Falcon Complete Dashboard
| Operation ID | Description | ||||
|---|---|---|---|---|---|
|
Retrieve aggregate allowlist ticket values based on the matched filter | ||||
|
Retrieve aggregate blocklist ticket values based on the matched filter | ||||
|
Retrieve aggregate detection values based on the matched filter | ||||
|
Retrieve aggregate host/devices count based on the matched filter | ||||
|
Retrieve aggregate escalation ticket values based on the matched filter | ||||
|
Retrieve aggregate incident values based on the matched filter | ||||
|
Retrieve aggregate remediation ticket values based on the matched filter | ||||
|
Retrieve allowlist tickets that match the provided filter criteria with scrolling enabled | ||||
|
Retrieve block listtickets that match the provided filter criteria with scrolling enabled | ||||
|
Retrieve DetectionsIds that match the provided FQL filter, criteria with scrolling enabled | ||||
|
Retrieve device count collection Ids that match the provided FQL filter, criteria with scrolling enabled | ||||
|
Retrieve escalation tickets that match the provided filter criteria with scrolling enabled | ||||
|
Retrieve incidents that match the provided filter criteria with scrolling enabled | ||||
|
Retrieve remediation tickets that match the provided filter criteria with scrolling enabled | ||||
Retrieve aggregate allowlist ticket values based on the matched filter
aggregate_allow_list
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| body |
 |
 |
body | string | Full body payload in JSON format. |
| date_ranges |
|
 |
body | list of dictionaries | |
| field |
|
|
body | string | |
| filter |
|
|
body | string | FQL syntax |
| interval |
|
|
body | string | |
| min_doc_count |
|
|
body | integer | Minimum number of documents required to match. |
| missing |
|
|
body | string | |
| name |
|
|
body | string | |
| q |
|
|
body | string | FQL syntax |
| ranges |
|
|
body | list of dictionaries | |
| size |
|
|
body | integer | |
| sort |
|
|
body | string | FQL syntax |
| time_zone |
|
|
body | string | |
| type |
|
|
body | string |
from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
response = falcon.aggregate_allow_list(date_ranges=date_ranges,
field="string",
filter="string",
interval="string",
min_doc_count=integer,
missing="string",
name="string",
q="string",
ranges=ranges,
size=integer,
sort="string",
time_zone="string",
type="string"
)
print(response)from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
response = falcon.AggregateAllowList(date_ranges=date_ranges,
field="string",
filter="string",
interval="string",
min_doc_count=integer,
missing="string",
name="string",
q="string",
ranges=ranges,
size=integer,
sort="string",
time_zone="string",
type="string"
)
print(response)from falconpy import APIHarness
falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
BODY = [{
"date_ranges": date_ranges,
"field": "string",
"filter": "string",
"interval": "string",
"min_doc_count": 0,
"missing": "string",
"name": "string",
"q": "string",
"ranges": ranges,
"size": 0,
"sort": "string",
"sub_aggregates": [
null
],
"time_zone": "string",
"type": "string"
}]
response = falcon.command("AggregateAllowList", body=BODY)
print(response)Retrieve aggregate blocklist ticket values based on the matched filter
aggregate_block_list
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| body |
|
|
body | string | Full body payload in JSON format. |
| date_ranges |
|
|
body | list of dictionaries | |
| field |
|
|
body | string | |
| filter |
|
|
body | string | FQL syntax |
| interval |
|
|
body | string | |
| min_doc_count |
|
|
body | integer | Minimum number of documents required to match. |
| missing |
|
|
body | string | |
| name |
|
|
body | string | |
| q |
|
|
body | string | FQL syntax |
| ranges |
|
|
body | list of dictionaries | |
| size |
|
|
body | integer | |
| sort |
|
|
body | string | FQL syntax |
| time_zone |
|
|
body | string | |
| type |
|
|
body | string |
from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
response = falcon.aggregate_block_list(date_ranges=date_ranges,
field="string",
filter="string",
interval="string",
min_doc_count=integer,
missing="string",
name="string",
q="string",
ranges=ranges,
size=integer,
sort="string",
time_zone="string",
type="string"
)
print(response)from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
response = falcon.AggregateBlockList(date_ranges=date_ranges,
field="string",
filter="string",
interval="string",
min_doc_count=integer,
missing="string",
name="string",
q="string",
ranges=ranges,
size=integer,
sort="string",
time_zone="string",
type="string"
)
print(response)from falconpy import APIHarness
falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
BODY = [{
"date_ranges": date_ranges,
"field": "string",
"filter": "string",
"interval": "string",
"min_doc_count": 0,
"missing": "string",
"name": "string",
"q": "string",
"ranges": ranges,
"size": 0,
"sort": "string",
"sub_aggregates": [
null
],
"time_zone": "string",
"type": "string"
}]
response = falcon.command("AggregateBlockList", body=BODY)
print(response)Retrieve aggregate detection values based on the matched filter
aggregate_detections
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| body |
|
|
body | string | Full body payload in JSON format. |
| date_ranges |
|
|
body | list of dictionaries | |
| field |
|
|
body | string | |
| filter |
|
|
body | string | FQL syntax |
| interval |
|
|
body | string | |
| min_doc_count |
|
|
body | integer | Minimum number of documents required to match. |
| missing |
|
|
body | string | |
| name |
|
|
body | string | |
| q |
|
|
body | string | FQL syntax |
| ranges |
|
|
body | list of dictionaries | |
| size |
|
|
body | integer | |
| sort |
|
|
body | string | FQL syntax |
| time_zone |
|
|
body | string | |
| type |
|
|
body | string |
from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
response = falcon.aggregate_detections(date_ranges=date_ranges,
field="string",
filter="string",
interval="string",
min_doc_count=integer,
missing="string",
name="string",
q="string",
ranges=ranges,
size=integer,
sort="string",
time_zone="string",
type="string"
)
print(response)from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
response = falcon.AggregateDetections(date_ranges=date_ranges,
field="string",
filter="string",
interval="string",
min_doc_count=integer,
missing="string",
name="string",
q="string",
ranges=ranges,
size=integer,
sort="string",
time_zone="string",
type="string"
)
print(response)from falconpy import APIHarness
falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
BODY = [{
"date_ranges": date_ranges,
"field": "string",
"filter": "string",
"interval": "string",
"min_doc_count": 0,
"missing": "string",
"name": "string",
"q": "string",
"ranges": ranges,
"size": 0,
"sort": "string",
"sub_aggregates": [
null
],
"time_zone": "string",
"type": "string"
}]
response = falcon.command("AggregateDetections", body=BODY)
print(response)Retrieve aggregate host/devices count based on the matched filter
aggregate_device_count_collection
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| body |
|
|
body | string | Full body payload in JSON format. |
| date_ranges |
|
|
body | list of dictionaries | |
| field |
|
|
body | string | |
| filter |
|
|
body | string | FQL syntax |
| interval |
|
|
body | string | |
| min_doc_count |
|
|
body | integer | Minimum number of documents required to match. |
| missing |
|
|
body | string | |
| name |
|
|
body | string | |
| q |
|
|
body | string | FQL syntax |
| ranges |
|
|
body | list of dictionaries | |
| size |
|
|
body | integer | |
| sort |
|
|
body | string | FQL syntax |
| time_zone |
|
|
body | string | |
| type |
|
|
body | string |
from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
response = falcon.aggregate_device_count_collection(date_ranges=date_ranges,
field="string",
filter="string",
interval="string",
min_doc_count=integer,
missing="string",
name="string",
q="string",
ranges=ranges,
size=integer,
sort="string",
time_zone="string",
type="string"
)
print(response)from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
response = falcon.AggregateDeviceCountCollection(date_ranges=date_ranges,
field="string",
filter="string",
interval="string",
min_doc_count=integer,
missing="string",
name="string",
q="string",
ranges=ranges,
size=integer,
sort="string",
time_zone="string",
type="string"
)
print(response)from falconpy import APIHarness
falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
BODY = [{
"date_ranges": date_ranges,
"field": "string",
"filter": "string",
"interval": "string",
"min_doc_count": 0,
"missing": "string",
"name": "string",
"q": "string",
"ranges": ranges,
"size": 0,
"sort": "string",
"sub_aggregates": [
null
],
"time_zone": "string",
"type": "string"
}]
response = falcon.command("AggregateDeviceCountCollection", body=BODY)
print(response)Retrieve aggregate escalation ticket values based on the matched filter
aggregate_escalations
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| body |
|
|
body | string | Full body payload in JSON format. |
| date_ranges |
|
|
body | list of dictionaries | |
| field |
|
|
body | string | |
| filter |
|
|
body | string | FQL syntax |
| interval |
|
|
body | string | |
| min_doc_count |
|
|
body | integer | Minimum number of documents required to match. |
| missing |
|
|
body | string | |
| name |
|
|
body | string | |
| q |
|
|
body | string | FQL syntax |
| ranges |
|
|
body | list of dictionaries | |
| size |
|
|
body | integer | |
| sort |
|
|
body | string | FQL syntax |
| time_zone |
|
|
body | string | |
| type |
|
|
body | string |
from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
response = falcon.aggregate_escalations(date_ranges=date_ranges,
field="string",
filter="string",
interval="string",
min_doc_count=integer,
missing="string",
name="string",
q="string",
ranges=ranges,
size=integer,
sort="string",
time_zone="string",
type="string"
)
print(response)from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
response = falcon.AggregateEscalations(date_ranges=date_ranges,
field="string",
filter="string",
interval="string",
min_doc_count=integer,
missing="string",
name="string",
q="string",
ranges=ranges,
size=integer,
sort="string",
time_zone="string",
type="string"
)
print(response)from falconpy import APIHarness
falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
BODY = [{
"date_ranges": date_ranges,
"field": "string",
"filter": "string",
"interval": "string",
"min_doc_count": 0,
"missing": "string",
"name": "string",
"q": "string",
"ranges": ranges,
"size": 0,
"sort": "string",
"sub_aggregates": [
null
],
"time_zone": "string",
"type": "string"
}]
response = falcon.command("AggregateEscalations", body=BODY)
print(response)Retrieve aggregate incident values based on the matched filter
aggregate_fc_incidents
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| body |
|
|
body | string | Full body payload in JSON format. |
| date_ranges |
|
|
body | list of dictionaries | |
| field |
|
|
body | string | |
| filter |
|
|
body | string | FQL syntax |
| interval |
|
|
body | string | |
| min_doc_count |
|
|
body | integer | Minimum number of documents required to match. |
| missing |
|
|
body | string | |
| name |
|
|
body | string | |
| q |
|
|
body | string | FQL syntax |
| ranges |
|
|
body | list of dictionaries | |
| size |
|
|
body | integer | |
| sort |
|
|
body | string | FQL syntax |
| time_zone |
|
|
body | string | |
| type |
|
|
body | string |
from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
response = falcon.aggregate_fc_incidents(date_ranges=date_ranges,
field="string",
filter="string",
interval="string",
min_doc_count=integer,
missing="string",
name="string",
q="string",
ranges=ranges,
size=integer,
sort="string",
time_zone="string",
type="string"
)
print(response)from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
response = falcon.AggregateFCIncidents(date_ranges=date_ranges,
field="string",
filter="string",
interval="string",
min_doc_count=integer,
missing="string",
name="string",
q="string",
ranges=ranges,
size=integer,
sort="string",
time_zone="string",
type="string"
)
print(response)from falconpy import APIHarness
falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
BODY = [{
"date_ranges": date_ranges,
"field": "string",
"filter": "string",
"interval": "string",
"min_doc_count": 0,
"missing": "string",
"name": "string",
"q": "string",
"ranges": ranges,
"size": 0,
"sort": "string",
"sub_aggregates": [
null
],
"time_zone": "string",
"type": "string"
}]
response = falcon.command("AggregateFCIncidents", body=BODY)
print(response)Retrieve aggregate remediation ticket values based on the matched filter
aggregate_remediations
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| body |
|
|
body | string | Full body payload in JSON format. |
| date_ranges |
|
|
body | list of dictionaries | |
| field |
|
|
body | string | |
| filter |
|
|
body | string | FQL syntax |
| interval |
|
|
body | string | |
| min_doc_count |
|
|
body | integer | Minimum number of documents required to match. |
| missing |
|
|
body | string | |
| name |
|
|
body | string | |
| q |
|
|
body | string | FQL syntax |
| ranges |
|
|
body | list of dictionaries | |
| size |
|
|
body | integer | |
| sort |
|
|
body | string | FQL syntax |
| time_zone |
|
|
body | string | |
| type |
|
|
body | string |
from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
response = falcon.aggregate_remediations(date_ranges=date_ranges,
field="string",
filter="string",
interval="string",
min_doc_count=integer,
missing="string",
name="string",
q="string",
ranges=ranges,
size=integer,
sort="string",
time_zone="string",
type="string"
)
print(response)from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
response = falcon.AggregateRemediations(date_ranges=date_ranges,
field="string",
filter="string",
interval="string",
min_doc_count=integer,
missing="string",
name="string",
q="string",
ranges=ranges,
size=integer,
sort="string",
time_zone="string",
type="string"
)
print(response)from falconpy import APIHarness
falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
BODY = [{
"date_ranges": date_ranges,
"field": "string",
"filter": "string",
"interval": "string",
"min_doc_count": 0,
"missing": "string",
"name": "string",
"q": "string",
"ranges": ranges,
"size": 0,
"sort": "string",
"sub_aggregates": [
null
],
"time_zone": "string",
"type": "string"
}]
response = falcon.command("AggregateRemediations", body=BODY)
print(response)Retrieve allowlist tickets that match the provided filter criteria with scrolling enabled
query_allow_list_filter
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| filter |
|
|
query | string | Optional filter and sort criteria in the form of an FQL query. |
| limit |
|
|
query | integer | The maximum records to return. (Max: 500). |
| offset |
|
|
query | integer | Starting index of overall result set from which to return ids. |
| parameters |
|
|
query | string | Full query string parameters payload in JSON format. |
| sort |
|
|
query | string | The property to sort on, followed by a dot (.), followed by the sort direction, either asc or desc. |
from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
response = falcon.query_allow_list_filter(limit=integer,
sort="string",
filter="string",
offset="string"
)
print(response)from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
response = falcon.QueryAllowListFilter(limit=integer,
sort="string",
filter="string",
offset="string"
)
print(response)from falconpy import APIHarness
falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
response = falcon.command("QueryAllowListFilter",
limit=integer,
sort="string",
filter="string",
offset="string"
)
print(response)Retrieve block listtickets that match the provided filter criteria with scrolling enabled
query_block_list_filter
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| filter |
|
|
query | string | Optional filter and sort criteria in the form of an FQL query. |
| limit |
|
|
query | integer | The maximum records to return. (Max: 500). |
| offset |
|
|
query | integer | Starting index of overall result set from which to return ids. |
| parameters |
|
|
query | string | Full query string parameters payload in JSON format. |
| sort |
|
|
query | string | The property to sort on, followed by a dot (.), followed by the sort direction, either asc or desc. |
from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
response = falcon.query_block_list_filter(limit=integer,
sort="string",
filter="string",
offset="string"
)
print(response)from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
response = falcon.QueryBlockListFilter(limit=integer,
sort="string",
filter="string",
offset="string"
)
print(response)from falconpy import APIHarness
falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
response = falcon.command("QueryBlockListFilter",
limit=integer,
sort="string",
filter="string",
offset="string"
)
print(response)Retrieve DetectionsIds that match the provided FQL filter, criteria with scrolling enabled
query_detection_ids_by_filter
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| filter |
|
|
query | string | Optional filter and sort criteria in the form of an FQL query. |
| limit |
|
|
query | integer | The maximum records to return. (Max: 500). |
| offset |
|
|
query | integer | Starting index of overall result set from which to return ids. |
| parameters |
|
|
query | string | Full query string parameters payload in JSON format. |
| sort |
|
|
query | string | The property to sort on, followed by a dot (.), followed by the sort direction, either asc or desc. |
from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
response = falcon.query_detection_ids_by_filter(limit=integer,
sort="string",
filter="string",
offset="string"
)
print(response)from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
response = falcon.QueryDetectionIdsByFilter(limit=integer,
sort="string",
filter="string",
offset="string"
)
print(response)from falconpy import APIHarness
falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
response = falcon.command("QueryDetectionIdsByFilter",
limit=integer,
sort="string",
filter="string",
offset="string"
)
print(response)Retrieve device count collection Ids that match the provided FQL filter, criteria with scrolling enabled
get_device_count_collection_queries_by_filter
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| filter |
|
|
query | string | Optional filter and sort criteria in the form of an FQL query. |
| limit |
|
|
query | integer | The maximum records to return. (Max: 500). |
| offset |
|
|
query | integer | Starting index of overall result set from which to return ids. |
| parameters |
|
|
query | string | Full query string parameters payload in JSON format. |
| sort |
|
|
query | string | The property to sort on, followed by a dot (.), followed by the sort direction, either asc or desc. |
from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
response = falcon.get_device_count_collection_queries_by_filter(limit=integer,
sort="string",
filter="string",
offset="string"
)
print(response)from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
response = falcon.GetDeviceCountCollectionQueriesByFilter(limit=integer,
sort="string",
filter="string",
offset="string"
)
print(response)from falconpy import APIHarness
falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
response = falcon.command("GetDeviceCountCollectionQueriesByFilter",
limit=integer,
sort="string",
filter="string",
offset="string"
)
print(response)Retrieve escalation tickets that match the provided filter criteria with scrolling enabled
query_escalations_filter
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| filter |
|
|
query | string | Optional filter and sort criteria in the form of an FQL query. |
| limit |
|
|
query | integer | The maximum records to return. (Max: 500). |
| offset |
|
|
query | integer | Starting index of overall result set from which to return ids. |
| parameters |
|
|
query | string | Full query string parameters payload in JSON format. |
| sort |
|
|
query | string | The property to sort on, followed by a dot (.), followed by the sort direction, either asc or desc. |
from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
response = falcon.query_escalations_filter(limit=integer,
sort="string",
filter="string",
offset="string"
)
print(response)from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
response = falcon.QueryEscalationsFilter(limit=integer,
sort="string",
filter="string",
offset="string"
)
print(response)from falconpy import APIHarness
falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
response = falcon.command("QueryEscalationsFilter",
limit=integer,
sort="string",
filter="string",
offset="string"
)
print(response)Retrieve incidents that match the provided filter criteria with scrolling enabled
query_incident_ids_by_filter
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| filter |
|
|
query | string | Optional filter and sort criteria in the form of an FQL query. |
| limit |
|
|
query | integer | The maximum records to return. (Max: 500). |
| offset |
|
|
query | integer | Starting index of overall result set from which to return ids. |
| parameters |
|
|
query | string | Full query string parameters payload in JSON format. |
| sort |
|
|
query | string | The property to sort on, followed by a dot (.), followed by the sort direction, either asc or desc. |
from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
response = falcon.query_incident_ids_by_filter(limit=integer,
sort="string",
filter="string",
offset="string"
)
print(response)from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
response = falcon.QueryIncidentIdsByFilter(limit=integer,
sort="string",
filter="string",
offset="string"
)
print(response)from falconpy import APIHarness
falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
response = falcon.command("QueryIncidentIdsByFilter",
limit=integer,
sort="string",
filter="string",
offset="string"
)
print(response)Retrieve remediation tickets that match the provided filter criteria with scrolling enabled
query_remediations_filter
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| filter |
|
|
query | string | Optional filter and sort criteria in the form of an FQL query. |
| limit |
|
|
query | integer | The maximum records to return. (Max: 500). |
| offset |
|
|
query | integer | Starting index of overall result set from which to return ids. |
| parameters |
|
|
query | string | Full query string parameters payload in JSON format. |
| sort |
|
|
query | string | The property to sort on, followed by a dot (.), followed by the sort direction, either asc or desc. |
from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
response = falcon.query_remediations_filter(limit=integer,
sort="string",
filter="string",
offset="string"
)
print(response)from falconpy import CompleteDashboard
falcon = CompleteDashboard(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
response = falcon.QueryRemediationsFilter(limit=integer,
sort="string",
filter="string",
offset="string"
)
print(response)from falconpy import APIHarness
falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
response = falcon.command("QueryRemediationsFilter",
limit=integer,
sort="string",
filter="string",
offset="string"
)
print(response)
- Home
- Discussions Board
- Glossary of Terms
- Installation, Upgrades and Removal
- Samples Collection
- Using FalconPy
- API Operations
-
Service Collections
- Alerts
- API Integrations
- Cloud Connect AWS (deprecated)
- Cloud Snapshots
- Configuration Assessment
- Configuration Assessment Evaluation Logic
- Container Alerts
- Container Detections
- Container Images
- Container Packages
- Container Vulnerabilities
- CSPM Registration
- Custom IOAs
- Custom Storage
- D4C Registration (deprecated)
- Detects
- Device Control Policies
- Discover
- Drift Indicators
- Event Streams
- Exposure Management
- Falcon Complete Dashboard
- Falcon Container
- Falcon Intelligence Sandbox
- FDR
- FileVantage
- Firewall Management
- Firewall Policies
- Foundry LogScale
- Host Group
- Hosts
- Identity Protection
- Image Assessment Policies
- Incidents
- Installation Tokens
- Intel
- IOA Exclusions
- IOC
- IOCs (deprecated)
- Kubernetes Protection
- MalQuery
- Message Center
- ML Exclusions
- Mobile Enrollment
- MSSP (Flight Control)
- OAuth2
- ODS (On Demand Scan)
- Overwatch Dashboard
- Prevention Policy
- Quarantine
- Quick Scan
- Real Time Response
- Real Time Response Admin
- Real Time Response Audit
- Recon
- Report Executions
- Response Policies
- Sample Uploads
- Scheduled Reports
- Sensor Download
- Sensor Update Policy
- Sensor Visibility Exclusions
- Spotlight Evaluation Logic
- Spotlight Vulnerabilities
- Tailored Intelligence
- ThreatGraph
- Unidentified Containers
- User Management
- Workflows
- Zero Trust Assessment
- Documentation Support
-
CrowdStrike SDKs
- Crimson Falcon - Ruby
- FalconPy - Python 3
- FalconJS - Javascript
- goFalcon - Go
- PSFalcon - Powershell
- Rusty Falcon - Rust
