Getting Started

Installation

From RubyGems (Recommended)

gem install crimson-falcon

Or add to your Gemfile:

gem 'crimson-falcon', '~> 1.2.0'

From Source

gem build crimson-falcon.gemspec
gem install ./crimson-falcon-1.2.0.gem

From Git

gem 'crimson-falcon', :git => 'https://github.com/CrowdStrike/crimson-falcon.git'

Authentication

Configure credentials using a block syntax. Set cloud to your CrowdStrike region.

require 'crimson-falcon'

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]  # "us-1", "us-2", "eu-1", "us-gov-1"
end

Quick Start

require 'crimson-falcon'

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = "us-1"
end

api = Falcon::SensorDownload.new
result = api.get_sensor_installers_ccidby_query
puts result.resources

Function Names

Crimson Falcon uses snake_case method names matching the API Operation IDs:

API Operation	Ruby Method
CombinedDevicesByFilter	`combined_devices_by_filter`
GetDeviceDetailsV2	`get_device_details_v2`
PerformActionV2	`perform_action_v2`
QueryDevicesByFilterScroll	`query_devices_by_filter_scroll`

Samples

The samples directory includes:

hosts/sensor_versions_by_hostname.rb — Query sensor versions by hostname
incidents/crowd_score.rb — Retrieve CrowdScore
oauth2/get_access_token.rb — OAuth2 authentication
sensor_download/get_ccid.rb — Retrieve CCID

Shared utilities in samples/shared/ provide command line parameter handling and credential prompting.

Resources

Page Updated: v1.2.0