Device Content - CrowdStrike/falconpy GitHub Wiki

CrowdStrike Falcon CrowdStrike Subreddit

Using the Device Content service collection

Uber class support Service class support Documentation Version Page Updated

Table of Contents

Operation ID Description
entities_states_v1
PEP8 get_states
Retrieve the host content state for a number of ids between 1 and 100.
queries_states_v1
PEP8 query_states
Query for the content state of the host.

entities_states_v1

Retrieve the host content state for a number of IDs between 1 and 100.

PEP8 method name

get_states

Endpoint

Method Route
GET /device-content/entities/states/v1

Required Scope

device-content:read

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
ids Service Class Support
 Uber Class Support query array (string) The IDs of the devices to fetch the content state of.
parameters Service Class Support
 Uber Class Support query dictionary Full query string parameters payload in JSON format. Not required if using other keywords.

Usage

Service class example (PEP8 syntax)
from falconpy import DeviceContent

falcon = DeviceContent(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_states(ids=id_list)

print(response)
Service class example (Operation ID syntax)
from falconpy import DeviceContent

falcon = DeviceContent(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_states_v1(ids=id_list)

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_states_v1", ids=id_list)

print(response)

queries_states_v1

Query for the content state of the host.

PEP8 method name

query_states

Endpoint

Method Route
GET /device-content/queries/states/v1

Required Scope

device-content:read

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter Service Class Support
 Uber Class Support query string The FQL search filter.
limit Service Class Support
 Uber Class Support query integer The max number of resource ids to return.
sort Service Class Support
 Uber Class Support query string What field to sort the results on.
offset Service Class Support
 Uber Class Support query integer The offset token returned from the previous query. If none was returned, there are no more pages to the result set.
parameters Service Class Support
 Uber Class Support query dictionary Full query string parameters payload in JSON format. Not required if using other keywords.

Usage

Service class example (PEP8 syntax)
from falconpy import DeviceContent

falcon = DeviceContent(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.query_states(limit=integer,
                               sort="string",
                               offset=integer,
                               filter="string"
                               )
print(response)
Service class example (Operation ID syntax)
from falconpy import DeviceContent

falcon = DeviceContent(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.queries_states_v1(limit=integer,
                                    sort="string",
                                    offset=integer,
                                    filter="string"
                                    )
print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_states_v1", 
                          limit=integer,
                          sort="string",
                          offset=integer,
                          filter="string"
                          )
print(response)

⚠️ **GitHub.com Fallback** ⚠️