Host Migration - CrowdStrike/falconpy GitHub Wiki
| Operation ID | Description | ||||
|---|---|---|---|---|---|
|
Get host migration aggregates as specified via json in request body. | ||||
|
Get migration aggregates as specified via json in request body. | ||||
|
Perform an action on host migrations. | ||||
|
Get host migration details. | ||||
|
Get destinations for a migration. | ||||
|
Perform an action on a migration job. | ||||
|
Get migration job details. | ||||
|
Create a device migration job. | ||||
|
Query host migration IDs. | ||||
|
Query migration jobs. | ||||
WARNING
client_idandclient_secretare keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.
Get host migration aggregates as specified via json in request body.
aggregate_host_migration
| Method | Route |
|---|---|
/host-migration/aggregates/host-migrations/v1 |
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| body |
|
body | list of dictionaries | Full body payload in JSON format. | |
| date_ranges | body | list of dictionaries | Applies to date_range aggregations. Example: [ { "from": "2016-05-28T09:00:31Z", "to": "2016-05-30T09:00:31Z" }, { "from": "2016-06-01T09:00:31Z", "to": "2016-06-10T09:00:31Z" } ] |
||
| exclude | body | string | Elements to exclude. | ||
| field | body | string | The field on which to compute the aggregation. | ||
| filter | body | string | FQL syntax formatted string to use to filter the results. | ||
| from | body | integer | Starting position. | ||
| include | body | string | Elements to include. | ||
| interval | body | string | Time interval for date histogram aggregations. Valid values include:
|
||
| max_doc_count | body | integer | Only return buckets if values are less than or equal to the value here. | ||
| min_doc_count | body | integer | Only return buckets if values are greater than or equal to the value here. | ||
| missing | body | string | Missing is the value to be used when the aggregation field is missing from the object. In other words, the missing parameter defines how documents that are missing a value should be treated. By default they will be ignored, but it is also possible to treat them as if they had a value. | ||
| name | body | string | Name of the aggregate query, as chosen by the user. Used to identify the results returned to you. | ||
| q | body | string | Full text search across all metadata fields. | ||
| ranges | body | list of dictionaries | Applies to range aggregations. Ranges values will depend on field. For example, if max_severity is used, ranges might look like: [ { "From": 0, "To": 70 }, { "From": 70, "To": 100 } ] |
||
| size | body | integer | The max number of term buckets to be returned. | ||
| sub_aggregates | body | list of dictionaries | A nested aggregation, such as: [ { "name": "max_first_behavior", "type": "max", "field": "first_behavior" } ] There is a maximum of 3 nested aggregations per request. |
||
| sort | body | string |
FQL syntax string to sort bucket results.
asc and desc using | format. Example: _count|desc
|
||
| time_zone | body | string | Time zone for bucket results. | ||
| type | body | string | Type of aggregation. Valid values include:
|
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
response = falcon.aggregate_host_migration(date_ranges=date_ranges,
exclude="string",
field="string",
filter="string",
from=integer,
include="string",
interval="string",
max_doc_count=integer,
min_doc_count=integer,
missing="string",
name="string",
q="string",
ranges=ranges,
size=integer,
sort="string",
time_zone="string",
type="string"
)
print(response)from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
response = falcon.HostMigrationAggregatesV1(date_ranges=date_ranges,
exclude="string",
field="string",
filter="string",
from=integer,
include="string",
interval="string",
max_doc_count=integer,
min_doc_count=integer,
missing="string",
name="string",
q="string",
ranges=ranges,
size=integer,
sort="string",
time_zone="string",
type="string"
)
print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
body_payload = [{
"date_ranges": date_ranges,
"exclude": "string",
"field": "string",
"filter": "string",
"from": integer,
"include": "string",
"interval": "string",
"max_doc_count": integer,
"min_doc_count": integer,
"missing": "string",
"name": "string",
"q": "string",
"ranges": ranges,
"size": integer,
"sort": "string",
"sub_aggregates": [
null
]
"time_zone": "string",
"type": "string"
}]
response = falcon.command("HostMigrationAggregatesV1", body=body_payload)
print(response)Back to Table of Contents
Get migration aggregates as specified via json in request body.
aggregate_migration
| Method | Route |
|---|---|
/host-migration/aggregates/migrations/v1 |
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| body |
|
body | list of dictionaries | Full body payload in JSON format. | |
| date_ranges | body | list of dictionaries | Applies to date_range aggregations. Example: [ { "from": "2016-05-28T09:00:31Z", "to": "2016-05-30T09:00:31Z" }, { "from": "2016-06-01T09:00:31Z", "to": "2016-06-10T09:00:31Z" } ] |
||
| exclude | body | string | Elements to exclude. | ||
| field | body | string | The field on which to compute the aggregation. | ||
| filter | body | string | FQL syntax formatted string to use to filter the results. | ||
| from | body | integer | Starting position. | ||
| include | body | string | Elements to include. | ||
| interval | body | string | Time interval for date histogram aggregations. Valid values include:
|
||
| max_doc_count | body | integer | Only return buckets if values are less than or equal to the value here. | ||
| min_doc_count | body | integer | Only return buckets if values are greater than or equal to the value here. | ||
| missing | body | string | Missing is the value to be used when the aggregation field is missing from the object. In other words, the missing parameter defines how documents that are missing a value should be treated. By default they will be ignored, but it is also possible to treat them as if they had a value. | ||
| name | body | string | Name of the aggregate query, as chosen by the user. Used to identify the results returned to you. | ||
| q | body | string | Full text search across all metadata fields. | ||
| ranges | body | list of dictionaries | Applies to range aggregations. Ranges values will depend on field. For example, if max_severity is used, ranges might look like: [ { "From": 0, "To": 70 }, { "From": 70, "To": 100 } ] |
||
| size | body | integer | The max number of term buckets to be returned. | ||
| sub_aggregates | body | list of dictionaries | A nested aggregation, such as: [ { "name": "max_first_behavior", "type": "max", "field": "first_behavior" } ] There is a maximum of 3 nested aggregations per request. |
||
| sort | body | string |
FQL syntax string to sort bucket results.
asc and desc using | format. Example: _count|desc
|
||
| time_zone | body | string | Time zone for bucket results. | ||
| type | body | string | Type of aggregation. Valid values include:
|
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
response = falcon.aggregate_migration(date_ranges=date_ranges,
exclude="string",
field="string",
filter="string",
from=integer,
include="string",
interval="string",
max_doc_count=integer,
min_doc_count=integer,
missing="string",
name="string",
q="string",
ranges=ranges,
size=integer,
sort="string",
time_zone="string",
type="string"
)
print(response)from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
response = falcon.MigrationAggregatesV1(date_ranges=date_ranges,
exclude="string",
field="string",
filter="string",
from=integer,
include="string",
interval="string",
max_doc_count=integer,
min_doc_count=integer,
missing="string",
name="string",
q="string",
ranges=ranges,
size=integer,
sort="string",
time_zone="string",
type="string"
)
print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
date_ranges = [
{
"from": "2021-05-15T14:55:21.892315096Z",
"to": "2021-05-17T13:42:16.493180643Z"
}
]
ranges = [
{
"From": 1,
"To": 100
}
]
body_payload = [{
"date_ranges": date_ranges,
"exclude": "string",
"field": "string",
"filter": "string",
"from": integer,
"include": "string",
"interval": "string",
"max_doc_count": integer,
"min_doc_count": integer,
"missing": "string",
"name": "string",
"q": "string",
"ranges": ranges,
"size": integer,
"sort": "string",
"sub_aggregates": [
null
]
"time_zone": "string",
"type": "string"
}]
response = falcon.command("MigrationAggregatesV1", body=body_payload)
print(response)Back to Table of Contents
Perform an action on host migrations.
perform_host_migration_action
| Method | Route |
|---|---|
/host-migration/entities/host-migrations-actions/v1 |
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| action_name | query | string | The action to perform. Allowed actions: remove_hosts, remove_host_groups, add_host_groups. |
||
| action_parameters | body | dictionary | Action parameters payload to execute. | ||
| body | body | string | Full body payload as a JSON formatted dictionary. Not required if using other keyword arguments. | ||
| filter | body | string | FQL formatted filter to use to identify migration IDs to target. Allowed filters: groups, hostgroups, static_host_groups, hostname, status, target_cid, source_cid, migration_id, id, host_migration_id, and created_time. |
||
| id | query | string | The migration job to perform actions on. | ||
| ids | body | string or list of strings | Migration IDs to target. | ||
| parameters | query | dictionary | Full query string parameters payload in JSON format. |
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
action_parameters = [{
"name": "string",
"value": "string"
}]
response = falcon.perform_host_migration_action(action_name="string",
action_parameters=action_parameters,
filter="string",
id="string",
ids=id_list
)
print(response)from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
action_parameters = [{
"name": "string",
"value": "string"
}]
response = falcon.HostMigrationsActionsV1(action_name="string",
action_parameters=action_parameters,
filter="string",
id="string",
ids=id_list
)
print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = ['ID1', 'ID2', 'ID3']
body_payload = {
"action_parameters": [
{
"name": "string",
"value": "string"
}
],
"filter": "string",
"ids": id_list
}
response = falcon.command("HostMigrationsActionsV1",
action_name="string",
id="string",
body=body_payload
)
print(response)Back to Table of Contents
Get host migration details.
get_host_migration_details
| Method | Route |
|---|---|
/host-migration/entities/host-migrations/GET/v1 |
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| body | body | dictionary | Full body payload in JSON format. Not required when using other keywords. | ||
| ids | body | string or list of strings | Migration IDs to retrieve. |
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_host_migration_details(ids=id_list)
print(response)from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.GetHostMigrationsV1(ids=id_list)
print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("GetHostMigrationsV1", ids=id_list)
print(response)Back to Table of Contents
Get destinations for a migration.
get_migration_destination
| Method | Route |
|---|---|
/host-migration/entities/migration-destinations/GET/v1 |
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| body | body | string | Full body payload as a JSON formatted dictionary. Not required if using other keyword arguments. | ||
| filter | body | string | FQL formatted filter to use to identify migration IDs to target. Allowed filters: groups, hostgroups, static_host_groups, hostname, status, target_cid, source_cid, migration_id, id, host_migration_id, and created_time. |
||
| device_ids | body | string or list of strings | Device IDs to target. |
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_migration_destination(filter="string", device_ids=id_list)
print(response)from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.GetMigrationDestinationsV1(filter="string", device_ids=id_list)
print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = ['ID1', 'ID2', 'ID3']
body_payload = {
"device_ids": id_list,
"filter": "string"
}
response = falcon.command("GetMigrationDestinationsV1", body=body_payload)
print(response)Back to Table of Contents
Perform an action on a migration job.
perform_migration_job_action
| Method | Route |
|---|---|
/host-migration/entities/migrations-actions/v1 |
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| action_name | query | string | The action to perform. Allowed actions: start_migration, cancel_migration, rename_migration, and delete_migration. |
||
| action_parameters | body | dictionary | Action parameters payload to execute. | ||
| body | body | string | Full body payload as a JSON formatted dictionary. Not required if using other keyword arguments. | ||
| filter | body | string | FQL formatted filter to use to identify migration IDs to target. Allowed filters: groups, hostgroups, static_host_groups, hostname, status, target_cid, source_cid, migration_id, id, host_migration_id, and created_time. |
||
| ids | body | string or list of strings | Migration ID to target. | ||
| parameters | query | dictionary | Full query string parameters payload in JSON format. |
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
action_parameters = [{
"name": "string",
"value": "string"
}]
response = falcon.perform_migration_job_action(action_name="string",
action_parameters=action_parameters,
filter="string",
ids=id_list
)
print(response)from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
action_parameters = [{
"name": "string",
"value": "string"
}]
response = falcon.MigrationsActionsV1(action_name="string",
action_parameters=action_parameters,
filter="string",
ids=id_list
)
print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = ['ID1', 'ID2', 'ID3']
body_payload = {
"action_parameters": [
{
"name": "string",
"value": "string"
}
],
"filter": "string",
"ids": id_list
}
response = falcon.command("MigrationsActionsV1", action_name="string", body=body_payload)
print(response)Back to Table of Contents
Get migration job details.
get_migration_job_details
| Method | Route |
|---|---|
/host-migration/entities/migrations/v1 |
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| ids | query | string or list of strings | The migration jobs of interest. | ||
| parameters | query | dictionary | Full query string parameters payload in JSON format. |
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_migration_job_details(ids=id_list)
print(response)from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.GetMigrationsV1(ids=id_list)
print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("GetMigrationsV1", ids=id_list)
print(response)Create a device migration job.
create_migration
| Method | Route |
|---|---|
/host-migration/entities/migrations/v1 |
- Consumes: application/json
- Produces: application/json
The
device_idsandfilterarguments are mutually exclusive. When both are provided, thefilterargument takes precedence.
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| body | body | string | Full body payload as a JSON formatted dictionary. Not required if using other keyword arguments. | ||
| device_ids | body | string or list of strings | |||
| filter | body | string | FQL formatted filter to identify devices for the migration. | ||
| name | body | string | Name of the migration job. | ||
| target_cid | body | string | CID the migration job targets. |
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.create_migration(device_ids=id_list,
filter="string",
name="string",
target_cid="string"
)
print(response)from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.CreateMigrationV1(device_ids=id_list,
filter="string",
name="string",
target_cid="string"
)
print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = ['ID1', 'ID2', 'ID3']
body_payload = {
"device_ids": id_list,
"filter": "string",
"name": "string",
"target_cid": "string"
}
response = falcon.command("CreateMigrationV1", body=body_payload)
print(response)Back to Table of Contents
Query host migration IDs.
query_host_migration_ids
| Method | Route |
|---|---|
/host-migration/queries/host-migrations/v1 |
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| id | query | string | The migration job to query | ||
| filter | query | string | The filter expression that should be used to limit the results. Valid fields: static_host_groups, source_cid, migration_id, groups, hostgroups, target_cid, id, created_time, host_migration_id, hostname, and status
|
||
| limit | query | integer | The maximum records to return. [1-10000] | ||
| offset | query | integer | The offset to start retrieving records from | ||
| parameters | query | dictionary | Full query string parameters payload in JSON format. | ||
| sort | query | string | The property to sort by. Available fields: source_cid, id, created_time, static_host_group, hostname, status, target_cid, groups, hostgroups, migration_id, and host_migration_id
|
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.query_host_migration_ids(id="string",
offset=integer,
limit=integer,
sort="string",
filter="string"
)
print(response)from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.GetHostMigrationIDsV1(id="string",
offset=integer,
limit=integer,
sort="string",
filter="string"
)
print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.command("GetHostMigrationIDsV1",
id="string",
offset=integer,
limit=integer,
sort="string",
filter="string"
)
print(response)Back to Table of Contents
Query migration jobs.
query_migration_jobs
| Method | Route |
|---|---|
/host-migration/queries/migrations/v1 |
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| filter | query | string | The filter expression that should be used to limit the results. Valid fields: status, migration_status, created_by, created_time, name, id, migration_id, and target_cid
|
||
| limit | query | integer | The maximum records to return. [1-10000] | ||
| offset | query | integer | The offset to start retrieving records from | ||
| parameters | query | dictionary | Full query string parameters payload in JSON format. | ||
| sort | query | string | The property to sort by. Valid fields: migration_id, target_cid, status, migration_status, created_by, created_time, name, and id
|
from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.query_migration_jobs(offset=integer,
limit=integer,
sort="string",
filter="string"
)
print(response)from falconpy import HostMigration
falcon = HostMigration(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.GetMigrationIDsV1(offset=integer,
limit=integer,
sort="string",
filter="string"
)
print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.command("GetMigrationIDsV1",
offset=integer,
limit=integer,
sort="string",
filter="string"
)
print(response)Back to Table of Contents
