CAO Hunting - CrowdStrike/falconpy GitHub Wiki

CrowdStrike Falcon CrowdStrike Subreddit

Using the CAO Hunting service collection

Uber class support Service class support Documentation Version Page Updated

Table of Contents

Operation ID Description
AggregateHuntingGuides
PEP 8 aggregate_guides
Aggregate Hunting Guides
AggregateIntelligenceQueries
PEP 8 aggregate_queries
Aggregate intelligence queries.
GetArchiveExport
PEP 8 create_export_archive
Creates an Archive Export.
GetHuntingGuides
PEP 8 get_guides
Retrieves a list of Hunting Guides
GetIntelligenceQueries
PEP 8 get_queries
Retrieves a list of Intelligence queries.
SearchHuntingGuides
PEP 8 search_guides
Search for Hunting Guides that match the provided conditions
SearchIntelligenceQueries
PEP 8 search_queries
Search intelligence queries that match the provided conditions.

Passing credentials

WARNING

client_id and client_secret are keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

AggregateIntelligenceQueries

Aggregate intelligence queries.

PEP8 method name

aggregate_queries

Endpoint

Method Route
POST /hunting/aggregates/intelligence-queries/v1

Required Scope

cao-hunting:read

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
body Service Class Support Uber Class Support body dictionary Full body payload as a dictionary. Not required when using other keywords.
date_ranges Service Class Support No Uber Class Support body list of dictionaries Applies to date_range aggregations.

Example:
[
  {
    "from": "2016-05-28T09:00:31Z",
    "to": "2016-05-30T09:00:31Z"
  },
  {
    "from": "2016-06-01T09:00:31Z",
    "to": "2016-06-10T09:00:31Z"
  }
]
exclude Service Class Support No Uber Class Support body string Elements to exclude.
extended_bounds Service Class Support No Uber Class Support body dictionary Extended aggregate boundaries. Contains max and min values as strings.

Example:
  {
    "max": "string",
    "min": "string"
  }
field Service Class Support No Uber Class Support body string The field on which to compute the aggregation.
filter Service Class Support No Uber Class Support body string FQL syntax formatted string to use to filter the results.
from Service Class Support No Uber Class Support body integer Starting position.
include Service Class Support No Uber Class Support body string Elements to include.
interval Service Class Support No Uber Class Support body string Time interval for date histogram aggregations. Valid values include:
  • year
  • month
  • week
  • day
  • hour
  • minute
max_doc_count Service Class Support No Uber Class Support body integer Only return buckets if values are less than or equal to the value here.
min_doc_count Service Class Support No Uber Class Support body integer Only return buckets if values are greater than or equal to the value here.
missing Service Class Support No Uber Class Support body string Missing is the value to be used when the aggregation field is missing from the object. In other words, the missing parameter defines how documents that are missing a value should be treated. By default they will be ignored, but it is also possible to treat them as if they had a value.
name Service Class Support No Uber Class Support body string Name of the aggregate query, as chosen by the user. Used to identify the results returned to you.
q Service Class Support No Uber Class Support body string Full text search across all metadata fields.
ranges Service Class Support No Uber Class Support body list of dictionaries Applies to range aggregations. Ranges values will depend on field.

For example, if max_severity is used, ranges might look like:
[
  {
    "From": 0,
    "To": 70
  },
  {
    "From": 70,
    "To": 100
  }
]
size Service Class Support No Uber Class Support body integer The max number of term buckets to be returned.
sub_aggregates Service Class Support No Uber Class Support body list of dictionaries A nested aggregation, such as:
[
  {
    "name": "max_first_behavior",
    "type": "max",
    "field": "first_behavior"
  }
]

There is a maximum of 3 nested aggregations per request.
sort Service Class Support No Uber Class Support body string FQL syntax string to sort bucket results.
  • _count - sort by document count
  • _term - sort by the string value alphabetically
Supports asc and desc using | format.

Example: _count|desc
time_zone Service Class Support No Uber Class Support body string Time zone for bucket results.
type Service Class Support No Uber Class Support body string Type of aggregation. Valid values include:
  • date_histogram - Aggregates counts on a specified time interval. Requires use of “interval” field.
  • date_range - Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
  • terms - Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
  • range - Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.
  • cardinality - Returns the count of distinct values in a specified field.
  • max - Returns the maximum value of a specified field.
  • min - Returns the minimum value of a specified field.
  • avg - Returns the average value of the specified field.
  • sum - Returns the total sum of all values for the specified field.
  • percentiles - Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.

Usage

Service class example (PEP8 syntax)
from falconpy import CAOHunting

# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

date_range = {
    "from": "string",
    "to": "string"
}
bounds = {
    "max": "string",
    "min": "string"
}
search_range = {
    "From": integer,
    "To": integer
}

response = falcon.aggregate_queries(date_ranges=[date_range],
                                    exclude="string",
                                    extended_bounds=bounds,
                                    field="string",
                                    filter="string",
                                    from=integer,
                                    include="string",
                                    interval="string",
                                    max_doc_count=integer,
                                    min_doc_count=integer,
                                    missing="string",
                                    name="string",
                                    q="string",
                                    ranges=[search_range],
                                    size=integer,
                                    sort="string",
                                    time_zone="string",
                                    type="string"
                                    )
print(response)
Service class example (Operation ID syntax)
from falconpy import CAOHunting

# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

date_range = {
    "from": "string",
    "to": "string"
}
bounds = {
    "max": "string",
    "min": "string"
}
search_range = {
    "From": integer,
    "To": integer
}

response = falcon.AggregateIntelligenceQueries(date_ranges=[date_range],
                                               exclude="string",
                                               extended_bounds=bounds,
                                               field="string",
                                               filter="string",
                                               from=integer,
                                               include="string",
                                               interval="string",
                                               max_doc_count=integer,
                                               min_doc_count=integer,
                                               missing="string",
                                               name="string",
                                               q="string",
                                               ranges=[search_range],
                                               size=integer,
                                               sort="string",
                                               time_zone="string",
                                               type="string"
                                               )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = [
    {
        "date_ranges": [
            {
                "from": "string",
                "to": "string"
            }
        ],
        "exclude": "string",
        "extended_bounds": {
            "max": "string",
            "min": "string"
        },
        "field": "string",
        "filter": "string",
        "from": integer,
        "include": "string",
        "interval": "string",
        "max_doc_count": integer,
        "min_doc_count": integer,
        "missing": "string",
        "name": "string",
        "q": "string",
        "ranges": [
            {
                "From": integer,
                "To": integer
            }
        ],
        "size": integer,
        "sort": "string",
        "sub_aggregates": [
            null
        ],
        "time_zone": "string",
        "type": "string"
    }
]

response = falcon.command("AggregateIntelligenceQueries", body=body_payload)

print(response)

Back to Table of Contents

GetArchiveExport

Creates an Archive Export.

PEP8 method name

create_export_archive

Endpoint

Method Route
GET /hunting/entities/archive-exports/v1

Required Scope

cao-hunting:read

Content-Type

  • Produces: application/octet-stream

Keyword Arguments

Name Service Uber Type Data type Description
archive_type Service Class Support Uber Class Support query string The Archive Type can be one of 'zip' and 'gzip'. Defaults to 'zip'.
filter Service Class Support Uber Class Support query string The FQL Filter.
language Service Class Support Uber Class Support query string The Query Language. Accepted Values:
  • cql
  • snort
  • suricata
  • yara
  • SPL AI translated (Beta)
  • __all__ returns a single archive with queries in all the languages
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format. Not required when using other keywords.

Usage

Service class example (PEP8 syntax)
from falconpy import CAOHunting

# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

save_file = "some_file.ext"
with open(save_file, "wb") as file_output:
    file_output.write(falcon.create_export_archive(language="string",
                                        filter="string",
                                        archive_type="string"
                                        ))
Service class example (Operation ID syntax)
from falconpy import CAOHunting

# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

save_file = "some_file.ext"
with open(save_file, "wb") as file_output:
    file_output.write(falcon.GetArchiveExport(language="string",
                                              filter="string",
                                              archive_type="string"
                                              ))
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

save_file = "some_file.ext"
with open(save_file, "wb") as file_output:
    file_output.write(falcon.command("GetArchiveExport",
                                     language="string",
                                      filter="string",
                                      archive_type="string"
                                      ))

Back to Table of Contents

GetIntelligenceQueries

Retrieves a list of Intelligence queries.

PEP8 method name

get_queries

Endpoint

Method Route
GET /hunting/entities/intelligence-queries/v1

Required Scope

cao-hunting:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
ids Service Class Support Uber Class Support query string or list of strings Intelligence queries IDs.
include_translated_content Service Class Support Uber Class Support query string or list of strings The AI translated language that should be returned if it exists. Accepted values are: SPL, __all__.
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format. Not required when using other keywords.

Usage

Service class example (PEP8 syntax)
from falconpy import CAOHunting

# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']
translated_langs = 'SPL,__all__'  # Can also pass a list here: ['SPL', '__all__']

response = falcon.get_queries(ids=id_list,
                              include_translated_content=translated_langs
			      )

print(response)
Service class example (Operation ID syntax)
from falconpy import CAOHunting

# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']
translated_langs = 'SPL,__all__'  # Can also pass a list here: ['SPL', '__all__']

response = falcon.GetIntelligenceQueries(ids=id_list,
                                         include_translated_content=translated_langs
					 )

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']
translated_langs = 'SPL,__all__'  # Can also pass a list here: ['SPL', '__all__']

response = falcon.command("GetIntelligenceQueries",
                          ids=id_list,
                          include_translated_content=translated_langs
			  )

print(response)

Back to Table of Contents

SearchIntelligenceQueries

Search intelligence queries that match the provided conditions.

PEP8 method name

search_queries

Endpoint

Method Route
GET /hunting/queries/intelligence-queries/v1

Required Scope

cao-hunting:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter Service Class Support Uber Class Support query string FQL query specifying the filter parameters.
limit Service Class Support Uber Class Support query integer Number of IDs to return.
offset Service Class Support Uber Class Support query string Starting index of result set from which to return IDs.
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format. Not required when using other keywords.
q Service Class Support Uber Class Support query string Match phrase_prefix query criteria; included fields: _all (all filter string fields indexed).
sort Service Class Support Uber Class Support query string Order by fields.

Usage

Service class example (PEP8 syntax)
from falconpy import CAOHunting

# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.search_queries(offset="string",
                                 limit=integer,
                                 sort="string",
                                 filter="string",
                                 q="string"
                                 )
print(response)
Service class example (Operation ID syntax)
from falconpy import CAOHunting

# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.SearchIntelligenceQueries(offset="string",
                                            limit=integer,
                                            sort="string",
                                            filter="string",
                                            q="string"
                                            )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("SearchIntelligenceQueries",
                          offset="string",
                          limit=integer,
                          sort="string",
                          filter="string",
                          q="string"
                          )
print(response)

Back to Table of Contents

AggregateHuntingGuides

Aggregate Hunting Guides

PEP8 method name

aggregate_guides

Endpoint

Method Route
POST /hunting/aggregates/hunting-guides/v1

Required Scope

cao-hunting:read

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
body Service Class Support Uber Class Support body list of dictionaries Full body payload as a list of dictionaries. Not required when using other keywords.
date_ranges Service Class Support No Uber Class Support body list of dictionaries Applies to date_range aggregations.

Example:
[
  {
    "from": "2016-05-28T09:00:31Z",
    "to": "2016-05-30T09:00:31Z"
  },
  {
    "from": "2016-06-01T09:00:31Z",
    "to": "2016-06-10T09:00:31Z"
  }
]
exclude Service Class Support No Uber Class Support body string Elements to exclude.
extended_bounds Service Class Support No Uber Class Support body dictionary Extended aggregate boundaries. Contains max and min values as strings.

Example:
  {
    "max": "string",
    "min": "string"
  }
field Service Class Support No Uber Class Support body string The field on which to compute the aggregation.
filter Service Class Support No Uber Class Support body string FQL syntax formatted string to use to filter the results.
filters_spec Service Class Support No Uber Class Support body dictionary Filters specification containing filters, other_bucket, and other_bucket_key.

Example:
  {
    "filters": {
      "additionalProp1": "string",
      "additionalProp2": "string"
    },
    "other_bucket": boolean,
    "other_bucket_key": "string"
  }
from Service Class Support No Uber Class Support body integer Starting position.
include Service Class Support No Uber Class Support body string Elements to include.
interval Service Class Support No Uber Class Support body string Time interval for date histogram aggregations. Valid values include:
  • year
  • month
  • week
  • day
  • hour
  • minute
max_doc_count Service Class Support No Uber Class Support body integer Only return buckets if values are less than or equal to the value here.
min_doc_count Service Class Support No Uber Class Support body integer Only return buckets if values are greater than or equal to the value here.
missing Service Class Support No Uber Class Support body string Missing is the value to be used when the aggregation field is missing from the object. In other words, the missing parameter defines how documents that are missing a value should be treated. By default they will be ignored, but it is also possible to treat them as if they had a value.
name Service Class Support No Uber Class Support body string Name of the aggregate query, as chosen by the user. Used to identify the results returned to you.
percents Service Class Support No Uber Class Support body list of integers Percentile values for percentile aggregations.
q Service Class Support No Uber Class Support body string Full text search across all metadata fields.
ranges Service Class Support No Uber Class Support body list of dictionaries Applies to range aggregations. Ranges values will depend on field.

For example, if max_severity is used, ranges might look like:
[
  {
    "From": 0,
    "To": 70
  },
  {
    "From": 70,
    "To": 100
  }
]
size Service Class Support No Uber Class Support body integer The max number of term buckets to be returned.
sort Service Class Support No Uber Class Support body string FQL syntax string to sort bucket results.
  • _count - sort by document count
  • _term - sort by the string value alphabetically
Supports asc and desc using | format.

Example: _count|desc
sub_aggregates Service Class Support No Uber Class Support body list of dictionaries A nested aggregation, such as:
[
  {
    "name": "max_first_behavior",
    "type": "max",
    "field": "first_behavior"
  }
]

There is a maximum of 3 nested aggregations per request.
time_zone Service Class Support No Uber Class Support body string Time zone for bucket results.
type Service Class Support No Uber Class Support body string Type of aggregation. Valid values include:
  • date_histogram - Aggregates counts on a specified time interval. Requires use of "interval" field.
  • date_range - Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
  • terms - Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
  • cardinality - Returns the count of distinct values in a specified field.
  • max - Returns the maximum value of a specified field.
  • min - Returns the minimum value of a specified field.
  • avg - Returns the average value of the specified field.
  • sum - Returns the total sum of all values for the specified field.
  • percentiles - Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.

Usage

Service class example (PEP8 syntax)
from falconpy import CAOHunting

# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

date_range = {
    "from": "string",
    "to": "string"
}
bounds = {
    "max": "string",
    "min": "string"
}
filter_spec = {
    "filters": {
        "additionalProp1": "string",
        "additionalProp2": "string"
    },
    "other_bucket": boolean,
    "other_bucket_key": "string"
}
search_range = {
    "From": integer,
    "To": integer
}

response = falcon.aggregate_guides(date_ranges=[date_range],
                                   exclude="string",
                                   extended_bounds=bounds,
                                   field="string",
                                   filter="string",
                                   filters_spec=filter_spec,
                                   from=integer,
                                   include="string",
                                   interval="string",
                                   max_doc_count=integer,
                                   min_doc_count=integer,
                                   missing="string",
                                   name="string",
                                   percents=[integer],
                                   q="string",
                                   ranges=[search_range],
                                   size=integer,
                                   sort="string",
                                   time_zone="string",
                                   type="string"
                                   )
print(response)
Service class example (Operation ID syntax)
from falconpy import CAOHunting

# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

date_range = {
    "from": "string",
    "to": "string"
}
bounds = {
    "max": "string",
    "min": "string"
}
filter_spec = {
    "filters": {
        "additionalProp1": "string",
        "additionalProp2": "string"
    },
    "other_bucket": boolean,
    "other_bucket_key": "string"
}
search_range = {
    "From": integer,
    "To": integer
}

response = falcon.AggregateHuntingGuides(date_ranges=[date_range],
                                         exclude="string",
                                         extended_bounds=bounds,
                                         field="string",
                                         filter="string",
                                         filters_spec=filter_spec,
                                         from=integer,
                                         include="string",
                                         interval="string",
                                         max_doc_count=integer,
                                         min_doc_count=integer,
                                         missing="string",
                                         name="string",
                                         percents=[integer],
                                         q="string",
                                         ranges=[search_range],
                                         size=integer,
                                         sort="string",
                                         time_zone="string",
                                         type="string"
                                         )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )


body_payload = [
    {
        "date_ranges": [
        {
            "from": "string",
            "to": "string"
        }
        ],
        "exclude": "string",
        "extended_bounds": {
        "max": "string",
        "min": "string"
        },
        "field": "string",
        "filter": "string",
        "filters_spec": {
            "filters": {
                "additionalProp1": "string",
                "additionalProp2": "string",
                "additionalProp3": "string"
            },
            "other_bucket": boolean,
            "other_bucket_key": "string"
        },
        "from": integer,
        "include": "string",
        "interval": "string",
        "max_doc_count": integer,
        "min_doc_count": integer,
        "missing": "string",
        "name": "string",
        "percents": [
        integer
        ],
        "q": "string",
        "ranges": [
        {
            "From": integer,
            "To": integer
        }
        ],
        "size": integer,
        "sort": "string",
        "sub_aggregates": [
        null
        ],
        "time_zone": "string",
        "type": "string"
    }
]

response = falcon.command("AggregateHuntingGuides", body=body_payload)

print(response)

Back to Table of Contents

GetHuntingGuides

Retrieves a list of Hunting Guides

PEP8 method name

get_guides

Endpoint

Method Route
GET /hunting/entities/hunting-guides/v1

Required Scope

cao-hunting:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
ids Service Class Support Uber Class Support query string or list of strings Hunting Guides IDs. Required parameter.
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format. Not required when using other keywords.

Usage

Service class example (PEP8 syntax)
from falconpy import CAOHunting

# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_guides(ids=id_list)

print(response)
Service class example (Operation ID syntax)
from falconpy import CAOHunting

# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetHuntingGuides(ids=id_list)

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetHuntingGuides", ids=id_list)

print(response)

Back to Table of Contents

SearchHuntingGuides

Search for Hunting Guides that match the provided conditions

PEP8 method name

search_guides

Endpoint

Method Route
GET /hunting/queries/hunting-guides/v1

Required Scope

cao-hunting:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter Service Class Support Uber Class Support query string FQL query specifying the filter parameters.
limit Service Class Support Uber Class Support query integer Number of IDs to return.
offset Service Class Support Uber Class Support query string Starting index of result set from which to return IDs.
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format. Not required when using other keywords.
sort Service Class Support Uber Class Support query string Order by fields.
q Service Class Support Uber Class Support query string Match phrase_prefix query criteria; included fields: _all (all filter string fields indexed).

Usage

Service class example (PEP8 syntax)
from falconpy import CAOHunting

# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.search_guides(offset="string",
                                limit=integer,
                                sort="string",
                                filter="string",
                                q="string"
                                )

print(response)
Service class example (Operation ID syntax)
from falconpy import CAOHunting

# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.SearchHuntingGuides(offset="string",
                                      limit=integer,
                                      sort="string",
                                      filter="string",
                                      q="string"
                                      )

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("SearchHuntingGuides",
                          offset="string",
                          limit=integer,
                          sort="string",
                          filter="string",
                          q="string"
                          )
print(response)

Back to Table of Contents

⚠️ **GitHub.com Fallback** ⚠️