Falcon Complete Dashboard
| API Function | Description |
|---|---|
| AggregateAllowList | Retrieve aggregate allowlist ticket values based on the matched filter |
| AggregateBlockList | Retrieve aggregate blocklist ticket values based on the matched filter |
| AggregateDetections | Retrieve aggregate detection values based on the matched filter |
| AggregateDeviceCountCollection | Retrieve aggregate host/devices count based on the matched filter |
| AggregateEscalations | Retrieve aggregate escalation ticket values based on the matched filter |
| AggregateFCIncidents | Retrieve aggregate incident values based on the matched filter |
| AggregateRemediations | Retrieve aggregate remediation ticket values based on the matched filter |
| QueryAllowListFilter | Retrieve allowlist tickets that match the provided filter criteria with scrolling enabled |
| QueryBlockListFilter | Retrieve block listtickets that match the provided filter criteria with scrolling enabled |
| QueryDetectionIdsByFilter | Retrieve DetectionsIds that match the provided FQL filter, criteria with scrolling enabled |
| GetDeviceCountCollectionQueriesByFilter | Retrieve device count collection Ids that match the provided FQL filter, criteria with scrolling enabled |
| QueryEscalationsFilter | Retrieve escalation tickets that match the provided filter criteria with scrolling enabled |
| QueryIncidentIdsByFilter | Retrieve incidents that match the provided filter criteria with scrolling enabled |
| QueryRemediationsFilter | Retrieve remediation tickets that match the provided filter criteria with scrolling enabled |
Retrieve aggregate allowlist ticket values based on the matched filter
- Consumes: application/json
- Produces: application/json
| Required | Name | Type | Datatype | Description |
|---|---|---|---|---|
| ✅ | body | body | string |
from falconpy import api_complete as FalconSDK
falcon = FalconSDK.APIHarness(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
}
)
BODY = {
'Body Payload': 'See body description above'
}
response = falcon.command('AggregateAllowList', body=BODY)
print(response)
falcon.deauthenticate()Retrieve aggregate blocklist ticket values based on the matched filter
- Consumes: application/json
- Produces: application/json
| Required | Name | Type | Datatype | Description |
|---|---|---|---|---|
| ✅ | body | body | string |
from falconpy import api_complete as FalconSDK
falcon = FalconSDK.APIHarness(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
}
)
BODY = {
'Body Payload': 'See body description above'
}
response = falcon.command('AggregateBlockList', body=BODY)
print(response)
falcon.deauthenticate()Retrieve aggregate detection values based on the matched filter
- Consumes: application/json
- Produces: application/json
| Required | Name | Type | Datatype | Description |
|---|---|---|---|---|
| ✅ | body | body | string |
from falconpy import api_complete as FalconSDK
falcon = FalconSDK.APIHarness(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
}
)
BODY = {
'Body Payload': 'See body description above'
}
response = falcon.command('AggregateDetections', body=BODY)
print(response)
falcon.deauthenticate()Retrieve aggregate host/devices count based on the matched filter
- Consumes: application/json
- Produces: application/json
| Required | Name | Type | Datatype | Description |
|---|---|---|---|---|
| ✅ | body | body | string |
from falconpy import api_complete as FalconSDK
falcon = FalconSDK.APIHarness(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
}
)
BODY = {
'Body Payload': 'See body description above'
}
response = falcon.command('AggregateDeviceCountCollection', body=BODY)
print(response)
falcon.deauthenticate()Retrieve aggregate escalation ticket values based on the matched filter
- Consumes: application/json
- Produces: application/json
| Required | Name | Type | Datatype | Description |
|---|---|---|---|---|
| ✅ | body | body | string |
from falconpy import api_complete as FalconSDK
falcon = FalconSDK.APIHarness(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
}
)
BODY = {
'Body Payload': 'See body description above'
}
response = falcon.command('AggregateEscalations', body=BODY)
print(response)
falcon.deauthenticate()Retrieve aggregate incident values based on the matched filter
- Consumes: application/json
- Produces: application/json
| Required | Name | Type | Datatype | Description |
|---|---|---|---|---|
| ✅ | body | body | string |
from falconpy import api_complete as FalconSDK
falcon = FalconSDK.APIHarness(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
}
)
BODY = {
'Body Payload': 'See body description above'
}
response = falcon.command('AggregateFCIncidents', body=BODY)
print(response)
falcon.deauthenticate()Retrieve aggregate remediation ticket values based on the matched filter
- Consumes: application/json
- Produces: application/json
| Required | Name | Type | Datatype | Description |
|---|---|---|---|---|
| ✅ | body | body | string |
from falconpy import api_complete as FalconSDK
falcon = FalconSDK.APIHarness(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
}
)
BODY = {
'Body Payload': 'See body description above'
}
response = falcon.command('AggregateRemediations', body=BODY)
print(response)
falcon.deauthenticate()Retrieve allowlist tickets that match the provided filter criteria with scrolling enabled
- Consumes: application/json
- Produces: application/json
| Required | Name | Type | Datatype | Description |
|---|---|---|---|---|
| limit | query | integer | The maximum records to return. [1-500] | |
| sort | query | string | The property to sort on, followed by a dot (.), followed by the sort direction, either "asc" or "desc". | |
| filter | query | string | Optional filter and sort criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon. | |
| offset | query | string | Starting index of overall result set from which to return ids. |
from falconpy import api_complete as FalconSDK
falcon = FalconSDK.APIHarness(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
}
)
PARAMS = {
'limit': integer,
'sort': 'string',
'filter': 'string',
'offset': 'string'
}
response = falcon.command('QueryAllowListFilter', parameters=PARAMS)
print(response)
falcon.deauthenticate()Retrieve block listtickets that match the provided filter criteria with scrolling enabled
- Consumes: application/json
- Produces: application/json
| Required | Name | Type | Datatype | Description |
|---|---|---|---|---|
| limit | query | integer | The maximum records to return. [1-500] | |
| sort | query | string | The property to sort on, followed by a dot (.), followed by the sort direction, either "asc" or "desc". | |
| filter | query | string | Optional filter and sort criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon. | |
| offset | query | string | Starting index of overall result set from which to return ids. |
from falconpy import api_complete as FalconSDK
falcon = FalconSDK.APIHarness(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
}
)
PARAMS = {
'limit': integer,
'sort': 'string',
'filter': 'string',
'offset': 'string'
}
response = falcon.command('QueryBlockListFilter', parameters=PARAMS)
print(response)
falcon.deauthenticate()Retrieve DetectionsIds that match the provided FQL filter, criteria with scrolling enabled
- Consumes: application/json
- Produces: application/json
| Required | Name | Type | Datatype | Description |
|---|---|---|---|---|
| limit | query | integer | The maximum records to return. [1-500] | |
| sort | query | string | The property to sort on, followed by a dot (.), followed by the sort direction, either "asc" or "desc". | |
| filter | query | string | Optional filter and sort criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon. | |
| offset | query | string | Starting index of overall result set from which to return ids. |
from falconpy import api_complete as FalconSDK
falcon = FalconSDK.APIHarness(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
}
)
PARAMS = {
'limit': integer,
'sort': 'string',
'filter': 'string',
'offset': 'string'
}
response = falcon.command('QueryDetectionIdsByFilter', parameters=PARAMS)
print(response)
falcon.deauthenticate()Retrieve device count collection Ids that match the provided FQL filter, criteria with scrolling enabled
- Consumes: application/json
- Produces: application/json
| Required | Name | Type | Datatype | Description |
|---|---|---|---|---|
| limit | query | integer | The maximum records to return. [1-500] | |
| sort | query | string | The property to sort on, followed by a dot (.), followed by the sort direction, either "asc" or "desc". | |
| filter | query | string | Optional filter and sort criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon. | |
| offset | query | string | Starting index of overall result set from which to return ids. |
from falconpy import api_complete as FalconSDK
falcon = FalconSDK.APIHarness(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
}
)
PARAMS = {
'limit': integer,
'sort': 'string',
'filter': 'string',
'offset': 'string'
}
response = falcon.command('GetDeviceCountCollectionQueriesByFilter', parameters=PARAMS)
print(response)
falcon.deauthenticate()Retrieve escalation tickets that match the provided filter criteria with scrolling enabled
- Consumes: application/json
- Produces: application/json
| Required | Name | Type | Datatype | Description |
|---|---|---|---|---|
| limit | query | integer | The maximum records to return. [1-500] | |
| sort | query | string | The property to sort on, followed by a dot (.), followed by the sort direction, either "asc" or "desc". | |
| filter | query | string | Optional filter and sort criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon. | |
| offset | query | string | Starting index of overall result set from which to return ids. |
from falconpy import api_complete as FalconSDK
falcon = FalconSDK.APIHarness(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
}
)
PARAMS = {
'limit': integer,
'sort': 'string',
'filter': 'string',
'offset': 'string'
}
response = falcon.command('QueryEscalationsFilter', parameters=PARAMS)
print(response)
falcon.deauthenticate()Retrieve incidents that match the provided filter criteria with scrolling enabled
- Consumes: application/json
- Produces: application/json
| Required | Name | Type | Datatype | Description |
|---|---|---|---|---|
| limit | query | integer | The maximum records to return. [1-500] | |
| sort | query | string | The property to sort on, followed by a dot (.), followed by the sort direction, either "asc" or "desc". | |
| filter | query | string | Optional filter and sort criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon. | |
| offset | query | string | Starting index of overall result set from which to return ids. |
from falconpy import api_complete as FalconSDK
falcon = FalconSDK.APIHarness(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
}
)
PARAMS = {
'limit': integer,
'sort': 'string',
'filter': 'string',
'offset': 'string'
}
response = falcon.command('QueryIncidentIdsByFilter', parameters=PARAMS)
print(response)
falcon.deauthenticate()Retrieve remediation tickets that match the provided filter criteria with scrolling enabled
- Consumes: application/json
- Produces: application/json
| Required | Name | Type | Datatype | Description |
|---|---|---|---|---|
| limit | query | integer | The maximum records to return. [1-500] | |
| sort | query | string | The property to sort on, followed by a dot (.), followed by the sort direction, either "asc" or "desc". | |
| filter | query | string | Optional filter and sort criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon. | |
| offset | query | string | Starting index of overall result set from which to return ids. |
from falconpy import api_complete as FalconSDK
falcon = FalconSDK.APIHarness(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
}
)
PARAMS = {
'limit': integer,
'sort': 'string',
'filter': 'string',
'offset': 'string'
}
response = falcon.command('QueryRemediationsFilter', parameters=PARAMS)
print(response)
falcon.deauthenticate()
- Home
- Discussions Board
- Glossary of Terms
- Installation, Upgrades and Removal
- Samples Collection
- Using FalconPy
- API Operations
-
Service Collections
- Alerts
- API Integrations
- Cloud Connect AWS (deprecated)
- Cloud Snapshots
- Configuration Assessment
- Configuration Assessment Evaluation Logic
- Container Alerts
- Container Detections
- Container Images
- Container Packages
- Container Vulnerabilities
- CSPM Registration
- Custom IOAs
- Custom Storage
- D4C Registration (deprecated)
- Detects
- Device Control Policies
- Discover
- Drift Indicators
- Event Streams
- Exposure Management
- Falcon Complete Dashboard
- Falcon Container
- Falcon Intelligence Sandbox
- FDR
- FileVantage
- Firewall Management
- Firewall Policies
- Foundry LogScale
- Host Group
- Hosts
- Identity Protection
- Image Assessment Policies
- Incidents
- Installation Tokens
- Intel
- IOA Exclusions
- IOC
- IOCs (deprecated)
- Kubernetes Protection
- MalQuery
- Message Center
- ML Exclusions
- Mobile Enrollment
- MSSP (Flight Control)
- OAuth2
- ODS (On Demand Scan)
- Overwatch Dashboard
- Prevention Policy
- Quarantine
- Quick Scan
- Real Time Response
- Real Time Response Admin
- Real Time Response Audit
- Recon
- Report Executions
- Response Policies
- Sample Uploads
- Scheduled Reports
- Sensor Download
- Sensor Update Policy
- Sensor Visibility Exclusions
- Spotlight Evaluation Logic
- Spotlight Vulnerabilities
- Tailored Intelligence
- ThreatGraph
- Unidentified Containers
- User Management
- Workflows
- Zero Trust Assessment
- Documentation Support
-
CrowdStrike SDKs
- Crimson Falcon - Ruby
- FalconPy - Python 3
- FalconJS - Javascript
- goFalcon - Go
- PSFalcon - Powershell
- Rusty Falcon - Rust
