions, and access assignment.
- [API Integrations](/foundry/data-capabilities/api-integrations/): Connect Foundry apps to external REST APIs and CrowdStrike APIs.
- [Collections](/foundry/data-capabilities/collections/): Store structured data natively on the Falcon platform with JSON Schema-based collections.
- [Queries](/foundry/data-capabilities/queries/): Embed LogScale queries and saved searches in Foundry apps.
- [Dashboards](/foundry/experience-capabilities/dashboards/): Build dashboard views with widgets that display query results.
- [UI Examples](/foundry/experience-capabilities/ui-examples/): Starter templates and live examples for Foundry UI development.
- [UI Extensions](/foundry/experience-capabilities/ui-extensions/): Add panels, tabs, and cards to existing Falcon console pages.
- [UI Pages](/foundry/experience-capabilities/ui-pages/): Create custom full-page experiences in the Falcon console.
- [Falcon Foundry AI Skills](/foundry/getting-started/ai-skills/): Build Falcon Foundry apps from a natural language prompt using AI coding assistant skills.
- [Quickstart: Foundry CLI](/foundry/getting-started/quickstart-cli/): Install the Foundry CLI, create your first app, and deploy from your terminal.
- [Quickstart: Falcon Console](/foundry/getting-started/quickstart-ui/): Build your first Foundry app using the Falcon console's visual app builder.
- [Falcon Foundry Samples](/foundry/getting-started/samples/): Open-source Falcon Foundry sample applications and integrations.
- [Functions: Foundry CLI](/foundry/logic-capabilities/functions-cli/): Develop, test, and deploy Foundry functions from the command line.
- [Functions Overview](/foundry/logic-capabilities/functions-overview/): Run serverless code on the Falcon platform in Python or Go.
- [Functions: UI Editor](/foundry/logic-capabilities/functions-ui-editor/): Write and test Python functions in the browser-based Foundry editor.
- [RTR Scripts](/foundry/logic-capabilities/rtr-scripts/): Include Real Time Response scripts in Foundry apps.
- [Workflow Debugging & Testing](/foundry/logic-capabilities/workflow-debugging/): Debug and test Fusion SOAR workflows in Foundry apps.
- [Workflow Templates](/foundry/logic-capabilities/workflow-templates/): Build Fusion SOAR workflow templates in Foundry apps.
- [App Documentation](/foundry/reference/app-docs/): Create and manage README documentation for Foundry apps.
- [App Manifest Reference](/foundry/reference/app-manifest/): Complete reference for the Foundry app manifest.yml schema.
- [CLI Reference](/foundry/reference/cli-reference/): Complete command reference for the Foundry CLI.
- [UI Kit](/foundry/reference/ui-kit/): Component library for building Foundry UI extensions and pages.
- [Tutorial: Custom SOAR Action](/foundry/tutorials/custom-soar-action/): Build a Foundry app that integrates an external API as a custom Fusion SOAR action.
- [Tutorial: Deploy an App Template](/foundry/tutorials/deploy-app-template/): Deploy a pre-built Foundry app template from the Content Library in 5 steps.
- [Tutorial: Detection Enrichment App](/foundry/tutorials/detection-enrichment/): Build a no-code detection enrichment app using the Foundry Extension Builder.
- [Tutorial: Push Data Connector](/foundry/tutorials/push-data-connector/): Build a Foundry function that ingests custom data into Falcon Next-Gen SIEM.
- [Tutorial: Threat Hunting Dashboard](/foundry/tutorials/threat-hunting-dashboard/): Build a Foundry dashboard with query widgets and a scheduled report.
- [Understanding Foundry](/foundry/understanding-foundry/): Build custom apps, API integrations, and automated workflows directly on the CrowdStrike Falcon platform.

## Falcon MCP

- [Changelog](/falcon-mcp/changelog/): Release history for the Falcon MCP Server.
- [Amazon Bedrock](/falcon-mcp/deployment/amazon-bedrock/): Deploy the Falcon MCP Server to Amazon Bedrock AgentCore.
- [Docker](/falcon-mcp/deployment/docker/): Deploy the Falcon MCP Server using Docker containers.
- [Google Cloud](/falcon-mcp/deployment/google-cloud/): Deploy the Falcon MCP Server on Google Cloud Run or Vertex AI Agent Engine.
- [Integration Testing](/falcon-mcp/development/integration-testing/): Running integration tests with real CrowdStrike API calls.
- [Module Development](/falcon-mcp/development/module-development/): Step-by-step guide for implementing new Falcon MCP modules.
- [Resource Development](/falcon-mcp/development/resource-development/): How to implement and register MCP resources in the Falcon MCP Server.
- [Basic Usage](/falcon-mcp/examples/basic-usage/): Python code examples for using the Falcon MCP Server programmatically.
- [MCP Config](/falcon-mcp/examples/mcp-config/): MCP configuration file examples for connecting to the Falcon MCP Server.
- [Configuration](/falcon-mcp/getting-started/configuration/): Configure environment variables and settings for the Falcon MCP Server.
- [API Credentials](/falcon-mcp/getting-started/credentials/): Create and configure CrowdStrike API credentials for the Falcon MCP Server.
- [Installation](/falcon-mcp/getting-started/installation/): Install the Falcon MCP Server using uv or pip.
- [Quick Start](/falcon-mcp/getting-started/quickstart/): Get up and running with the Falcon MCP Server in 5 minutes.
- [Case Management](/falcon-mcp/modules/cases/): Managing CrowdStrike cases, including searching, creating, updating, and managing evidence and tags
- [Cloud Security](/falcon-mcp/modules/cloud/): Accessing and analyzing CrowdStrike Falcon cloud resources like Kubernetes & Containers Inventory, Images Vulnerabilities, Cloud Assets
- [Correlation Rules](/falcon-mcp/modules/correlationrules/): Correlation Rules module for CrowdStrike Falcon.
- [Custom IOA](/falcon-mcp/modules/custom-ioa/): Searching, creating, updating, and deleting Custom IOA (Indicators of Attack) behavioral rules and rule groups using Falcon Custom IOA Service Collection endpoints
- [Data Protection](/falcon-mcp/modules/data-protection/): Provides read-only access to Data Protection configuration data — classifications, policies, and content patterns — so an LLM can reason about why a Data Protection detection fired
- [Detections](/falcon-mcp/modules/detections/): Accessing and analyzing CrowdStrike Falcon detections
- [Discover](/falcon-mcp/modules/discover/): Accessing and managing CrowdStrike Falcon Discover applications and unmanaged assets
- [Exclusions](/falcon-mcp/modules/exclusions/): This module provides a unified set of tools for managing CrowdStrike exclusions across four types — IOA, Machine Learning, Sensor Visibility, and Certificate-Based — behind a single `exclusion_type` discriminator
- [Firewall Management](/falcon-mcp/modules/firewall/): Searching and managing firewall rules and rule groups
- [Host Groups](/falcon-mcp/modules/host-groups/): Searching, creating, updating, and deleting CrowdStrike Falcon host groups, as well as managing group membership
- [Hosts](/falcon-mcp/modules/hosts/): Accessing and managing CrowdStrike Falcon hosts/devices
- [Identity Protection](/falcon-mcp/modules/idp/): Accessing and managing CrowdStrike Falcon Identity Protection capabilities
- [Intel](/falcon-mcp/modules/intel/): Accessing and analyzing CrowdStrike Falcon intelligence data
- [IOC](/falcon-mcp/modules/ioc/): Searching, creating, and deleting custom IOCs using Falcon IOC Service Collection endpoints
- [NGSIEM](/falcon-mcp/modules/ngsiem/): Running search queries against CrowdStrike's Next-Gen SIEM via the asynchronous job-based search API
- [Module Overview](/falcon-mcp/modules/): Overview of all available Falcon MCP modules with API scopes.
- [Policies](/falcon-mcp/modules/policies/): This module provides a unified set of tools for managing CrowdStrike host-based policies across all six policy types — prevention, sensor_update, firewall, device_control, response, and content_update — behind a single `policy_type` discriminator
- [Quarantine](/falcon-mcp/modules/quarantine/): Investigating quarantined files and applying quarantine actions during triage and remediation workflows
- [Recon](/falcon-mcp/modules/recon/): Searching Falcon Intelligence Recon notifications, monitoring rules, and exposed-data records
- [Real Time Response](/falcon-mcp/modules/rtr/): Initiating and inspecting RTR sessions and for executing read-only RTR commands during host investigations
- [Scheduled Reports](/falcon-mcp/modules/scheduled-reports/): Accessing and managing CrowdStrike Falcon scheduled reports and scheduled searches
- [Sensor Usage](/falcon-mcp/modules/sensor-usage/): Accessing CrowdStrike Falcon sensor usage data
- [Serverless](/falcon-mcp/modules/serverless/): Accessing and managing CrowdStrike Falcon Serverless Vulnerabilities
- [Shield](/falcon-mcp/modules/shield/): Shield module for CrowdStrike Falcon.
- [Spotlight](/falcon-mcp/modules/spotlight/): Accessing and managing CrowdStrike Falcon Spotlight vulnerabilities
- [Falcon MCP](/falcon-mcp/): Connect AI assistants to the CrowdStrike Falcon platform via the Model Context Protocol.
- [CLI Commands](/falcon-mcp/usage/cli/): Command-line options for running the Falcon MCP Server.
- [Dynamic Mode](/falcon-mcp/usage/dynamic-mode/): Reduce context usage by exposing three tools instead of all module tools.
- [Editor Integration](/falcon-mcp/usage/editor-integration/): Configure the Falcon MCP Server in popular MCP-compatible editors and assistants.
- [Flight Control (MSSP)](/falcon-mcp/usage/flight-control/): Using the Falcon MCP Server in multi-tenant Flight Control environments.
- [Transport Methods](/falcon-mcp/usage/transports/): The three transport methods supported by the Falcon MCP Server.

## Sensor Deployment

- [Authentication](/falcon-sensor/ansible/authentication/): The Falcon Ansible collection requires authenticating against the Falcon API. To do so you will
- [Event Driven Ansible](/falcon-sensor/ansible/event-driven/): An ansible-rulebook event source plugin for generating events from the Falcon Event Stream API
- [falcon_discover](/falcon-sensor/ansible/inventory-plugins/falcon-discover/): CrowdStrike Falcon Discover inventory source
- [falcon_hosts](/falcon-sensor/ansible/inventory-plugins/falcon-hosts/): CrowdStrike Falcon Hosts inventory source
- [fctl_child_cids](/falcon-sensor/ansible/lookup-plugins/fctl-child-cids/): fetch Flight Control child CIDs
- [host_ids](/falcon-sensor/ansible/lookup-plugins/host-ids/): fetch host IDs (AIDs)
- [maintenance_token](/falcon-sensor/ansible/lookup-plugins/maintenance-token/): fetch maintenance token
- [auth](/falcon-sensor/ansible/modules/auth/): Manage authentication
- [cid_info](/falcon-sensor/ansible/modules/cid-info/): Get CID with checksum
- [correlation_rule_info](/falcon-sensor/ansible/modules/correlation-rule-info/): Get information about NG-SIEM correlation rules
- [correlation_rule](/falcon-sensor/ansible/modules/correlation-rule/): Manage NG-SIEM correlation rules
- [falconctl_info](/falcon-sensor/ansible/modules/falconctl-info/): Get values associated with Falcon sensor.
- [falconctl](/falcon-sensor/ansible/modules/falconctl/): Configure CrowdStrike Falcon Sensor
- [fctl_child_cid_info](/falcon-sensor/ansible/modules/fctl-child-cid-info/): Retrieve details about Flight Control child CIDs
- [host_contain](/falcon-sensor/ansible/modules/host-contain/): Network contain hosts in Falcon
- [host_group_info](/falcon-sensor/ansible/modules/host-group-info/): Get information about Falcon host groups
- [host_group](/falcon-sensor/ansible/modules/host-group/): Manage Falcon host groups
- [host_hide](/falcon-sensor/ansible/modules/host-hide/): Hide/Unhide hosts from the Falcon console
- [host_info](/falcon-sensor/ansible/modules/host-info/): Get information about Falcon hosts
- [hunting_rule_download](/falcon-sensor/ansible/modules/hunting-rule-download/): Download CrowdStrike Falcon Hunting rule archives
- [intel_rule_download](/falcon-sensor/ansible/modules/intel-rule-download/): Download CrowdStrike Falcon Intel rule files
- [intel_rule_info](/falcon-sensor/ansible/modules/intel-rule-info/): Get information about CrowdStrike Falcon Intel rules
- [kernel_support_info](/falcon-sensor/ansible/modules/kernel-support-info/): Get information about kernels supported by the Falcon Sensor for Linux
- [ngsiem_data_connection_info](/falcon-sensor/ansible/modules/ngsiem-data-connection-info/): Get information about NG-SIEM data connections
- [ngsiem_data_connection](/falcon-sensor/ansible/modules/ngsiem-data-connection/): Manage NG-SIEM data connections
- [ngsiem_data_connector_info](/falcon-sensor/ansible/modules/ngsiem-data-connector-info/): Get information about available NG-SIEM data connectors
- [ngsiem_parser_info](/falcon-sensor/ansible/modules/ngsiem-parser-info/): Get information about NG-SIEM parsers
- [ngsiem_parser](/falcon-sensor/ansible/modules/ngsiem-parser/): Manage NG-SIEM parsers
- [ngsiem_search](/falcon-sensor/ansible/modules/ngsiem-search/): Execute searches against CrowdStrike Next-Gen SIEM repositories
- [sensor_download_info](/falcon-sensor/ansible/modules/sensor-download-info/): Get information about Falcon Sensor Installers
- [sensor_download](/falcon-sensor/ansible/modules/sensor-download/): Download Falcon Sensor Installer
- [sensor_update_builds_info](/falcon-sensor/ansible/modules/sensor-update-builds-info/): Get a list of available sensor build versions
- [sensor_update_policy_info](/falcon-sensor/ansible/modules/sensor-update-policy-info/): Get information about Falcon Update Sensor Policies
- [sensor_update_policy](/falcon-sensor/ansible/modules/sensor-update-policy/): Manage Falcon sensor update policies
- [Ansible Collection](/falcon-sensor/ansible/): Deploy, configure, and manage CrowdStrike Falcon sensors using the crowdstrike.falcon Ansible collection.
- [falcon_configure](/falcon-sensor/ansible/roles/falcon-configure/): Configures the CrowdStrike Falcon Sensor. This role is focused mainly on configuring the Falcon Sensor on Linux and macOS. Windows is supported, but not as much functionality is currently available. T
- [falcon_install](/falcon-sensor/ansible/roles/falcon-install/): Installs the CrowdStrike Falcon Sensor. It provides the flexibility to install the sensor using the CrowdStrike API, a local file, or a remote URL
- [falcon_uninstall](/falcon-sensor/ansible/roles/falcon-uninstall/): Uninstalls the CrowdStrike Falcon Sensor
- [Chef Cookbook](/falcon-sensor/chef/): Install, configure, and manage the CrowdStrike Falcon sensor using the falcon Chef cookbook.
- [Chef Resources](/falcon-sensor/chef/resources/): Reference documentation for falcon_install, falcon_config, and falcon_service Chef resources.
- [Usage](/falcon-sensor/chef/usage/): Getting started with the CrowdStrike Falcon Chef cookbook.
- [Sensor Deployment](/falcon-sensor/): Deploy, configure, and manage the CrowdStrike Falcon sensor across your infrastructure.
- [Puppet Module](/falcon-sensor/puppet/): Install, configure, and manage the CrowdStrike Falcon sensor using the falcon Puppet module.
- [Reference](/falcon-sensor/puppet/reference/): Complete parameter reference for the falcon Puppet module classes and resource types.
- [Usage](/falcon-sensor/puppet/usage/): Configuration options and usage examples for the falcon Puppet module.
- [Container Sensor Pull](/falcon-sensor/scripts/bash/container-sensor-pull/): Pull, copy, and manage Falcon container images. Supports multi-arch, unified images, registry mirroring, and Kubernetes pull token generation.
- [Bash: Install / Uninstall](/falcon-sensor/scripts/bash/install/): Install or remove the Falcon sensor on Linux systems. Supports version pinning, golden image prep, proxy configuration, and sensor update policy targeting.
- [Bash: Migrate](/falcon-sensor/scripts/bash/migrate/): Migrate the Falcon sensor between CIDs on Linux. Handles tag migration, recovery files, and cross-region moves.
- [Deployment Scripts](/falcon-sensor/scripts/): Community-maintained scripts for direct Falcon sensor deployment, migration, and container image management.
- [PowerShell: Install / Uninstall](/falcon-sensor/scripts/powershell/install/): Install or remove the Falcon sensor on Windows systems. Integrates with sensor update policies for version control and supports provisioning tokens.
- [PowerShell: Migrate](/falcon-sensor/scripts/powershell/migrate/): Migrate the Falcon sensor between cloud tenants on Windows. Preserves sensor and Falcon grouping tags with automatic recovery on failure.
- [SystemD: Docker](/falcon-sensor/scripts/systemd/docker/): Run the Falcon Linux sensor container as a SystemD service using Docker. Includes automated installer script and manual configuration.
- [SystemD: Podman](/falcon-sensor/scripts/systemd/podman/): Run the Falcon Linux sensor container as a SystemD service using Podman for rootless container deployments.

## Falcon Next-Gen SIEM

- [Correlation Rules](/ngsiem/correlation-rules/): Create query-based rules that generate custom detections, incidents, and cases in Next-Gen SIEM.
- [CPS-Compliant Parsers](/ngsiem/cps/compliant-parsers/): CPS-compliant parsers, parser fields, differences between CPS and ECS, and managing non-ECS fields.
- [Deprecated Parsers](/ngsiem/cps/deprecated-parsers/): Deprecated parsers and their recommended replacements for Next-Gen SIEM data connectors.
- [Module Guidelines](/ngsiem/cps/module-guidelines/): Guidelines and list of module names used in CPS-compliant parsers for the #event.module tag.
- [observer.type Guidelines](/ngsiem/cps/observer-type/): A non-exhaustive list of values used in parsers for the #observer.type field.
- [CrowdStrike Parsing Standard](/ngsiem/cps/): Learn about the CrowdStrike Parsing Standard (CPS), CPS-compliant parsers, guidelines for creating parsers, and more.
- [Parser Guidelines](/ngsiem/cps/parser-guidelines/): Guidelines for creating CPS-compliant parsers including sample data requirements and testing standards.
- [Parser Template](/ngsiem/cps/parser-template/): Starter template and examples for writing your own CPS-compliant parser.
- [Vendor Guidelines](/ngsiem/cps/vendor-guidelines/): Guidelines and list of vendor names used in CPS-compliant parsers for the #Vendor tag.
- [Versions](/ngsiem/cps/versions/): See the latest version and change history for the CrowdStrike Parsing Standard (CPS).
- [Data Ingestion (HEC)](/ngsiem/data-ingestion/): Ingest data from any source into Falcon Next-Gen SIEM using the HTTP Event Collector.
- [Fusion SOAR](/ngsiem/fusion-soar/): Build automated workflows for security orchestration, automation, and response in Next-Gen SIEM.
- [Limits & Standards](/ngsiem/limits/): Operating limits and standard parameters for Falcon Next-Gen SIEM.
- [Falcon Next-Gen SIEM](/ngsiem/): Build custom parsers, normalize security data, and integrate third-party log sources with CrowdStrike Next-Gen SIEM.

## Configuration as Code

- [Configuration as Code](/cac/): Manage the CrowdStrike Falcon platform using Configuration as Code with Terraform.
- [AWS Cloud Registration](/cac/terraform/modules/aws-cloud-registration/): Terraform module for registering AWS accounts with CrowdStrike Falcon Cloud Security.
- [AWS SSM Distributor](/cac/terraform/modules/aws-ssm-distributor/): Terraform module for deploying the CrowdStrike Falcon sensor to EC2 instances via AWS Systems Manager.
- [Azure Cloud Registration](/cac/terraform/modules/azure-cloud-registration/): Terraform module for registering Azure subscriptions and management groups with CrowdStrike Falcon Cloud Security.
- [GCP Cloud Registration](/cac/terraform/modules/gcp-cloud-registration/): Terraform module for registering GCP organizations, folders, and projects with CrowdStrike Falcon Cloud Security.
- [Kubernetes](/cac/terraform/modules/kubernetes/): Terraform module for deploying the CrowdStrike Falcon sensor to Kubernetes and OpenShift clusters.
- [OCI Cloud Registration](/cac/terraform/modules/oci-cloud-registration/): Terraform module for registering Oracle Cloud Infrastructure with CrowdStrike Falcon Cloud Security.
- [Terraform](/cac/terraform/): Manage CrowdStrike Falcon platform resources and cloud integrations using Terraform.
- [content_category_versions](/cac/terraform/provider/content-update-policy/data-sources/content-category-versions/): This data source provides information about available content category versions for pinning in content update policies. API Scopes The following API scopes are required: Content Update Policy | Read
- [content_update_policies](/cac/terraform/provider/content-update-policy/data-sources/content-update-policies/): This data source provides information about content update policies in Falcon. API Scopes The following API scopes are required: Content Update Policy | Read
- [content_update_policy_attachment](/cac/terraform/provider/content-update-policy/resources/content-update-policy-attachment/): This resource allows managing the host groups attached to a content update policy.
- [content_update_policy_precedence](/cac/terraform/provider/content-update-policy/resources/content-update-policy-precedence/): This resource allows you to set the precedence of Content Update Policies based on the order of IDs.
- [content_update_policy](/cac/terraform/provider/content-update-policy/resources/content-update-policy/): This resource allows management of content update policies in the CrowdStrike Falcon platform. Content update policies control how and when CrowdStrike content updates are deployed to hosts. API Scopes The following API scopes are required: Content Update Policy | Read & Write
- [default_content_update_policy](/cac/terraform/provider/content-update-policy/resources/default-content-update-policy/): This resource allows management of the default content update policy in the CrowdStrike Falcon platform.
- [data_protection_content_pattern](/cac/terraform/provider/data-protection/resources/data-protection-content-pattern/): A content pattern defines custom regex-based patterns to detect sensitive data. API Scopes The following API scopes are required: Data Protection | Read & Write
- [data_protection_sensitivity_label](/cac/terraform/provider/data-protection/resources/data-protection-sensitivity-label/): A sensitivity label manages an external data protection label in CrowdStrike Falcon. The underlying API supports create, read, and delete operations only, so changing any configurable attribute forces replacement. API Scopes The following API scopes are required: Data Protection | Read & Write
- [custom_ioc](/cac/terraform/provider/endpoint-security/resources/custom-ioc/): Manages IOC (Indicator of Compromise) indicators in CrowdStrike Falcon.
- [ioa_exclusion](/cac/terraform/provider/endpoint-security/resources/ioa-exclusion/): An IOA exclusion prevents a specific IOA detection pattern from triggering for matching child, parent, and grandparent command-line and image-filename regex values. API Scopes The following API scopes are required: IOA Exclusions | Read & Write
- [ioa_rule_group](/cac/terraform/provider/endpoint-security/resources/ioa-rule-group/): Manages IOA (Indicator of Attack) rule groups in CrowdStrike Falcon.
- [ml_certificate_exclusion](/cac/terraform/provider/endpoint-security/resources/ml-certificate-exclusion/): An ML certificate exclusion defines a machine learning exclusion scoped to a certificate and either all hosts or specific host groups. API Scopes The following API scopes are required: Certificate Based Exclusions | Read & Write
- [ml_file_path_exclusion](/cac/terraform/provider/endpoint-security/resources/ml-file-path-exclusion/): Manages machine learning exclusions for trusted file paths in the CrowdStrike Falcon Platform. At least one exclusion mode must be enabled via exclude_detections and/or exclude_uploads. API Scopes The following API scopes are required: Machine Learning Exclusions | Read & Write
- [cloud_aws_account_validation](/cac/terraform/provider/falcon-cloud-security/data-sources/cloud-aws-account-validation/): This data source validate account configuration and connection status for an integrated AWS account. API Scopes The following API scopes are required: Cloud security AWS registration | Read & Write
- [cloud_aws_account](/cac/terraform/provider/falcon-cloud-security/data-sources/cloud-aws-account/): This data source provides information about AWS accounts in Falcon. API Scopes The following API scopes are required: Cloud security AWS registration | Read & Write
- [cloud_compliance_framework_controls](/cac/terraform/provider/falcon-cloud-security/data-sources/cloud-compliance-framework-controls/): This data source retrieves all or a subset of controls within compliance benchmarks.
- [cloud_risk_findings](/cac/terraform/provider/falcon-cloud-security/data-sources/cloud-risk-findings/): This data source retrieves cloud risk findings from Falcon Cloud Security.
- [cloud_security_rules](/cac/terraform/provider/falcon-cloud-security/data-sources/cloud-security-rules/): This data source retrieves detailed information about a specific cloud security rule, including its unique identifier (ID) and associated attributes.
- [cloud_security_suppression_rules](/cac/terraform/provider/falcon-cloud-security/data-sources/cloud-security-suppression-rules/): This data source retrieves detailed information about cloud security suppression rules.
- [cloud_aws_account](/cac/terraform/provider/falcon-cloud-security/resources/cloud-aws-account/): This resource registers an AWS account or organization in Falcon Cloud Security. API Scopes The following API scopes are required: Cloud security AWS registration | Read & Write
- [cloud_azure_tenant_eventhub_settings](/cac/terraform/provider/falcon-cloud-security/resources/cloud-azure-tenant-eventhub-settings/): This resource manages the eventhub settings on an Azure Tenant in Falcon Cloud Security. API Scopes The following API scopes are required: Cloud security Azure registration | Read & Write
- [cloud_azure_tenant](/cac/terraform/provider/falcon-cloud-security/resources/cloud-azure-tenant/): This resource registers an Azure Tenant in Falcon Cloud Security. API Scopes The following API scopes are required: Cloud security Azure registration | Read & Write
- [cloud_compliance_custom_framework](/cac/terraform/provider/falcon-cloud-security/resources/cloud-compliance-custom-framework/): This resource allows managing custom compliance frameworks in the CrowdStrike Falcon Platform. API Scopes The following API scopes are required: Cloud Security Policies | Read & Write
- [cloud_google_registration_settings](/cac/terraform/provider/falcon-cloud-security/resources/cloud-google-registration-settings/): This resource manages settings for a Google Cloud registration in Falcon Cloud Security that may not be known until after the registration has been created, such as log ingestion and Workload Identity Federation (WIF) configuration.
- [cloud_google_registration](/cac/terraform/provider/falcon-cloud-security/resources/cloud-google-registration/): This resource registers a Google Cloud project, folder, or organization in Falcon Cloud Security. API Scopes The following API scopes are required: Cloud Security Google Cloud Registration | Read & Write
- [cloud_group](/cac/terraform/provider/falcon-cloud-security/resources/cloud-group/): This resource manages CrowdStrike Cloud Groups for organizing cloud resources and container images. API Scopes The following API scopes are required: Cloud Groups V2 | Read & Write
- [cloud_security_custom_rule](/cac/terraform/provider/falcon-cloud-security/resources/cloud-security-custom-rule/): ~> Deprecated This resource is deprecated and will be removed in a future version.
- [cloud_security_iac_custom_rule](/cac/terraform/provider/falcon-cloud-security/resources/cloud-security-iac-custom-rule/): This resource manages custom cloud security IAC rules.
- [cloud_security_iom_custom_rule](/cac/terraform/provider/falcon-cloud-security/resources/cloud-security-iom-custom-rule/): This resource manages custom cloud security IOM rules.
- [cloud_security_kac_custom_rule](/cac/terraform/provider/falcon-cloud-security/resources/cloud-security-kac-custom-rule/): This resource manages custom cloud security KAC rules. API Scopes The following API scopes are required: Cloud Security Policies | Read & Write
- [cloud_security_kac_policy_precedence](/cac/terraform/provider/falcon-cloud-security/resources/cloud-security-kac-policy-precedence/): This resource manages the precedence for Admission Control policies. API Scopes The following API scopes are required: Falcon Container Policies | Read & Write
- [cloud_security_kac_policy](/cac/terraform/provider/falcon-cloud-security/resources/cloud-security-kac-policy/): This resource manages an Admission Control policy, which provides instructions to the Falcon Kubernetes Admission Controller (KAC) about what actions to take on objects at runtime. API Scopes The following API scopes are required: Falcon Container Policies | Read & Write
- [cloud_security_suppression_rule](/cac/terraform/provider/falcon-cloud-security/resources/cloud-security-suppression-rule/): A suppression rule defines criteria for automatically suppressing findings, such as IOMs, across your environment.
- [container_registry](/cac/terraform/provider/falcon-container-image/data-sources/container-registry/): Retrieves information about a container registry connection in CrowdStrike Falcon Container Security. API Scopes The following API scopes are required: Falcon Container Image | Read
- [container_registry](/cac/terraform/provider/falcon-container-image/resources/container-registry/): Manages container registry connections in CrowdStrike Falcon Container Security. This resource allows you to connect container registries for image scanning and vulnerability assessment. API Scopes The following API scopes are required: Falcon Container Image | Read & Write
- [filevantage_policies](/cac/terraform/provider/filevantage/data-sources/filevantage-policies/): This data source provides information about FileVantage policies in Falcon. API Scopes The following API scopes are required: Falcon FileVantage | Read
- [filevantage_policy_attachment](/cac/terraform/provider/filevantage/resources/filevantage-policy-attachment/): This resource allows managing the host groups and rule groups attached to a FileVantage policy.
- [filevantage_policy_precedence](/cac/terraform/provider/filevantage/resources/filevantage-policy-precedence/): This resource allows you to set the precedence of FileVantage Policies based on the order of IDs.
- [filevantage_policy](/cac/terraform/provider/filevantage/resources/filevantage-policy/): This resource allows management of a FileVantage policy. A FileVantage policy is a collection of file integrity rules and rule groups that you can apply to host groups. API Scopes The following API scopes are required: Falcon FileVantage | Read & Write
- [filevantage_rule_group](/cac/terraform/provider/filevantage/resources/filevantage-rule-group/): This resource allows management of a FileVantage rule group. A FileVantage rule group is a collection of file integrity rules that can be assigned to a FileVantge policy. API Scopes The following API scopes are required: Falcon FileVantage | Read & Write
- [firewall_policies](/cac/terraform/provider/firewall-management/data-sources/firewall-policies/): This data source provides information about firewall policies in Falcon. API Scopes The following API scopes are required: Firewall management | Read
- [firewall_rule_groups](/cac/terraform/provider/firewall-management/data-sources/firewall-rule-groups/): This data source provides information about firewall rule groups in Falcon. API Scopes The following API scopes are required: Firewall management | Read
- [firewall_policy_precedence](/cac/terraform/provider/firewall-management/resources/firewall-policy-precedence/): This resource allows you to set the precedence of Firewall Policies based on the order of IDs.
- [firewall_policy](/cac/terraform/provider/firewall-management/resources/firewall-policy/): This resource allows management of CrowdStrike Firewall policies. A firewall policy defines the firewall settings and rule groups that apply to hosts in assigned host groups. API Scopes The following API scopes are required: Firewall management | Read & Write
- [firewall_rule_group](/cac/terraform/provider/firewall-management/resources/firewall-rule-group/): This resource allows management of CrowdStrike Firewall rule groups. A rule group is a collection of firewall rules that can be assigned to firewall policies. API Scopes The following API scopes are required: Firewall management | Read & Write
- [user_group](/cac/terraform/provider/flight-control/resources/user-group/): This resource manages user groups in CrowdStrike Falcon Flight Control. API Scopes The following API scopes are required: Flight Control | Read & Write
- [host_group_members](/cac/terraform/provider/host-group/data-sources/host-group-members/): This data source provides the live membership of a host group in Falcon.
- [host_group](/cac/terraform/provider/host-group/data-sources/host-group/): This data source provides information about a single host group in Falcon. Use this to look up a host group by name or ID and reference its attributes in other resources. API Scopes The following API scopes are required: Host groups | Read
- [host_group](/cac/terraform/provider/host-group/resources/host-group/): This resource allows you to manage host groups in the CrowdStrike Falcon Platform. API Scopes The following API scopes are required: Host groups | Read & WriteFirewall management | Read & WritePrevention policies | Read & WriteResponse policies | Read & WriteSensor update policies | Read & Write
- [cid_group](/cac/terraform/provider/host-setup-and-management/data-sources/cid-group/): Provides information about a single CID group in CrowdStrike Falcon Flight Control. Use this to look up a CID group by name or ID and reference its attributes in other resources. API Scopes The following API scopes are required: Flight Control | Read
- [cid](/cac/terraform/provider/host-setup-and-management/data-sources/cid/): Returns the Customer ID (CID) and Customer ID Checksum (CCID) for the Falcon tenant authenticated by the provider. API Scopes The following API scopes are required: Sensor Download | Read
- [rtr_put_file](/cac/terraform/provider/host-setup-and-management/data-sources/rtr-put-file/): This data source provides information about a single RTR put file in Falcon. Use this to look up a put file by name or ID and reference its attributes in other resources. API Scopes The following API scopes are required: Real Time Response (Admin) | Read
- [rtr_script](/cac/terraform/provider/host-setup-and-management/data-sources/rtr-script/): This data source provides information about a single Real Time Response (RTR) custom script in CrowdStrike Falcon. Use this to look up an RTR script by name or ID and reference its attributes. API Scopes The following API scopes are required: Real Time Response (Admin) | Read
- [cid_group](/cac/terraform/provider/host-setup-and-management/resources/cid-group/): Manages CID groups in CrowdStrike Falcon Flight Control. CID groups allow MSPs to organize and manage child CIDs for multi-tenant environments. API Scopes The following API scopes are required: Flight Control | Read & Write
- [install_token](/cac/terraform/provider/host-setup-and-management/resources/install-token/): Manages installation tokens in CrowdStrike Falcon. Installation tokens are used to authenticate sensor installations and deployments. API Scopes The following API scopes are required: Installation Tokens | Read & WriteInstallation Tokens Settings | Write
- [response_policy_precedence](/cac/terraform/provider/host-setup-and-management/resources/response-policy-precedence/): This resource allows you set the precedence of Response Policies based on the order of IDs.
- [response_policy](/cac/terraform/provider/host-setup-and-management/resources/response-policy/): Manages CrowdStrike Real Time Response (RTR) policies that control endpoint response capabilities.
- [rtr_put_file](/cac/terraform/provider/host-setup-and-management/resources/rtr-put-file/): Manages an RTR put file, which can be deployed to hosts via the RTR put command.
- [rtr_script](/cac/terraform/provider/host-setup-and-management/resources/rtr-script/): Manages Real Time Response (RTR) custom scripts in CrowdStrike Falcon. RTR scripts allow administrators to upload and manage custom scripts that can be executed on remote hosts during response sessions. API Scopes The following API scopes are required: Real Time Response (Admin) | Read & Write
- [Importing](/cac/terraform/provider/importing/): "
- [it_automation_policies](/cac/terraform/provider/it-automation/data-sources/it-automation-policies/): This data source provides information about IT Automation policies in CrowdStrike Falcon. Use this to look up policies by platform, name, or other attributes and reference them in other resources. API Scopes The following API scopes are required: IT Automation - Policies | Read
- [it_automation_task_groups](/cac/terraform/provider/it-automation/data-sources/it-automation-task-groups/): This data source provides information about IT Automation task groups in CrowdStrike Falcon. Task groups allow organizing tasks for RBAC and grouping purposes. API Scopes The following API scopes are required: IT Automation - Tasks | Read
- [it_automation_tasks](/cac/terraform/provider/it-automation/data-sources/it-automation-tasks/): This data source provides information about IT Automation tasks in CrowdStrike Falcon. API Scopes The following API scopes are required: IT Automation - Tasks | Read
- [it_automation_default_policy](/cac/terraform/provider/it-automation/resources/it-automation-default-policy/): This resource allows management of default IT Automation policy configuration settings in the CrowdStrike Falcon platform.
- [it_automation_policy_precedence](/cac/terraform/provider/it-automation/resources/it-automation-policy-precedence/): This resource allows you to set the precedence of IT Automation policies based on the order of policy IDs.
- [it_automation_policy](/cac/terraform/provider/it-automation/resources/it-automation-policy/): This resource allows management of IT Automation policies in the CrowdStrike Falcon platform.
- [it_automation_scheduled_task](/cac/terraform/provider/it-automation/resources/it-automation-scheduled-task/): This resource allows management of IT Automation scheduled tasks in the CrowdStrike Falcon platform.
- [it_automation_task_group](/cac/terraform/provider/it-automation/resources/it-automation-task-group/): This resource allows management of IT Automation task groups in the CrowdStrike Falcon platform.
- [it_automation_task](/cac/terraform/provider/it-automation/resources/it-automation-task/): This resource allows management of IT Automation tasks in the CrowdStrike Falcon platform.
- [correlation_rules](/cac/terraform/provider/next-gen-siem/data-sources/correlation-rules/): Use this data source to query existing CrowdStrike NGSIEM Correlation Rules. API Scopes The following API scopes are required: Correlation Rules | Read
- [ngsiem_data_connector](/cac/terraform/provider/next-gen-siem/data-sources/ngsiem-data-connector/): Reads a single NG-SIEM connector from the catalog by its exact name, returning its catalog ID, supported parsers, type, and vendor metadata. API Scopes The following API scopes are required: NGSIEM Data Connections API | Read
- [ngsiem_data_connectors](/cac/terraform/provider/next-gen-siem/data-sources/ngsiem-data-connectors/): Reads the NG-SIEM connector catalog and returns a list of connectors, each with its catalog ID, supported parsers, type, and vendor metadata. Supports an optional FQL filter. API Scopes The following API scopes are required: NGSIEM Data Connections API | Read
- [correlation_rule](/cac/terraform/provider/next-gen-siem/resources/correlation-rule/): Manages CrowdStrike NGSIEM Correlation Rules.
- [ngsiem_data_connection_token](/cac/terraform/provider/next-gen-siem/resources/ngsiem-data-connection-token/): Generates and manages the HEC ingest token for a push crowdstrike_ngsiem_data_connection.
- [ngsiem_data_connection](/cac/terraform/provider/next-gen-siem/resources/ngsiem-data-connection/): Manages a single NG-SIEM data connection that ingests logs from an external source into the CrowdStrike Falcon platform.
- [ngsiem_data_connector_config](/cac/terraform/provider/next-gen-siem/resources/ngsiem-data-connector-config/): Manages a reusable NG-SIEM data connector configuration.
- [prevention_policies](/cac/terraform/provider/prevention-policy/data-sources/prevention-policies/): This data source provides information about prevention policies in Falcon. API Scopes The following API scopes are required: Prevention policies | Read
- [default_prevention_policy_linux](/cac/terraform/provider/prevention-policy/resources/default-prevention-policy-linux/): This resource allows you to manage the default prevention policy for Linux hosts.
- [default_prevention_policy_mac](/cac/terraform/provider/prevention-policy/resources/default-prevention-policy-mac/): This resource allows you to manage the default prevention policy for Mac hosts.
- [default_prevention_policy_windows](/cac/terraform/provider/prevention-policy/resources/default-prevention-policy-windows/): This resource allows you to manage the default prevention policy for Windows hosts.
- [prevention_policy_attachment](/cac/terraform/provider/prevention-policy/resources/prevention-policy-attachment/): This resource allows managing the host groups and ioa rule groups attached to a prevention policy.
- [prevention_policy_linux](/cac/terraform/provider/prevention-policy/resources/prevention-policy-linux/): This resource allows you to manage prevention policies for Linux hosts. Prevention policies allow you to manage what activity will trigger detections and preventions on your hosts. API Scopes The following API scopes are required: Prevention policies | Read & Write
- [prevention_policy_mac](/cac/terraform/provider/prevention-policy/resources/prevention-policy-mac/): This resource allows you to manage prevention policies for Mac hosts. Prevention policies allow you to manage what activity will trigger detections and preventions on your hosts. API Scopes The following API scopes are required: Prevention policies | Read & Write
- [prevention_policy_precedence](/cac/terraform/provider/prevention-policy/resources/prevention-policy-precedence/): This resource allows you set the precedence of Prevention Policies based on the order of IDs.
- [prevention_policy_windows](/cac/terraform/provider/prevention-policy/resources/prevention-policy-windows/): This resource allows you to manage prevention policies for Windows hosts. Prevention policies allow you to manage what activity will trigger detections and preventions on your hosts. API Scopes The following API scopes are required: Prevention policies | Read & Write
- [sensor_update_policies](/cac/terraform/provider/sensor-update-policy/data-sources/sensor-update-policies/): This data source provides information about sensor update policies in Falcon. API Scopes The following API scopes are required: Sensor update policies | Read
- [sensor_update_policy_builds](/cac/terraform/provider/sensor-update-policy/data-sources/sensor-update-policy-builds/): This data source provides information about the latest sensor builds for each platform. API Scopes The following API scopes are required: Sensor update policies | Read
- [default_sensor_update_policy](/cac/terraform/provider/sensor-update-policy/resources/default-sensor-update-policy/): This resource allows management of the default sensor update policy in the CrowdStrike Falcon platform.
- [sensor_update_policy_host_group_attachment](/cac/terraform/provider/sensor-update-policy/resources/sensor-update-policy-host-group-attachment/): This resource allows managing the host groups attached to a sensor update policy.
- [sensor_update_policy_precedence](/cac/terraform/provider/sensor-update-policy/resources/sensor-update-policy-precedence/): This resource allows you to set the precedence of Sensor Update Policies based on the order of IDs.
- [sensor_update_policy](/cac/terraform/provider/sensor-update-policy/resources/sensor-update-policy/): This resource allows management of sensor update policies in the CrowdStrike Falcon platform. Sensor update policies allow you to control the update process across a set of hosts. API Scopes The following API scopes are required: Sensor update policies | Read & Write
- [sensor_visibility_exclusions](/cac/terraform/provider/sensor-visibility-exclusion/data-sources/sensor-visibility-exclusions/): This data source provides information about sensor visibility exclusions in Falcon. API Scopes The following API scopes are required: Sensor Visibility Exclusions | Read & Write
- [sensor_visibility_exclusion_attachment](/cac/terraform/provider/sensor-visibility-exclusion/resources/sensor-visibility-exclusion-attachment/): This resource allows managing the host groups attached to a sensor visibility exclusion policy.
- [sensor_visibility_exclusion](/cac/terraform/provider/sensor-visibility-exclusion/resources/sensor-visibility-exclusion/): This resource allows you to manage sensor visibility exclusions in the CrowdStrike Falcon Platform.
- [Sweepers](/cac/terraform/provider/sweepers/): "
- [user_roles](/cac/terraform/provider/user-management/data-sources/user-roles/): Lists the Falcon user roles available for a customer (CID), including default and custom roles with their display name, description, scope, and type. API Scopes The following API scopes are required: User Management | Read
- [user](/cac/terraform/provider/user-management/data-sources/user/): This data source provides information about a single Falcon user. Use this to look up a user by user UUID or email and reference their attributes in other resources. API Scopes The following API scopes are required: User management | Read
- [user_role_assignment](/cac/terraform/provider/user-management/resources/user-role-assignment/): This resource manages the complete set of Falcon roles assigned directly to an existing user within a customer ID (CID).
- [user](/cac/terraform/provider/user-management/resources/user/): This resource allows management of a user on the CrowdStrike Falcon platform.

## Authentication

All API access requires OAuth2 credentials (client_id and client_secret) created in the Falcon console under Support and resources > API Clients & Keys. Tokens expire after 30 minutes. Base URLs vary by cloud region: us-1 (api.crowdstrike.com), us-2 (api.us-2.crowdstrike.com), eu-1 (api.eu-1.crowdstrike.com), us-gov-1 (api.laggar.gcw.crowdstrike.com).