Custom Storage - CrowdStrike/falconpy GitHub Wiki

CrowdStrike Falcon CrowdStrike Subreddit

Using the Custom Storage service collection

Uber class support Service class support Documentation Version Page Updated

Table of Contents

Operation ID Description
ListObjects
PEP8 list
List the object keys in the specified collection in alphabetical order
SearchObjects
PEP8 search
Search for objects that match the specified filter criteria (returns metadata, not actual objects)
GetObject
PEP8 get
Get the bytes for the specified object
PutObject
PEP8 upload
Put the specified new object at the given key or overwrite an existing object at the given key
DeleteObject
PEP8 delete
Delete the specified object
GetObjectMetadata
PEP8 metadata
Get the metadata for the specified object
ListObjectsByVersion
PEP8 list_by_version
List the object keys in the specified collection in alphabetical order
SearchObjectsByVersion
PEP8 search_by_version
Search for objects that match the specified filter criteria (returns metadata, not actual objects)
GetVersionedObject
PEP8 get_version
Get the bytes for the specified object
PutObjectByVersion
PEP8 upload_version
Put the specified new object at the given key or overwrite an existing object at the given key
DeleteVersionedObject
PEP8 delete_version
Delete the specified versioned object
GetVersionedObjectMetadata
PEP8 version_metadata
Get the metadata for the specified object

Passing credentials

WARNING

client_id and client_secret are keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

ListObjects

List the object keys in the specified collection in alphabetical order

PEP8 method name

list

Endpoint

Method Route
GET /customobjects/v1/collections/{collection_name}/objects

Required Scope

custom-storage:read

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
collection_name Service Class Support Uber Class Support path string The name of the collection
end Service Class Support Uber Class Support query string The end key to end listing to
limit Service Class Support Uber Class Support query integer The limit of results to return
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.
start Service Class Support Uber Class Support query string The start key to start listing from

Usage

Service class example (PEP8 syntax)
from falconpy import CustomStorage

# Do not hardcode API credentials!
falcon = CustomStorage(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.list(end="string",
                       limit=integer,
                       start="string",
                       collection_name="string"
                       )
print(response)
Service class example (Operation ID syntax)
from falconpy import CustomStorage

# Do not hardcode API credentials!
falcon = CustomStorage(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.ListObjects(end="string",
                              limit=integer,
                              start="string",
                              collection_name="string"
                              )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ListObjects",
                          end="string"
                          limit=integer,
                          start="string",
                          collection_name="string"
                          )
print(response)

SearchObjects

Search for objects that match the specified filter criteria (returns metadata, not actual objects)

PEP8 method name

search

Endpoint

Method Route
POST /customobjects/v1/collections/{collection_name}/objects

Required Scope

custom-storage:read

Content-Type

  • Consumes: application/octet-stream
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
collection_name Service Class Support Uber Class Support path string The name of the collection
filter Service Class Support Uber Class Support query string The filter to limit the returned results.
limit Service Class Support Uber Class Support query integer The limit of results to return
offset Service Class Support Uber Class Support query integer The offset of results to return
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.
sort Service Class Support Uber Class Support query string The sort order for the returned results.

Usage

Service class example (PEP8 syntax)
from falconpy import CustomStorage

# Do not hardcode API credentials!
falcon = CustomStorage(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.search(filter="string",
                         limit=integer,
                         offset=integer,
                         sort="string",
                         collection_name="string"
                         )
print(response)
Service class example (Operation ID syntax)
from falconpy import CustomStorage

# Do not hardcode API credentials!
falcon = CustomStorage(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.SearchObjects(filter="string",
                                limit=integer,
                                offset=integer,
                                sort="string",
                                collection_name="string"
                                )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("SearchObjects",
                          filter="string",
                          limit=integer,
                          offset=integer,
                          sort="string",
                          collection_name="string"
                          )
print(response)

GetObject

Get the bytes for the specified object

PEP8 method name

get

Endpoint

Method Route
GET /customobjects/v1/collections/{collection_name}/objects/{object_key}

Required Scope

custom-storage:read

Content-Type

  • Consumes: application/json
  • Produces: application/octet-stream

Keyword Arguments

Name Service Uber Type Data type Description
collection_name Service Class Support Uber Class Support path string The name of the collection
object_key Service Class Support Uber Class Support path string The object key

Usage

Service class example (PEP8 syntax)
from falconpy import CustomStorage

# Do not hardcode API credentials!
falcon = CustomStorage(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

with open("some_file.ext", "wb", encoding="utf-8") as save_file:
    save_file.write(falcon.get(collection_name="string", object_key="string"))
Service class example (Operation ID syntax)
from falconpy import CustomStorage

# Do not hardcode API credentials!
falcon = CustomStorage(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

with open("some_file.ext", "wb", encoding="utf-8") as save_file:
    save_file.write(falcon.GetObject(collection_name="string", object_key="string"))
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

with open("some_file.ext", "wb", encoding="utf-8") as save_file:
    save_file.write(falcon.command("GetObject", collection_name="string", object_key="string"))

PutObject

Put the specified new object at the given key or overwrite an existing object at the given key

PEP8 method name

upload

Endpoint

Method Route
PUT /customobjects/v1/collections/{collection_name}/objects/{object_key}

Required Scope

custom-storage:write

Content-Type

  • Consumes: application/octet-stream
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
body Service Class Support Uber Class Support body string The object to be uploaded in binary format.
collection_name Service Class Support Uber Class Support path string The name of the collection.
dry_run Service Class Support Uber Class Support query boolean If false, run the operation as normal. If true, validate that the request would succeed, but don't execute it.
object_key Service Class Support Uber Class Support path string The object key.
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.
schema_version Service Class Support Uber Class Support query string The version of the collection schema.

Usage

Service class example (PEP8 syntax)
from falconpy import CustomStorage

# Do not hardcode API credentials!
falcon = CustomStorage(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )
with open("some_file.ext", "rb") as upload_file:
    response = falcon.upload(body=upload_file.read(),
                             collection_name="string",
                             dry_run=boolean,
                             object_key="string",
                             schema_version="string"
                             )
print(response)
Service class example (Operation ID syntax)
from falconpy import CustomStorage

# Do not hardcode API credentials!
falcon = CustomStorage(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )
with open("some_file.ext", "rb") as upload_file:
    response = falcon.PutObject(body=upload_file.read(),
                                collection_name="string",
                                dry_run=boolean,
                                object_key="string",
                                schema_version="string"
                                )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

with open("some_file.ext", "rb") as upload_file:
    response = falcon.command("PutObject",
                              body=upload_file.read(),
                              collection_name="string",
                              dry_run=boolean,
                              object_key="string",
                              schema_version="string"
                              )
print(response)

DeleteObject

Delete the specified object

PEP8 method name

delete

Endpoint

Method Route
DELETE /customobjects/v1/collections/{collection_name}/objects/{object_key}

Required Scope

custom-storage:write

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
collection_name Service Class Support Uber Class Support path string The name of the collection
dry_run Service Class Support Uber Class Support query boolean If false, run the operation as normal. If true, validate that the request would succeed, but don't execute it.
object_key Service Class Support Uber Class Support path string The object key
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import CustomStorage

# Do not hardcode API credentials!
falcon = CustomStorage(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.delete(collection_name="string", object_key="string", dry_run=boolean)

print(response)
Service class example (Operation ID syntax)
from falconpy import CustomStorage

# Do not hardcode API credentials!
falcon = CustomStorage(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.DeleteObject(collection_name="string", object_key="string", dry_run=boolean)

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("DeleteObject",
                          collection_name="string",
                          object_key="string",
                          dry_run=boolean
                          )
print(response)

GetObjectMetadata

Get the metadata for the specified object

PEP8 method name

metadata

Endpoint

Method Route
GET /customobjects/v1/collections/{collection_name}/objects/{object_key}/metadata

Required Scope

custom-storage:read

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
collection_name Service Class Support Uber Class Support path string The name of the collection
object_key Service Class Support Uber Class Support path string The object key

Usage

Service class example (PEP8 syntax)
from falconpy import CustomStorage

# Do not hardcode API credentials!
falcon = CustomStorage(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.metadata(collection_name="string", object_key="string")
print(response)
Service class example (Operation ID syntax)
from falconpy import CustomStorage

# Do not hardcode API credentials!
falcon = CustomStorage(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.GetObjectMetadata(collection_name="string", object_key="string")
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetObjectMetadata", collection_name="string", object_key="string")
print(response)

ListObjectsByVersion

List the object keys in the specified collection in alphabetical order

PEP8 method name

list_by_version

Endpoint

Method Route
GET /customobjects/v1/collections/{collection_name}/{collection_version}/objects

Required Scope

custom-storage:read

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
collection_name Service Class Support Uber Class Support path string The name of the collection
collection_version Service Class Support Uber Class Support path string The version of the collection
end Service Class Support Uber Class Support query string The end key to end listing to
limit Service Class Support Uber Class Support query integer The limit of results to return
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.
start Service Class Support Uber Class Support query string The start key to start listing from

Usage

Service class example (PEP8 syntax)
from falconpy import CustomStorage

# Do not hardcode API credentials!
falcon = CustomStorage(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.list_by_version(end="string",
                                  limit=integer,
                                  start="string",
                                  collection_name="string",
                                  collection_version="string"
                                  )
print(response)
Service class example (Operation ID syntax)
from falconpy import CustomStorage

# Do not hardcode API credentials!
falcon = CustomStorage(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.ListObjectsByVersion(end="string",
                                       limit=integer,
                                       start="string",
                                       collection_name="string",
                                       collection_version="string"
                                       )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ListObjectsByVersion",
                          end="string"
                          limit=integer,
                          start="string",
                          collection_name="string",
                          collection_version="string"
                          )
print(response)

SearchObjectsByVersion

Search for objects that match the specified filter criteria (returns metadata, not actual objects)

PEP8 method name

search_by_version

Endpoint

Method Route
POST /customobjects/v1/collections/{collection_name}/{collection_version}/objects

Required Scope

custom-storage:read

Content-Type

  • Consumes: application/octet-stream
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
collection_name Service Class Support Uber Class Support path string The name of the collection
collection_version Service Class Support Uber Class Support path string The version of the collection
filter Service Class Support Uber Class Support query string The filter to limit the returned results.
limit Service Class Support Uber Class Support query integer The limit of results to return
offset Service Class Support Uber Class Support query integer The offset of results to return
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.
sort Service Class Support Uber Class Support query string The sort order for the returned results.

Usage

Service class example (PEP8 syntax)
from falconpy import CustomStorage

# Do not hardcode API credentials!
falcon = CustomStorage(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.search_by_version(filter="string",
                                    limit=integer,
                                    offset=integer,
                                    sort="string",
                                    collection_name="string",
                                    collection_version="string"
                                    )
print(response)
Service class example (Operation ID syntax)
from falconpy import CustomStorage

# Do not hardcode API credentials!
falcon = CustomStorage(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.SearchObjectsByVersion(filter="string",
                                         limit=integer,
                                         offset=integer,
                                         sort="string",
                                         collection_name="string",
                                         collection_version="string"
                                         )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("SearchObjectsByVersion",
                          filter="string",
                          limit=integer,
                          offset=integer,
                          sort="string",
                          collection_name="string",
                          collection_version="string"
                          )
print(response)

GetVersionedObject

Get the bytes for the specified object

PEP8 method name

get_version

Endpoint

Method Route
GET /customobjects/v1/collections/{collection_name}/{collection_version}/objects/{object_key}

Required Scope

custom-storage:read

Content-Type

  • Consumes: application/json
  • Produces: application/octet-stream

Keyword Arguments

Name Service Uber Type Data type Description
collection_name Service Class Support Uber Class Support path string The name of the collection
collection_version Service Class Support Uber Class Support path string The version of the collection
object_key Service Class Support Uber Class Support path string The object key

Usage

Service class example (PEP8 syntax)
from falconpy import CustomStorage

# Do not hardcode API credentials!
falcon = CustomStorage(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

with open("some_file.ext", "wb", encoding="utf-8") as save_file:
    save_file.write(falcon.get(collection_name="string",
                               collection_version="string",
                               object_key="string"
                               ))
Service class example (Operation ID syntax)
from falconpy import CustomStorage

# Do not hardcode API credentials!
falcon = CustomStorage(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

with open("some_file.ext", "wb", encoding="utf-8") as save_file:
    save_file.write(falcon.GetObject(collection_name="string",
                                     collection_version="string",
                                     object_key="string"
                                     ))
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

with open("some_file.ext", "wb", encoding="utf-8") as save_file:
    save_file.write(falcon.command("GetObject",
                                   collection_name="string",
                                   collection_version="string",
                                   object_key="string"
                                   ))

PutObjectByVersion

Put the specified new object at the given key or overwrite an existing object at the given key

PEP8 method name

upload_version

Endpoint

Method Route
PUT /customobjects/v1/collections/{collection_name}/{collection_version}/objects/{object_key}

Required Scope

custom-storage:write

Content-Type

  • Consumes: application/octet-stream
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
body Service Class Support Uber Class Support body string The object to be uploaded in binary format.
collection_name Service Class Support Uber Class Support path string The name of the collection.
collection_version Service Class Support Uber Class Support path string The version of the collection.
dry_run Service Class Support Uber Class Support query boolean If false, run the operation as normal. If true, validate that the request would succeed, but don't execute it.
object_key Service Class Support Uber Class Support path string The object key.
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.
schema_version Service Class Support Uber Class Support query string The version of the collection schema.

Usage

Service class example (PEP8 syntax)
from falconpy import CustomStorage

# Do not hardcode API credentials!
falcon = CustomStorage(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )
with open("some_file.ext", "rb") as upload_file:
    response = falcon.upload(body=upload_file.read(),
                             collection_name="string",
                             collection_version="string",
                             dry_run=boolean,
                             object_key="string",
                             schema_version="string"
                             )
print(response)
Service class example (Operation ID syntax)
from falconpy import CustomStorage

# Do not hardcode API credentials!
falcon = CustomStorage(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )
with open("some_file.ext", "rb") as upload_file:
    response = falcon.PutObject(body=upload_file.read(),
                                collection_name="string",
                                collection_version="string",
                                dry_run=boolean,
                                object_key="string",
                                schema_version="string"
                                )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

with open("some_file.ext", "rb") as upload_file:
    response = falcon.command("PutObject",
                              body=upload_file.read(),
                              collection_name="string",
                              collection_version="string",
                              dry_run=boolean,
                              object_key="string",
                              schema_version="string"
                              )
print(response)

DeleteVersionedObject

Delete the specified versioned object

PEP8 method name

delete_version

Endpoint

Method Route
DELETE /customobjects/v1/collections/{collection_name}/{collection_version}/objects/{object_key}

Required Scope

custom-storage:write

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
collection_name Service Class Support Uber Class Support path string The name of the collection
collection_version Service Class Support Uber Class Support path string The version of the collection
dry_run Service Class Support Uber Class Support query boolean If false, run the operation as normal. If true, validate that the request would succeed, but don't execute it.
object_key Service Class Support Uber Class Support path string The object key
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import CustomStorage

# Do not hardcode API credentials!
falcon = CustomStorage(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.delete_version(collection_name="string",
                                 collection_version="string",
                                 object_key="string",
                                 dry_run=boolean
                                 )
print(response)
Service class example (Operation ID syntax)
from falconpy import CustomStorage

# Do not hardcode API credentials!
falcon = CustomStorage(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.DeleteVersionedObject(collection_name="string",
                                        collection_version="string",
                                        object_key="string",
                                        dry_run=boolean
                                        )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("DeleteVersionedObject",
                          collection_name="string",
                          collection_version="string",
                          object_key="string",
                          dry_run=boolean
                          )
print(response)

GetVersionedObjectMetadata

Get the metadata for the specified object

PEP8 method name

version_metadata

Endpoint

Method Route
GET /customobjects/v1/collections/{collection_name}/{collection_version}/objects/{object_key}/metadata

Required Scope

custom-storage:read

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
collection_name Service Class Support Uber Class Support path string The name of the collection
collection_version Service Class Support Uber Class Support path string The version of the collection
object_key Service Class Support Uber Class Support path string The object key

Usage

Service class example (PEP8 syntax)
from falconpy import CustomStorage

# Do not hardcode API credentials!
falcon = CustomStorage(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.version_metadata(collection_name="string",
                                   collection_version="string",
                                   object_key="string"
                                   )
print(response)
Service class example (Operation ID syntax)
from falconpy import CustomStorage

# Do not hardcode API credentials!
falcon = CustomStorage(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.GetVersionedObjectMetadata(collection_name="string",
                                             collection_version="string",
                                             object_key="string"
                                             )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetVersionedObjectMetadata",
                          collection_name="string",
                          collection_version="string",
                          object_key="string"
                          )
print(response)

⚠️ **GitHub.com Fallback** ⚠️