Content Update Policies - CrowdStrike/falconpy GitHub Wiki

CrowdStrike Falcon CrowdStrike Subreddit

Using the Content Update Policies service collection

Uber class support Service class support Documentation Version Page Updated

Table of Contents

Operation ID Description
queryCombinedContentUpdatePolicyMembers
PEP8 query_policy_members_combined
Search for members of a Content Update Policy in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria.
queryCombinedContentUpdatePolicies
PEP8 query_policies_combined
Search for Content Update Policies in your environment by providing an FQL filter and paging details. Returns a set of Content Update Policies which match the filter criteria.
performContentUpdatePoliciesAction
PEP8 perform_action
Perform the specified action on the Content Update Policies specified in the request.
setContentUpdatePoliciesPrecedence
PEP8 set_precedence
Sets the precedence of Content Update Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies when updating precedence.
getContentUpdatePolicies
PEP8 get_policies
Retrieve a set of Content Update Policies by specifying their IDs.
createContentUpdatePolicies
PEP8 create_policies
Create Content Update Policies by specifying details about the policy to create.
deleteContentUpdatePolicies
PEP8 delete_policies
Delete a set of Content Update Policies by specifying their IDs.
updateContentUpdatePolicies
PEP8 update_policies
Update Content Update Policies by specifying the ID of the policy and details to update.
queryContentUpdatePolicyMembers
PEP8 query_policy_members
Search for members of a Content Update Policy in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria.
queryContentUpdatePolicies
PEP8 query_policies
Search for Content Update Policies in your environment by providing an FQL filter and paging details. Returns a set of Content Update Policy IDs which match the filter criteria.

queryCombinedContentUpdatePolicyMembers

Search for members of a Content Update Policy in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria.

PEP8 method name

query_policy_members_combined

Endpoint

Method Route
GET /policy/combined/content-update-members/v1

Required Scope

content-update-policies:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
id Service Class Support Uber Class Support query string The ID of the Content Update Policy to search for members of.
filter Service Class Support Uber Class Support query string The filter expression that should be used to limit the results.
offset Service Class Support Uber Class Support query integer The offset to start retrieving records from.
limit Service Class Support Uber Class Support query integer The maximum records to return. [1-5000]
sort Service Class Support Uber Class Support query string The property to sort by.
parameters Service Class Support Uber Class Support query dictionary Full set of query string parameters in a JSON formatted dictionary.

Usage

Service class example (PEP8 syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.query_policy_members_combined(id="string",
                                                filter="string",
                                                offset=integer,
                                                limit=integer,
                                                sort="string"
                                                )
print(response)
Service class example (Operation ID syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.queryCombinedContentUpdatePolicyMembers(id="string",
                                                          filter="string",
                                                          offset=integer,
                                                          limit=integer,
                                                          sort="string"
                                                          )
print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryCombinedContentUpdatePolicyMembers",
                          id="string",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string"
                          )
print(response)

queryCombinedContentUpdatePolicies

Search for Content Update Policies in your environment by providing an FQL filter and paging details. Returns a set of Content Update Policies which match the filter criteria.

PEP8 method name

query_policies_combined

Endpoint

Method Route
GET /policy/combined/content-update/v1

Required Scope

content-update-policies:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter Service Class Support Uber Class Support query string The filter expression that should be used to limit the results.
offset Service Class Support Uber Class Support query integer The offset to start retrieving records from.
limit Service Class Support Uber Class Support query integer The maximum records to return. [1-5000]
sort Service Class Support Uber Class Support query string The property to sort by.
parameters Service Class Support Uber Class Support query dictionary Full set of query string parameters in a JSON formatted dictionary.

Usage

Service class example (PEP8 syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.query_policies_combined(filter="string",
                                          offset=integer,
                                          limit=integer,
                                          sort="string"
                                          )
print(response)
Service class example (Operation ID syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.queryCombinedContentUpdatePolicies(filter="string",
                                                     offset=integer,
                                                     limit=integer,
                                                     sort="string"
                                                     )
print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryCombinedContentUpdatePolicies",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string"
                          )
print(response)

performContentUpdatePoliciesAction

Perform the specified action on the Content Update Policies specified in the request.

PEP8 method name

perform_action

Endpoint

Method Route
POST /policy/entities/content-update-actions/v1

Required Scope

content-update-policies:write

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
action_name Service Class Support Uber Class Support query string The action to perform.
action_parameters Service Class Support Uber Class Support query dictionary or list of dictionaries Action specific parameter options.
body Service Class Support Uber Class Support body dictionary Full body payload as JSON formatted dictionary.
ids Service Class Support Uber Class Support body string or list of strings Content update policy IDs to perform action against.
parameters Service Class Support Uber Class Support query dictionary Full set of query string parameters in a JSON formatted dictionary.

Usage

Service class example (PEP8 syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

act_params = {
    "name": "string",
    "value": "string"
}

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.perform_action(action_name="string",
                                 action_parameters=act_params,
                                 ids=id_list
                                 )
print(response)
Service class example (Operation ID syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

act_params = {
    "name": "string",
    "value": "string"
}

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.performContentUpdatePoliciesAction(action_name="string",
                                                     action_parameters=act_params,
                                                     ids=id_list
                                                     )
print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
  "action_parameters": [
    {
      "name": "string",
      "value": "string"
    }
  ],
  "ids": [
    "string"
  ]
}

response = falcon.command("performContentUpdatePoliciesAction",
                          action_name="string",
                          body=body_payload
                          )
print(response)

setContentUpdatePoliciesPrecedence

Sets the precedence of Content Update Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies when updating precedence.

PEP8 method name

set_precedence

Endpoint

Method Route
POST /policy/entities/content-update-precedence/v1

Required Scope

content-update-policies:write

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
body Service Class Support Uber Class Support body dictionary Full body payload as JSON formatted dictionary.
ids Service Class Support Uber Class Support body string or list of strings ID list in precedence order.

Usage

Service class example (PEP8 syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.set_precedence(ids=id_list)

print(response)
Service class example (Operation ID syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.setContentUpdatePoliciesPrecedence(ids=id_list)

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
  "ids": [
    "string"
  ]
}

response = falcon.command("setContentUpdatePoliciesPrecedence", body=body_payload)

print(response)

getContentUpdatePolicies

Retrieve a set of Content Update Policies by specifying their IDs.

PEP8 method name

get_policies

Endpoint

Method Route
GET /policy/entities/content-update/v1

Required Scope

content-update-policies:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
ids Service Class Support Uber Class Support query string or list of strings Content update policy IDs to return.
parameters Service Class Support Uber Class Support query dictionary Full set of query string parameters in a JSON formatted dictionary.

Usage

Service class example (PEP8 syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_policies(ids=id_list)

print(response)
Service class example (Operation ID syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getContentUpdatePolicies(ids=id_list)

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getContentUpdatePolicies", ids=id_list)

print(response)

createContentUpdatePolicies

Create Content Update Policies by specifying details about the policy to create.

PEP8 method name

create_policies

Endpoint

Method Route
POST /policy/entities/content-update/v1

Required Scope

content-update-policies:write

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
body Service Class Support Uber Class Support body dictionary Full body payload as JSON formatted dictionary.
description Service Class Support Uber Class Support body string Content Update policy description.
name Service Class Support Uber Class Support body string Content Update policy name.
settings Service Class Support Uber Class Support body dictionary Content Update policy settings.

Usage

Service class example (PEP8 syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

policy_settings = {
    "ring_assignment_settings": [
        {
            "delay_hours": "string",
            "id": "string",
            "ring_assignment": "string"
        }
    ]
}

response = falcon.create_policies(description="string", name="string", settings=policy_settings)

print(response)
Service class example (Operation ID syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

policy_settings = {
    "ring_assignment_settings": [
        {
            "delay_hours": "string",
            "id": "string",
            "ring_assignment": "string"
        }
    ]
}

response = falcon.createContentUpdatePolicies(description="string",
                                              name="string",
                                              settings=policy_settings
                                              )
print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
  "resources": [
    {
      "description": "string",
      "name": "string",
      "settings": {
        "ring_assignment_settings": [
          {
            "delay_hours": "string",
            "id": "string",
            "ring_assignment": "string"
          }
        ]
      }
    }
  ]
}

response = falcon.command("createContentUpdatePolicies", body=body_payload)

print(response)

deleteContentUpdatePolicies

Delete a set of Content Update Policies by specifying their IDs.

PEP8 method name

delete_policies

Endpoint

Method Route
DELETE /policy/entities/content-update/v1

Required Scope

content-update-policies:write

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
ids Service Class Support Uber Class Support query string or list of strings Content update policy IDs to remove.
parameters Service Class Support Uber Class Support query dictionary Full set of query string parameters in a JSON formatted dictionary.

Usage

Service class example (PEP8 syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_policies(ids=id_list)

print(response)
Service class example (Operation ID syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteContentUpdatePolicies(ids=id_list)

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deleteContentUpdatePolicies", ids=id_list)

print(response)

updateContentUpdatePolicies

Update Content Update Policies by specifying the ID of the policy and details to update.

PEP8 method name

update_policies

Endpoint

Method Route
PATCH /policy/entities/content-update/v1

Required Scope

content-update-policies:write

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
body Service Class Support Uber Class Support body dictionary Full body payload as JSON formatted dictionary.
description Service Class Support Uber Class Support body string Content Update policy description.
id Service Class Support Uber Class Support body string Content Update policy ID to update.
name Service Class Support Uber Class Support body string Content Update policy name.
settings Service Class Support Uber Class Support body dictionary Content Update policy settings.

Usage

Service class example (PEP8 syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

policy_settings = {
    "ring_assignment_settings": [
        {
            "delay_hours": "string",
            "id": "string",
            "ring_assignment": "string"
        }
    ]
}

response = falcon.update_policies(description="string",
                                  id="string",
                                  name="string",
                                  settings=policy_settings
                                  )
print(response)
Service class example (Operation ID syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

policy_settings = {
    "ring_assignment_settings": [
        {
            "delay_hours": "string",
            "id": "string",
            "ring_assignment": "string"
        }
    ]
}

response = falcon.updateContentUpdatePolicies(description="string",
                                              id="string",
                                              name="string",
                                              settings=policy_settings
                                              )
print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
  "resources": [
    {
      "description": "string",
      "id": "string",
      "name": "string",
      "settings": {
        "ring_assignment_settings": [
          {
            "delay_hours": "string",
            "id": "string",
            "ring_assignment": "string"
          }
        ]
      }
    }
  ]
}

response = falcon.command("updateContentUpdatePolicies", body=body_payload)

print(response)

queryContentUpdatePolicyMembers

Search for members of a Content Update Policy in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria.

PEP8 method name

query_policy_members

Endpoint

Method Route
GET /policy/queries/content-update-members/v1

Required Scope

content-update-policies:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
id Service Class Support Uber Class Support query string The ID of the Content Update Policy to search for members of.
filter Service Class Support Uber Class Support query string The filter expression that should be used to limit the results.
offset Service Class Support Uber Class Support query integer The offset to start retrieving records from.
limit Service Class Support Uber Class Support query integer The maximum records to return. [1-5000]
sort Service Class Support Uber Class Support query string The property to sort by.
parameters Service Class Support Uber Class Support query dictionary Full set of query string parameters in a JSON formatted dictionary.

Usage

Service class example (PEP8 syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.query_policy_members(id="string",
                                       filter="string",
                                       offset=integer,
                                       limit=integer,
                                       sort="string"
                                       )
print(response)
Service class example (Operation ID syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.queryContentUpdatePolicyMembers(id="string",
                                                  filter="string",
                                                  offset=integer,
                                                  limit=integer,
                                                  sort="string"
                                                  )
print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryContentUpdatePolicyMembers",
                          id="string",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string"
                          )
print(response)

queryContentUpdatePolicies

Search for Content Update Policies in your environment by providing an FQL filter and paging details. Returns a set of Content Update Policy IDs which match the filter criteria.

PEP8 method name

query_policies

Endpoint

Method Route
GET /policy/queries/content-update/v1

Required Scope

content-update-policies:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter Service Class Support Uber Class Support query string The filter expression that should be used to limit the results.
offset Service Class Support Uber Class Support query integer The offset to start retrieving records from.
limit Service Class Support Uber Class Support query integer The maximum records to return. [1-5000]
sort Service Class Support Uber Class Support query string The property to sort by.
parameters Service Class Support Uber Class Support query dictionary Full set of query string parameters in a JSON formatted dictionary.

Usage

Service class example (PEP8 syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.query_policies(filter="string",
                                 offset=integer,
                                 limit=integer,
                                 sort="string"
                                 )
print(response)
Service class example (Operation ID syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.queryContentUpdatePolicies(filter="string",
                                             offset=integer,
                                             limit=integer,
                                             sort="string"
                                             )
print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryContentUpdatePolicies",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string"
                          )
print(response)

⚠️ **GitHub.com Fallback** ⚠️