Cloud Security Detections - CrowdStrike/falconpy GitHub Wiki

CrowdStrike Falcon CrowdStrike Subreddit

Using the Cloud Security Detections service collection

Uber class support Service class support Documentation Version Page Updated

Table of Contents

Operation ID Description
cspm_evaluations_combined_iom_by_rule
PEP 8 get_combined_iom_by_rule
Return IOMs grouped by rule.
cspm_evaluations_iom_entities
PEP 8 get_iom_entities
Gets IOMs based on the provided IDs
cspm_evaluations_iom_queries
PEP 8 query_iom_entities
Gets a list of IOM IDs for the given parameters, filters and sort criteria.

Passing credentials

WARNING

client_id and client_secret are keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

cspm_evaluations_combined_iom_by_rule

Return IOMs grouped by rule.

PEP8 method name

get_combined_iom_by_rule

Endpoint

Method Route
GET /cloud-security-evaluations/combined/ioms-by-rule/v1

Required Scope

cloud-security-detections:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter Service Class Support Uber Class Support query string FQL string to filter results in Falcon Query Language (FQL). Supported fields: account_id account_name applicable_profile attack_type benchmark_name benchmark_version business_impact cid cloud_group cloud_label cloud_label_id cloud_provider cloud_scope created_at environment extension_status first_detected framework last_detected policy_id policy_name region requirement resource_gcrn resource_id resource_parent resource_status resource_type resource_type_name rule_group rule_id rule_name rule_origin section service service_category severity status suppressed_by tactic_id tactic_name tag_key tag_value tags tags_string technique_id technique_name zone
limit Service Class Support Uber Class Support query integer The maximum number of items to return. When not specified or 0, 500 is used. When larger than 1000, 1000 is used.
offset Service Class Support Uber Class Support query integer Offset returned assets.
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format. Not required when using other keywords.
sort Service Class Support Uber Class Support query string The field to sort on. Sortable fields include: assessed_assets cloud_provider misconfigurations rule_id severity. Use |asc or |desc suffix to specify sort direction.

Usage

Service class example (PEP8 syntax)
from falconpy import CloudSecurityDetections

# Do not hardcode API credentials!
falcon = CloudSecurityDetections(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.get_combined_iom_by_rule(filter="string",
                                           sort="string",
                                           limit=integer,
                                           offset=integer
                                           )

print(response)
Service class example (Operation ID syntax)
from falconpy import CloudSecurityDetections

# Do not hardcode API credentials!
falcon = CloudSecurityDetections(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.cspm_evaluations_combined_iom_by_rule(filter="string",
                                                        sort="string",
                                                        limit=integer,
                                                        offset=integer
                                                        )

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("cspm_evaluations_combined_iom_by_rule",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer
                          )

print(response)

Back to Table of Contents

cspm_evaluations_iom_entities

Gets IOMs based on the provided IDs

PEP8 method name

get_iom_entities

Endpoint

Method Route
GET /cloud-security-evaluations/entities/ioms/v1

Required Scope

cloud-security-detections:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
ids Service Class Support Uber Class Support query array (string) List of IOMs to return (maximum 100 IDs allowed). Use POST method with same path if more entities are required.
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format. Not required when using other keywords.

Usage

Service class example (PEP8 syntax)
from falconpy import CloudSecurityDetections

# Do not hardcode API credentials!
falcon = CloudSecurityDetections(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_iom_entities(ids=id_list)

print(response)
Service class example (Operation ID syntax)
from falconpy import CloudSecurityDetections

# Do not hardcode API credentials!
falcon = CloudSecurityDetections(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.cspm_evaluations_iom_entities(ids=id_list)

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("cspm_evaluations_iom_entities", ids=id_list)

print(response)

Back to Table of Contents

cspm_evaluations_iom_queries

Gets a list of IOM IDs for the given parameters, filters and sort criteria.

PEP8 method name

query_iom_entities

Endpoint

Method Route
GET /cloud-security-evaluations/queries/ioms/v1

Required Scope

cloud-security-detections:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
after Service Class Support Uber Class Support query string token-based pagination. Use for paginating through an entire result set. Use only one of 'offset' and 'after' parameters for paginating
filter Service Class Support Uber Class Support query string FQL string to filter results in Falcon Query Language (FQL). Supported fields: account_id account_name applicable_profile attack_type benchmark_name benchmark_version business_impact cid cloud_group cloud_label cloud_label_id cloud_provider cloud_scope created_at environment extension_status first_detected framework last_detected policy_id policy_name policy_uuid region requirement requirement_name resource_gcrn resource_id resource_parent resource_status resource_type resource_type_name rule_group rule_id rule_name rule_origin rule_remediation section service service_category severity status suppressed_by suppression_reason tactic_id tactic_name tag_key tag_value tags tags_string technique_id technique_name
limit Service Class Support Uber Class Support query integer The maximum number of items to return. When not specified or 0, 500 is used. When larger than 1000, 1000 is used.
offset Service Class Support Uber Class Support query integer Offset returned assets
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format. Not required when using other keywords.
sort Service Class Support Uber Class Support query string The field to sort on. Use |asc or |desc suffix to specify sort direction.Supported fields: account_id account_name applicable_profile attack_type benchmark_name benchmark_version business_impact cid cloud_group cloud_label cloud_label_id cloud_provider cloud_scope created_at environment extension_status first_detected framework last_detected policy_id policy_name policy_uuid region requirement requirement_name resource_gcrn resource_id resource_parent resource_status resource_type resource_type_name rule_group rule_id rule_name rule_origin rule_remediation section service service_category severity status suppressed_by suppression_reason tactic_id tactic_name tag_key tag_value tags tags_string technique_id technique_name

Usage

Service class example (PEP8 syntax)
from falconpy import CloudSecurityDetections

# Do not hardcode API credentials!
falcon = CloudSecurityDetections(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.query_iom_entities(filter="string",
                                     sort="string",
                                     limit=integer,
                                     offset=integer,
                                     after="string"
                                     )

print(response)
Service class example (Operation ID syntax)
from falconpy import CloudSecurityDetections

# Do not hardcode API credentials!
falcon = CloudSecurityDetections(client_id=CLIENT_ID,
                                 client_secret=CLIENT_SECRET
                                 )

response = falcon.cspm_evaluations_iom_queries(filter="string",
                                              sort="string",
                                              limit=integer,
                                              offset=integer,
                                              after="string"
                                              )

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("cspm_evaluations_iom_queries",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer,
                          after="string"
                          )

print(response)

Back to Table of Contents

⚠️ **GitHub.com Fallback** ⚠️