Host Migration - CrowdStrike/falconpy GitHub Wiki
Operation ID | Description | ||||
---|---|---|---|---|---|
|
Get host migration aggregates as specified via json in request body. | ||||
|
Get migration aggregates as specified via json in request body. | ||||
|
Perform an action on host migrations. | ||||
|
Get host migration details. | ||||
|
Get destinations for a migration. | ||||
|
Perform an action on a migration job. | ||||
|
Get migration job details. | ||||
|
Create a device migration job. | ||||
|
Query host migration IDs. | ||||
|
Query migration jobs. |
Get host migration aggregates as specified via json in request body.
aggregate_host_migration
Method | Route |
---|---|
/host-migration/aggregates/host-migrations/v1 |
- Consumes: application/json
- Produces: application/json
Name | Service | Uber | Type | Data type | Description |
---|---|---|---|---|---|
body |
|
body | list of dictionaries | Full body payload in JSON format. | |
date_ranges | body | list of dictionaries | Applies to date_range aggregations. Example: [ { "from": "2016-05-28T09:00:31Z", "to": "2016-05-30T09:00:31Z" }, { "from": "2016-06-01T09:00:31Z", "to": "2016-06-10T09:00:31Z" } ] |
||
exclude | body | string | Elements to exclude. | ||
field | body | string | The field on which to compute the aggregation. | ||
filter | body | string | FQL syntax formatted string to use to filter the results. | ||
from | body | integer | Starting position. | ||
include | body | string | Elements to include. | ||
interval | body | string | Time interval for date histogram aggregations. Valid values include:
|
||
max_doc_count | body | integer | Only return buckets if values are less than or equal to the value here. | ||
min_doc_count | body | integer | Only return buckets if values are greater than or equal to the value here. | ||
missing | body | string | Missing is the value to be used when the aggregation field is missing from the object. In other words, the missing parameter defines how documents that are missing a value should be treated. By default they will be ignored, but it is also possible to treat them as if they had a value. | ||
name | body | string | Name of the aggregate query, as chosen by the user. Used to identify the results returned to you. | ||
q | body | string | Full text search across all metadata fields. | ||
ranges | body | list of dictionaries | Applies to range aggregations. Ranges values will depend on field. For example, if max_severity is used, ranges might look like: [ { "From": 0, "To": 70 }, { "From": 70, "To": 100 } ] |
||
size | body | integer | The max number of term buckets to be returned. | ||
sub_aggregates | body | list of dictionaries | A nested aggregation, such as: [ { "name": "max_first_behavior", "type": "max", "field": "first_behavior" } ] There is a maximum of 3 nested aggregations per request. |
||
sort | body | string |
FQL syntax string to sort bucket results.
asc and desc using | format. Example: _count|desc
|
||
time_zone | body | string | Time zone for bucket results. | ||
type | body | string | Type of aggregation. Valid values include:
|
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
response = falcon.aggregate_host_migration(date_ranges=date_ranges,
exclude="string",
field="string",
filter="string",
from=integer,
include="string",
interval="string",
max_doc_count=integer,
min_doc_count=integer,
missing="string",
name="string",
q="string",
ranges=ranges,
size=integer,
sort="string",
time_zone="string",
type="string"
)
print(response)
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
response = falcon.HostMigrationAggregatesV1(date_ranges=date_ranges,
exclude="string",
field="string",
filter="string",
from=integer,
include="string",
interval="string",
max_doc_count=integer,
min_doc_count=integer,
missing="string",
name="string",
q="string",
ranges=ranges,
size=integer,
sort="string",
time_zone="string",
type="string"
)
print(response)
from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
body_payload = [{
"date_ranges": date_ranges,
"exclude": "string",
"field": "string",
"filter": "string",
"from": integer,
"include": "string",
"interval": "string",
"max_doc_count": integer,
"min_doc_count": integer,
"missing": "string",
"name": "string",
"q": "string",
"ranges": ranges,
"size": integer,
"sort": "string",
"sub_aggregates": [
null
]
"time_zone": "string",
"type": "string"
}]
response = falcon.command("HostMigrationAggregatesV1", body=body_payload)
print(response)
Back to Table of Contents
Get migration aggregates as specified via json in request body.
aggregate_migration
Method | Route |
---|---|
/host-migration/aggregates/migrations/v1 |
- Consumes: application/json
- Produces: application/json
Name | Service | Uber | Type | Data type | Description |
---|---|---|---|---|---|
body |
|
body | list of dictionaries | Full body payload in JSON format. | |
date_ranges | body | list of dictionaries | Applies to date_range aggregations. Example: [ { "from": "2016-05-28T09:00:31Z", "to": "2016-05-30T09:00:31Z" }, { "from": "2016-06-01T09:00:31Z", "to": "2016-06-10T09:00:31Z" } ] |
||
exclude | body | string | Elements to exclude. | ||
field | body | string | The field on which to compute the aggregation. | ||
filter | body | string | FQL syntax formatted string to use to filter the results. | ||
from | body | integer | Starting position. | ||
include | body | string | Elements to include. | ||
interval | body | string | Time interval for date histogram aggregations. Valid values include:
|
||
max_doc_count | body | integer | Only return buckets if values are less than or equal to the value here. | ||
min_doc_count | body | integer | Only return buckets if values are greater than or equal to the value here. | ||
missing | body | string | Missing is the value to be used when the aggregation field is missing from the object. In other words, the missing parameter defines how documents that are missing a value should be treated. By default they will be ignored, but it is also possible to treat them as if they had a value. | ||
name | body | string | Name of the aggregate query, as chosen by the user. Used to identify the results returned to you. | ||
q | body | string | Full text search across all metadata fields. | ||
ranges | body | list of dictionaries | Applies to range aggregations. Ranges values will depend on field. For example, if max_severity is used, ranges might look like: [ { "From": 0, "To": 70 }, { "From": 70, "To": 100 } ] |
||
size | body | integer | The max number of term buckets to be returned. | ||
sub_aggregates | body | list of dictionaries | A nested aggregation, such as: [ { "name": "max_first_behavior", "type": "max", "field": "first_behavior" } ] There is a maximum of 3 nested aggregations per request. |
||
sort | body | string |
FQL syntax string to sort bucket results.
asc and desc using | format. Example: _count|desc
|
||
time_zone | body | string | Time zone for bucket results. | ||
type | body | string | Type of aggregation. Valid values include:
|
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
response = falcon.aggregate_migration(date_ranges=date_ranges,
exclude="string",
field="string",
filter="string",
from=integer,
include="string",
interval="string",
max_doc_count=integer,
min_doc_count=integer,
missing="string",
name="string",
q="string",
ranges=ranges,
size=integer,
sort="string",
time_zone="string",
type="string"
)
print(response)
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
response = falcon.MigrationAggregatesV1(date_ranges=date_ranges,
exclude="string",
field="string",
filter="string",
from=integer,
include="string",
interval="string",
max_doc_count=integer,
min_doc_count=integer,
missing="string",
name="string",
q="string",
ranges=ranges,
size=integer,
sort="string",
time_zone="string",
type="string"
)
print(response)
from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
body_payload = [{
"date_ranges": date_ranges,
"exclude": "string",
"field": "string",
"filter": "string",
"from": integer,
"include": "string",
"interval": "string",
"max_doc_count": integer,
"min_doc_count": integer,
"missing": "string",
"name": "string",
"q": "string",
"ranges": ranges,
"size": integer,
"sort": "string",
"sub_aggregates": [
null
]
"time_zone": "string",
"type": "string"
}]
response = falcon.command("MigrationAggregatesV1", body=body_payload)
print(response)
Back to Table of Contents
Perform an action on host migrations.
perform_host_migration_action
Method | Route |
---|---|
/host-migration/entities/host-migrations-actions/v1 |
- Consumes: application/json
- Produces: application/json
Name | Service | Uber | Type | Data type | Description |
---|---|---|---|---|---|
action_name | query | string | The action to perform. Allowed actions: remove_hosts , remove_host_groups , add_host_groups . |
||
action_parameters | body | dictionary | Action parameters payload to execute. | ||
body | body | string | Full body payload as a JSON formatted dictionary. Not required if using other keyword arguments. | ||
filter | body | string | FQL formatted filter to use to identify migration IDs to target. Allowed filters: groups , hostgroups , static_host_groups , hostname , status , target_cid , source_cid , migration_id , id , host_migration_id , and created_time . |
||
id | query | string | The migration job to perform actions on. | ||
ids | body | string or list of strings | Migration IDs to target. | ||
parameters | query | dictionary | Full query string parameters payload in JSON format. |
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
action_parameters = [{
"name": "string",
"value": "string"
}]
response = falcon.perform_host_migration_action(action_name="string",
action_parameters=action_parameters,
filter="string",
id="string",
ids=id_list
)
print(response)
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
action_parameters = [{
"name": "string",
"value": "string"
}]
response = falcon.HostMigrationsActionsV1(action_name="string",
action_parameters=action_parameters,
filter="string",
id="string",
ids=id_list
)
print(response)
from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = ['ID1', 'ID2', 'ID3']
body_payload = {
"action_parameters": [
{
"name": "string",
"value": "string"
}
],
"filter": "string",
"ids": id_list
}
response = falcon.command("HostMigrationsActionsV1",
action_name="string",
id="string",
body=body_payload
)
print(response)
Back to Table of Contents
Get host migration details.
Eachobjectisdefinedbytheactionfield.
Method | Route |
---|---|
/host-migration/entities/host-migrations/GET/v1 |
- Consumes: application/json
- Produces: application/json
Name | Service | Uber | Type | Data type | Description |
---|---|---|---|---|---|
body | body | dictionary | Full body payload in JSON format. Not required when using other keywords. | ||
ids | body | string or list of strings | Migration IDs to retrieve. |
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.Eachobjectisdefinedbytheactionfield_(ids=id_list)
print(response)
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.GetHostMigrationsV1(ids=id_list)
print(response)
from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("GetHostMigrationsV1", ids=id_list)
print(response)
Back to Table of Contents
Get destinations for a migration.
get_migration_destination
Method | Route |
---|---|
/host-migration/entities/migration-destinations/GET/v1 |
- Consumes: application/json
- Produces: application/json
Name | Service | Uber | Type | Data type | Description |
---|---|---|---|---|---|
body | body | string | Full body payload as a JSON formatted dictionary. Not required if using other keyword arguments. | ||
filter | body | string | FQL formatted filter to use to identify migration IDs to target. Allowed filters: groups , hostgroups , static_host_groups , hostname , status , target_cid , source_cid , migration_id , id , host_migration_id , and created_time . |
||
device_ids | body | string or list of strings | Device IDs to target. |
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_migration_destination(filter="string", device_ids=id_list)
print(response)
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.GetMigrationDestinationsV1(filter="string", device_ids=id_list)
print(response)
from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = ['ID1', 'ID2', 'ID3']
body_payload = {
"device_ids": id_list,
"filter": "string"
}
response = falcon.command("GetMigrationDestinationsV1", body=body_payload)
print(response)
Back to Table of Contents
Perform an action on a migration job.
perform_migration_job_action
Method | Route |
---|---|
/host-migration/entities/migrations-actions/v1 |
- Consumes: application/json
- Produces: application/json
Name | Service | Uber | Type | Data type | Description |
---|---|---|---|---|---|
action_name | query | string | The action to perform. Allowed actions: start_migration , cancel_migration , rename_migration , and delete_migration . |
||
action_parameters | body | dictionary | Action parameters payload to execute. | ||
body | body | string | Full body payload as a JSON formatted dictionary. Not required if using other keyword arguments. | ||
filter | body | string | FQL formatted filter to use to identify migration IDs to target. Allowed filters: groups , hostgroups , static_host_groups , hostname , status , target_cid , source_cid , migration_id , id , host_migration_id , and created_time . |
||
ids | body | string or list of strings | Migration ID to target. | ||
parameters | query | dictionary | Full query string parameters payload in JSON format. |
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
action_parameters = [{
"name": "string",
"value": "string"
}]
response = falcon.perform_migration_job_action(action_name="string",
action_parameters=action_parameters,
filter="string",
ids=id_list
)
print(response)
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
action_parameters = [{
"name": "string",
"value": "string"
}]
response = falcon.MigrationsActionsV1(action_name="string",
action_parameters=action_parameters,
filter="string",
ids=id_list
)
print(response)
from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = ['ID1', 'ID2', 'ID3']
body_payload = {
"action_parameters": [
{
"name": "string",
"value": "string"
}
],
"filter": "string",
"ids": id_list
}
response = falcon.command("MigrationsActionsV1", action_name="string", body=body_payload)
print(response)
Back to Table of Contents
Get migration job details.
get_migration_job_details
Method | Route |
---|---|
/host-migration/entities/migrations/v1 |
- Consumes: application/json
- Produces: application/json
Name | Service | Uber | Type | Data type | Description |
---|---|---|---|---|---|
ids | query | string or list of strings | The migration jobs of interest. | ||
parameters | query | dictionary | Full query string parameters payload in JSON format. |
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_migration_job_details(ids=id_list)
print(response)
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.GetMigrationsV1(ids=id_list)
print(response)
from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("GetMigrationsV1", ids=id_list)
print(response)
Create a device migration job.
create_migration
Method | Route |
---|---|
/host-migration/entities/migrations/v1 |
- Consumes: application/json
- Produces: application/json
The
device_ids
andfilter
arguments are mutually exclusive. When both are provided, thefilter
argument takes precedence.
Name | Service | Uber | Type | Data type | Description |
---|---|---|---|---|---|
body | body | string | Full body payload as a JSON formatted dictionary. Not required if using other keyword arguments. | ||
device_ids | body | string or list of strings | |||
filter | body | string | FQL formatted filter to identify devices for the migration. | ||
name | body | string | Name of the migration job. | ||
target_cid | body | string | CID the migration job targets. |
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.create_migration(device_ids=id_list,
filter="string",
name="string",
target_cid="string"
)
print(response)
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.CreateMigrationV1(device_ids=id_list,
filter="string",
name="string",
target_cid="string"
)
print(response)
from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = ['ID1', 'ID2', 'ID3']
body_payload = {
"device_ids": id_list,
"filter": "string",
"name": "string",
"target_cid": "string"
}
response = falcon.command("CreateMigrationV1", body=body_payload)
print(response)
Back to Table of Contents
Query host migration IDs.
query_host_migration_ids
Method | Route |
---|---|
/host-migration/queries/host-migrations/v1 |
- Consumes: application/json
- Produces: application/json
Name | Service | Uber | Type | Data type | Description |
---|---|---|---|---|---|
id | query | string | The migration job to query | ||
filter | query | string | The filter expression that should be used to limit the results. Valid fields: static_host_groups , source_cid , migration_id , groups , hostgroups , target_cid , id , created_time , host_migration_id , hostname , status
|
||
limit | query | integer | The maximum records to return. [1-10000] | ||
offset | query | integer | The offset to start retrieving records from | ||
parameters | query | dictionary | Full query string parameters payload in JSON format. | ||
sort | query | string | The property to sort by. |
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.query_host_migration_ids(id="string",
offset=integer,
limit=integer,
sort="string",
filter="string"
)
print(response)
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.GetHostMigrationIDsV1(id="string",
offset=integer,
limit=integer,
sort="string",
filter="string"
)
print(response)
from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.command("GetHostMigrationIDsV1",
id="string",
offset=integer,
limit=integer,
sort="string",
filter="string"
)
print(response)
Back to Table of Contents
Query migration jobs.
query_migration_jobs
Method | Route |
---|---|
/host-migration/queries/migrations/v1 |
- Consumes: application/json
- Produces: application/json
Name | Service | Uber | Type | Data type | Description |
---|---|---|---|---|---|
filter | query | string | The filter expression that should be used to limit the results. Valid fields: status , migration_status , created_by , created_time , name , id , migration_id , target_cid
|
||
limit | query | integer | The maximum records to return. [1-10000] | ||
offset | query | integer | The offset to start retrieving records from | ||
parameters | query | dictionary | Full query string parameters payload in JSON format. | ||
sort | query | string | The property to sort by. |
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.query_migration_jobs(offset=integer,
limit=integer,
sort="string",
filter="string"
)
print(response)
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.GetMigrationIDsV1(offset=integer,
limit=integer,
sort="string",
filter="string"
)
print(response)
from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.command("GetMigrationIDsV1",
offset=integer,
limit=integer,
sort="string",
filter="string"
)
print(response)
Back to Table of Contents