Cloud Azure Registration - CrowdStrike/falconpy GitHub Wiki

CrowdStrike Falcon CrowdStrike Subreddit

Using the Cloud Azure Registration service collection

Uber class support Service class support Documentation Version Page Updated

Table of Contents

Operation ID Description
cloud_registration_azure_create_registration
PEP 8 create_registration
Create an Azure registration for a tenant.
cloud_registration_azure_delete_legacy_subscription
PEP 8 delete_legacy_subscription
Delete existing legacy Azure subscriptions.
cloud_registration_azure_delete_registration
PEP 8 delete_registration
Deletes existing Azure registrations.
cloud_registration_azure_download_script
PEP 8 download_script
Retrieve script to create resources
cloud_registration_azure_get_registration
PEP 8 get_registration
Retrieve existing Azure registration for a tenant.
cloud_registration_azure_trigger_health_check
PEP 8 health_check
Trigger health check scan for Azure registrations
cloud_registration_azure_update_registration
PEP 8 update_registration
Update an existing Azure registration for a tenant.
cloud_registration_azure_validate_registration
PEP 8 validate_registration
Validate an Azure registration by checking service principal, role assignments and deployment stack
download_azure_script
PEP 8 deployment_script
Download Azure deployment script (Terraform or Bicep)
cloud_registration_azure_delete_legacy_subscription
PEP 8 delete_legacy_subscription
Delete existing legacy Azure subscriptions.
cloud_registration_azure_trigger_health_check
PEP 8 health_check
Trigger health check scan for Azure registrations
cloud_registration_azure_validate_registration
PEP 8 validate_registration
Validate an Azure registration by checking service principal, role assignments and deployment stack (if the deployment method is Bicep)

Passing credentials

WARNING

client_id and client_secret are keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

cloud_registration_azure_get_registration

Retrieve existing Azure registration for a tenant.

PEP8 method name

get_registration

Endpoint

Method Route
GET /cloud-security-registration-azure/entities/registrations/v1

Required Scope

cloud-azure-registration:read

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
tenant_id Service Class Support Uber Class Support query string Tenant ID
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import CloudAzureRegistration

# Do not hardcode API credentials!
falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.get_registration(tenant_id="string")
print(response)
Service class example (Operation ID syntax)
from falconpy import CloudAzureRegistration

# Do not hardcode API credentials!
falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.cloud_registration_azure_get_registration(tenant_id="string")
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("cloud_registration_azure_get_registration", tenant_id="string")
print(response)

cloud_registration_azure_create_registration

Create an Azure registration for a tenant.

PEP8 method name

create_registration

Endpoint

Method Route
POST /cloud-security-registration-azure/entities/registrations/v1

Required Scope

cloud-azure-registration:write

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
body Service Class Support Uber Class Support body dictionary Full body payload in JSON format.
account_type Service Class Support Uber Class Support body string Azure account type.
tenant_id Service Class Support Uber Class Support body string Azure tenant ID.
subscription_ids Service Class Support Uber Class Support body string or list of strings Azure subscription IDs.

Usage

Service class example (PEP8 syntax)
from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.create_registration(tenant_id="string", 
                                     account_type="string", 
                                     subscription_ids=["string1", "string2"])

print(response)
Service class example (Operation ID syntax)
from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_create_registration(tenant_id="string", 
                                                             account_type="string", 
                                                             subscription_ids=["string1", "string2"])

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body = {
    "resource": {
        "tenant_id": "string",
        "account_type": "string",
        "subscription_ids": ["string1", "string2"]
    }
}

response = falcon.command("cloud_registration_azure_create_registration", body=body_payload)

print(response)

cloud_registration_azure_update_registration

Update an existing Azure registration for a tenant.

PEP8 method name

update_registration

Endpoint

Method Route
PATCH /cloud-security-registration-azure/entities/registrations/v1

Required Scope

cloud-azure-registration:write

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
body Service Class Support Uber Class Support body dictionary Full body payload in JSON format.
account_type Service Class Support Uber Class Support body string Azure account type.
tenant_id Service Class Support Uber Class Support body string Azure tenant ID.
subscription_ids Service Class Support Uber Class Support body string or list of strings Azure subscription IDs.

Usage

Service class example (PEP8 syntax)
from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.update_registration(tenant_id="string", 
                                     account_type="string", 
                                     subscription_ids=["string1", "string2"])

print(response)
Service class example (Operation ID syntax)
from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_update_registration(tenant_id="string", 
                                                             account_type="string", 
                                                             subscription_ids=["string1", "string2"])

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body = {
    "resource": {
        "tenant_id": "string",
        "account_type": "string",
        "subscription_ids": ["string1", "string2"]
    }
}

response = falcon.command("cloud_registration_azure_update_registration", body=body_payload)

print(response)

cloud_registration_azure_delete_registration

Deletes existing Azure registrations.

PEP8 method name

delete_registration

Endpoint

Method Route
DELETE /cloud-security-registration-azure/entities/registrations/v1

Required Scope

cloud-azure-registration:write

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
tenant_ids Service Class Support Uber Class Support query string or list of strings Azure tenant IDs
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.delete_registration(tenant_ids=["string1", "string2"])

print(response)
Service class example (Operation ID syntax)
from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_delete_registration(tenant_ids=["string1", "string2"])

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("cloud_registration_azure_delete_registration", tenant_ids=["string1", "string2"])

print(response)

download_azure_script

Download Azure deployment script (Terraform or Bicep)

PEP8 method name

deployment_script

Endpoint

Method Route
GET /cloud-security-registration-azure/entities/scripts/v1

Required Scope

cloud-azure-registration:read

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
tenant_id Service Class Support Uber Class Support query string Azure tenant ID
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.deployment_script(tenant_id="string")

print(response)
Service class example (Operation ID syntax)
from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.download_azure_script(tenant_id="string")

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("download_azure_script", tenant_id="string")

print(response)

Back to Table of Contents

cloud_registration_azure_delete_legacy_subscription

Delete existing legacy Azure subscriptions.

PEP8 method name

delete_legacy_subscription

Endpoint

Method Route
DELETE /cloud-security-registration-azure/entities/accounts/legacy/v1

Required Scope

cloud-azure-registration:write

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
body
Service Class Support
No Uber Class Support
 body string
parameters
Service Class Support
Uber Class Support
 query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import CloudAzureRegistration

# Do not hardcode API credentials!
falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.delete_legacy_subscription(body="string"
                                             )
print(response)
Service class example (Operation ID syntax)
from falconpy import CloudAzureRegistration

# Do not hardcode API credentials!
falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_delete_legacy_subscription(body="string"
                                                                      )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("cloud_registration_azure_delete_legacy_subscription")
print(response)

Back to Table of Contents

cloud_registration_azure_trigger_health_check

Trigger health check scan for Azure registrations

PEP8 method name

health_check

Endpoint

Method Route
POST /cloud-security-registration-azure/entities/registrations/healthcheck/v1

Required Scope

cloud-azure-registration:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
tenant_ids
Service Class Support
Uber Class Support
 query list Azure tenant IDs
parameters
Service Class Support
Uber Class Support
 query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import CloudAzureRegistration

# Do not hardcode API credentials!
falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.health_check(tenant_ids=["string"]
                               )
print(response)
Service class example (Operation ID syntax)
from falconpy import CloudAzureRegistration

# Do not hardcode API credentials!
falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_trigger_health_check(tenant_ids=["string"]
                                                                )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("cloud_registration_azure_trigger_health_check",
                          tenant_ids=["string"]
                          )
print(response)

Back to Table of Contents

cloud_registration_azure_validate_registration

Validate an Azure registration by checking service principal, role assignments and deployment stack (if the deployment method is Bicep)

PEP8 method name

validate_registration

Endpoint

Method Route
POST /cloud-security-registration-azure/entities/registrations/validate/v1

Required Scope

cloud-azure-registration:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
tenant_id
Service Class Support
Uber Class Support
 query string Azure tenant ID to be validated
stack_name
Service Class Support
Uber Class Support
 query string Azure deployment stack name to be validated
parameters
Service Class Support
Uber Class Support
 query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import CloudAzureRegistration

# Do not hardcode API credentials!
falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.validate_registration(tenant_id="string",
                                        stack_name="string"
                                        )
print(response)
Service class example (Operation ID syntax)
from falconpy import CloudAzureRegistration

# Do not hardcode API credentials!
falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_validate_registration(tenant_id="string",
                                                                 stack_name="string"
                                                                 )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("cloud_registration_azure_validate_registration",
                          tenant_id="string",
                          stack_name="string"
                          )
print(response)

Back to Table of Contents

cloud_registration_azure_download_script

Retrieve script to create resources

PEP8 method name

download_script

Endpoint

Method Route
POST /cloud-security-registration-azure/entities/scripts/v1

Required Scope

cloud-azure-registration:write

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
body Service Class Support Uber Class Support body dictionary Full body payload in JSON format.
tenant_id Service Class Support Uber Class Support body string Azure tenant ID.

Usage

Service class example (PEP8 syntax)
from falconpy import CloudAzureRegistration

# Do not hardcode API credentials!
falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.download_script(tenant_id="string")

print(response)
Service class example (Operation ID syntax)
from falconpy import CloudAzureRegistration

# Do not hardcode API credentials!
falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_download_script(tenant_id="string")

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "tenantId": "string"
        }
    ]
}

response = falcon.command("cloud_registration_azure_download_script", body=body_payload)

print(response)

⚠️ **GitHub.com Fallback** ⚠️