IOA Exclusions - CrowdStrike/falconpy GitHub Wiki

CrowdStrike Falcon CrowdStrike Subreddit

Using the IOA Exclusions service collection

Uber class support Service class support Documentation Version Page Updated

Table of Contents

Operation ID Description
getIOAExclusionsV1
PEP 8 get_exclusions
Get a set of IOA Exclusions by specifying their IDs.
createIOAExclusionsV1
PEP 8 create_exclusions
Create the IOA exclusions.
deleteIOAExclusionsV1
PEP 8 delete_exclusions
Delete the IOA exclusions by ID.
updateIOAExclusionsV1
PEP 8 update_exclusions
Update the IOA exclusions.
queryIOAExclusionsV1
PEP 8 query_exclusions
Search for IOA exclusions.
ss_ioa_exclusions_aggregates_v2
PEP 8 get_ss_exclusion_aggregates
Get Self Service IOA Exclusion aggregates as specified via json in the request body.
ss_ioa_exclusions_get_reports_v2
PEP 8 get_ss_exclusion_reports_v2
Create a report of Self Service IOA Exclusions scoped by the given filters.
ss_ioa_exclusions_get_v2
PEP 8 get_ss_exclusion_rules_v2
Get the Self Service IOA Exclusions rules by id.
ss_ioa_exclusions_create_v2
PEP 8 create_ss_exclusions
Create new Self Service IOA Exclusions.
ss_ioa_exclusions_update_v2
PEP 8 update_ss_exclusions
Update the Self Service IOA Exclusions rule by id.
ss_ioa_exclusions_delete_v2
PEP 8 delete_ss_exclusions
Delete the Self Service IOA Exclusions rule by id.
ss_ioa_exclusions_matched_rule_v2
PEP 8 get_ss_exclusion_matched_rules
Get Self Service IOA Exclusions rules for matched IFN/CLI for child, parent and grandparent.
ss_ioa_exclusions_new_rules_v2
PEP 8 get_default_ss_exclusions
Get defaults for Self Service IOA Exclusions based on provided IFN/CLI for child, parent and grandparent.
ss_ioa_exclusions_search_v2
PEP 8 query_ss_exclusions
Search for Self Service IOA Exclusions.

Passing credentials

WARNING

client_id and client_secret are keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

getIOAExclusionsV1

Get a set of IOA Exclusions by specifying their IDs

PEP8 method name

get_exclusions

Endpoint

Method Route
GET /policy/entities/ioa-exclusions/v1

Required Scope

ioa-exclusions:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
ids
Service Class Support
Uber Class Support
 query string or list of strings The IDs of the exclusions to retrieve.
parameters
Service Class Support
Uber Class Support
 query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_exclusions(ids=id_list)
print(response)
Service class example (Operation ID syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getIOAExclusionsV1(ids=id_list)
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getIOAExclusionsV1", ids=id_list)
print(response)

Back to Table of Contents

createIOAExclusionsV1

Create the IOA exclusions

PEP8 method name

create_exclusions

Endpoint

Method Route
POST /policy/entities/ioa-exclusions/v1

Required Scope

ioa-exclusions_write:write

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
body
Service Class Support
Uber Class Support
 body dictionary Full body payload in JSON format.
cl_regex
Service Class Support
No Uber Class Support
 body string Command line regular expression.
comment
Service Class Support
No Uber Class Support
 body string String comment describing why the exclusions was created.
description
Service Class Support
No Uber Class Support
 body string Exclusion description.
detection_json
Service Class Support
No Uber Class Support
 body string JSON formatted detection template.
groups
Service Class Support
No Uber Class Support
 body list of strings Group ID(s) impacted by the exclusion.
ifn_regex
Service Class Support
No Uber Class Support
 body string Indicator file name regular expression.
name
Service Class Support
No Uber Class Support
 body string Name of the exclusion.
pattern_id
Service Class Support
No Uber Class Support
 body string ID of the pattern to use for the exclusion.
pattern_name
Service Class Support
No Uber Class Support
 body string Name of the pattern to use for the exclusion.

Usage

Service class example (PEP8 syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

group_list = ['ID1', 'ID2', 'ID3']

response = falcon.create_exclusions(cl_regex="string",
                                    comment="string",
                                    description="string",
                                    detection_json="string",
                                    groups=group_list,
                                    ifn_regex="string",
                                    name="string",
                                    pattern_id="string",
                                    pattern_name="string"
                                    )

print(response)
Service class example (Operation ID syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

group_list = ['ID1', 'ID2', 'ID3']

response = falcon.createIOAExclusionsV1(cl_regex="string",
                                        comment="string",
                                        description="string",
                                        detection_json="string",
                                        groups=group_list,
                                        ifn_regex="string",
                                        name="string",
                                        pattern_id="string",
                                        pattern_name="string"
                                        )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

group_list = ['ID1', 'ID2', 'ID3']

BODY = {
    "cl_regex": "string",
    "comment": "string",
    "description": "string",
    "detection_json": "string",
    "groups": group_list,
    "ifn_regex": "string",
    "name": "string",
    "pattern_id": "string",
    "pattern_name": "string"
}

response = falcon.command("createIOAExclusionsV1", body=BODY)
print(response)

Back to Table of Contents

deleteIOAExclusionsV1

Delete the IOA exclusions by id

PEP8 method name

delete_exclusions

Endpoint

Method Route
DELETE /policy/entities/ioa-exclusions/v1

Required Scope

ioa-exclusions_write:write

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
comment
Service Class Support
Uber Class Support
 query string Explains why this exclusion was deleted.
ids
Service Class Support
Uber Class Support
 query string or list of strings The IDs of the exclusions to retrieve.
parameters
Service Class Support
Uber Class Support
 query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_exclusions(comment="string", ids=id_list)
print(response)
Service class example (Operation ID syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteIOAExclusionsV1(comment="string", ids=id_list)
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deleteIOAExclusionsV1", comment="string", ids=id_list)
print(response)

Back to Table of Contents

updateIOAExclusionsV1

Update the IOA exclusions

PEP8 method name

update_exclusions

Endpoint

Method Route
PATCH /policy/entities/ioa-exclusions/v1

Required Scope

ioa-exclusions_write:write

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
body
Service Class Support
Uber Class Support
 body dictionary Full body payload in JSON format.
cl_regex
Service Class Support
No Uber Class Support
 body string Command line regular expression.
comment
Service Class Support
No Uber Class Support
 body string String comment describing why the exclusions was created.
description
Service Class Support
No Uber Class Support
 body string Exclusion description.
detection_json
Service Class Support
No Uber Class Support
 body string JSON formatted detection template.
groups
Service Class Support
No Uber Class Support
 body list of strings Group ID(s) impacted by the exclusion.
id
Service Class Support
No Uber Class Support
 body string ID of the exclusion to update.
ifn_regex
Service Class Support
No Uber Class Support
 body string Indicator file name regular expression.
name
Service Class Support
No Uber Class Support
 body string Name of the exclusion.
pattern_id
Service Class Support
No Uber Class Support
 body string ID of the pattern to use for the exclusion.
pattern_name
Service Class Support
No Uber Class Support
 body string Name of the pattern to use for the exclusion.

Usage

Service class example (PEP8 syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

group_list = ['ID1', 'ID2', 'ID3']

response = falcon.update_exclusions(cl_regex="string",
                                    comment="string",
                                    description="string",
                                    detection_json="string",
                                    groups=group_list,
                                    id="string",
                                    ifn_regex="string",
                                    name="string",
                                    pattern_id="string",
                                    pattern_name="string"
                                    )
print(response)
Service class example (Operation ID syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

group_list = ['ID1', 'ID2', 'ID3']

response = falcon.updateIOAExclusionsV1(cl_regex="string",
                                        comment="string",
                                        description="string",
                                        detection_json="string",
                                        groups=group_list,
                                        id="string",
                                        ifn_regex="string",
                                        name="string",
                                        pattern_id="string",
                                        pattern_name="string"
                                        )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

group_list = ['ID1', 'ID2', 'ID3']

BODY = {
    "cl_regex": "string",
    "comment": "string",
    "description": "string",
    "detection_json": "string",
    "groups": group_list,
    "id": "string",
    "ifn_regex": "string",
    "name": "string",
    "pattern_id": "string",
    "pattern_name": "string"
}

response = falcon.command("updateIOAExclusionsV1", body=BODY)
print(response)

Back to Table of Contents

queryIOAExclusionsV1

Search for IOA exclusions.

PEP8 method name

query_exclusions

Endpoint

Method Route
GET /policy/queries/ioa-exclusions/v1

Required Scope

ioa-exclusions:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
cl_regex
Service Class Support
Uber Class Support
 query string Command line regular expression.
filter
Service Class Support
No Uber Class Support
 query string The filter expression that should be used to limit the results. FQL syntax.

Available filters:
  • name
  • pattern_id
  • pattern_name
  • applied_globally
  • created_on
  • created_by
  • last_modified
  • modified_by
ifn_regex
Service Class Support
Uber Class Support
 query string Indicator file name regular expression.
limit
Service Class Support
No Uber Class Support
 query integer The maximum number of records to return. [1-500]
offset
Service Class Support
No Uber Class Support
 query integer The offset to start retrieving records from.
parameters
Service Class Support
Uber Class Support
 query dictionary Full query string parameters payload in JSON format.
sort
Service Class Support
No Uber Class Support
 query string The property to sort by.
FQL syntax. (e.g. last_behavior.asc)

Available sort fields:
  • name
  • pattern_id
  • pattern_name
  • applied_globally
  • created_on
  • created_by
  • last_modified
  • modified_by

Usage

Service class example (PEP8 syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.query_exclusions(cl_regex="string",
                                   filter="string",
                                   offset=integer,
                                   ifn_regex="string",
                                   limit=integer,
                                   sort="string"
                                   )
print(response)
Service class example (Operation ID syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.queryIOAExclusionsV1(cl_regex="string",
                                       filter="string",
                                       offset=integer,
                                       ifn_regex="string",
                                       limit=integer,
                                       sort="string"
                                       )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryIOAExclusionsV1",
                          cl_regex="string",
                          filter="string",
                          offset=integer,
                          ifn_regex="string",
                          limit=integer,
                          sort="string"
                          )

print(response)

Back to Table of Contents

ss_ioa_exclusions_aggregates_v2

Get Self Service IOA Exclusion aggregates as specified via json in the request body.

PEP8 method name

get_ss_exclusion_aggregates

Endpoint

Method Route
POST /exclusions/aggregates/ss-ioa-exclusions/GET/v2

Required Scope

self-service-ioa-exclusions_write:write

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
body
Service Class Support
Uber Class Support
 body dictionary Full body payload in JSON format.
cl_regex
Service Class Support
Uber Class Support
 query string The cl_regex expression to filter exclusion aggregations by.
date_ranges
Service Class Support
No Uber Class Support
 body list of dictionaries Date range specifications.
exclude
Service Class Support
No Uber Class Support
 body string Exclusion string.
extended_bounds
Service Class Support
No Uber Class Support
 body dictionary Extended bounds specification.
field
Service Class Support
No Uber Class Support
 body string Field to aggregate on.
filter
Service Class Support
No Uber Class Support
 body string FQL filter expression.
filters_spec
Service Class Support
No Uber Class Support
 body dictionary Filter specification.
from
Service Class Support
No Uber Class Support
 body integer Starting position.
grandparent_cl_regex
Service Class Support
Uber Class Support
 query string The grandparent_cl_regex expression to filter exclusion aggregations by.
grandparent_ifn_regex
Service Class Support
Uber Class Support
 query string The grandparent_ifn_regex expression to filter exclusion aggregations by.
ifn_regex
Service Class Support
Uber Class Support
 query string The ifn_regex expression to filter exclusion aggregations by.
include
Service Class Support
No Uber Class Support
 body string Include string.
interval
Service Class Support
No Uber Class Support
 body string Time interval for date histogram aggregations.
max_doc_count
Service Class Support
No Uber Class Support
 body integer Maximum document count.
min_doc_count
Service Class Support
No Uber Class Support
 body integer Minimum document count.
missing
Service Class Support
No Uber Class Support
 body string Missing value.
name
Service Class Support
No Uber Class Support
 body string Aggregation name.
parameters
Service Class Support
Uber Class Support
 query dictionary Full query string parameters payload in JSON format.
parent_cl_regex
Service Class Support
Uber Class Support
 query string The parent_cl_regex expression to filter exclusion aggregations by.
parent_ifn_regex
Service Class Support
Uber Class Support
 query string The parent_ifn_regex expression to filter exclusion aggregations by.
percents
Service Class Support
No Uber Class Support
 body list of integers Percentile values.
q
Service Class Support
No Uber Class Support
 body string FQL syntax query.
ranges
Service Class Support
No Uber Class Support
 body list of dictionaries Range specifications.
size
Service Class Support
No Uber Class Support
 body integer Maximum number of results to return.
sort
Service Class Support
No Uber Class Support
 body string Sort expression.
sub_aggregates
Service Class Support
No Uber Class Support
 body list Sub-aggregation specifications.
time_zone
Service Class Support
No Uber Class Support
 body string Time zone for date aggregations.
type
Service Class Support
No Uber Class Support
 body string Aggregation type.

Usage

Service class example (PEP8 syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.get_ss_exclusion_aggregates(field="string",
                                              filter="string",
                                              name="string",
                                              size=integer,
                                              sort="string",
                                              type="string",
                                              ifn_regex="string",
                                              cl_regex="string",
                                              parent_ifn_regex="string",
                                              parent_cl_regex="string",
                                              grandparent_ifn_regex="string",
                                              grandparent_cl_regex="string"
                                              )
print(response)
Service class example (Operation ID syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.ss_ioa_exclusions_aggregates_v2(field="string",
                                                   filter="string",
                                                   name="string",
                                                   size=integer,
                                                   sort="string",
                                                   type="string",
                                                   ifn_regex="string",
                                                   cl_regex="string",
                                                   parent_ifn_regex="string",
                                                   parent_cl_regex="string",
                                                   grandparent_ifn_regex="string",
                                                   grandparent_cl_regex="string"
                                                   )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

BODY = {
    "field": "string",
    "filter": "string",
    "name": "string",
    "size": integer,
    "sort": "string",
    "type": "string"
}

response = falcon.command("ss_ioa_exclusions_aggregates_v2",
                          ifn_regex="string",
                          cl_regex="string",
                          parent_ifn_regex="string",
                          parent_cl_regex="string",
                          grandparent_ifn_regex="string",
                          grandparent_cl_regex="string",
                          body=BODY
                          )
print(response)

Back to Table of Contents

ss_ioa_exclusions_get_reports_v2

Create a report of Self Service IOA Exclusions scoped by the given filters.

PEP8 method name

get_ss_exclusion_reports_v2

Endpoint

Method Route
POST /exclusions/entities/ss-ioa-exclusions/reports/v2

Required Scope

self-service-ioa-exclusions_write:write

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
body
Service Class Support
Uber Class Support
 body dictionary Full body payload in JSON format.
report_format
Service Class Support
No Uber Class Support
 body string Report format.
search
Service Class Support
No Uber Class Support
 body dictionary Search filter and sort specification.

Usage

Service class example (PEP8 syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

search = {
    "filter": "string",
    "sort": "string"
}

response = falcon.get_ss_exclusion_reports_v2(report_format="string",
                                              search=search
                                              )
print(response)
Service class example (Operation ID syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

search = {
    "filter": "string",
    "sort": "string"
}

response = falcon.ss_ioa_exclusions_get_reports_v2(report_format="string",
                                                    search=search
                                                    )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

BODY = {
    "report_format": "string",
    "search": {
        "filter": "string",
        "sort": "string"
    }
}

response = falcon.command("ss_ioa_exclusions_get_reports_v2", body=BODY)
print(response)

Back to Table of Contents

ss_ioa_exclusions_get_v2

Get the Self Service IOA Exclusions rules by id.

PEP8 method name

get_ss_exclusion_rules_v2

Endpoint

Method Route
GET /exclusions/entities/ss-ioa-exclusions/v2

Required Scope

ioa-exclusions:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
ids
Service Class Support
Uber Class Support
 query string or list of strings The IDs of the exclusions to retrieve.
parameters
Service Class Support
Uber Class Support
 query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_ss_exclusion_rules_v2(ids=id_list)
print(response)
Service class example (Operation ID syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ss_ioa_exclusions_get_v2(ids=id_list)
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ss_ioa_exclusions_get_v2", ids=id_list)
print(response)

Back to Table of Contents

ss_ioa_exclusions_create_v2

Create new Self Service IOA Exclusions.

PEP8 method name

create_ss_exclusions

Endpoint

Method Route
POST /exclusions/entities/ss-ioa-exclusions/v2

Required Scope

self-service-ioa-exclusions_write:write

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
body
Service Class Support
Uber Class Support
 body dictionary Full body payload in JSON format.
exclusions
Service Class Support
No Uber Class Support
 body list of dictionaries List of exclusion definitions.

Usage

Service class example (PEP8 syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

exclusions = [
    {
        "cl_regex": "string",
        "comment": "string",
        "description": "string",
        "detection_json": "string",
        "grandparent_cl_regex": "string",
        "grandparent_ifn_regex": "string",
        "host_groups": ["string"],
        "ifn_regex": "string",
        "name": "string",
        "parent_cl_regex": "string",
        "parent_ifn_regex": "string",
        "pattern_id": "string",
        "pattern_name": "string"
    }
]

response = falcon.create_ss_exclusions(exclusions=exclusions)
print(response)
Service class example (Operation ID syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

exclusions = [
    {
        "cl_regex": "string",
        "comment": "string",
        "description": "string",
        "detection_json": "string",
        "grandparent_cl_regex": "string",
        "grandparent_ifn_regex": "string",
        "host_groups": ["string"],
        "ifn_regex": "string",
        "name": "string",
        "parent_cl_regex": "string",
        "parent_ifn_regex": "string",
        "pattern_id": "string",
        "pattern_name": "string"
    }
]

response = falcon.ss_ioa_exclusions_create_v2(exclusions=exclusions)
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

BODY = {
    "exclusions": [
        {
            "cl_regex": "string",
            "comment": "string",
            "description": "string",
            "detection_json": "string",
            "grandparent_cl_regex": "string",
            "grandparent_ifn_regex": "string",
            "host_groups": ["string"],
            "ifn_regex": "string",
            "name": "string",
            "parent_cl_regex": "string",
            "parent_ifn_regex": "string",
            "pattern_id": "string",
            "pattern_name": "string"
        }
    ]
}

response = falcon.command("ss_ioa_exclusions_create_v2", body=BODY)
print(response)

Back to Table of Contents

ss_ioa_exclusions_update_v2

Update the Self Service IOA Exclusions rule by id.

PEP8 method name

update_ss_exclusions

Endpoint

Method Route
PATCH /exclusions/entities/ss-ioa-exclusions/v2

Required Scope

self-service-ioa-exclusions_write:write

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
body
Service Class Support
Uber Class Support
 body dictionary Full body payload in JSON format.
exclusions
Service Class Support
No Uber Class Support
 body list of dictionaries List of exclusion definitions.

Usage

Service class example (PEP8 syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

exclusions = [
    {
        "cl_regex": "string",
        "comment": "string",
        "description": "string",
        "detection_json": "string",
        "grandparent_cl_regex": "string",
        "grandparent_ifn_regex": "string",
        "host_groups": ["string"],
        "id": "string",
        "ifn_regex": "string",
        "name": "string",
        "parent_cl_regex": "string",
        "parent_ifn_regex": "string",
        "pattern_id": "string",
        "pattern_name": "string"
    }
]

response = falcon.update_ss_exclusions(exclusions=exclusions)
print(response)
Service class example (Operation ID syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

exclusions = [
    {
        "cl_regex": "string",
        "comment": "string",
        "description": "string",
        "detection_json": "string",
        "grandparent_cl_regex": "string",
        "grandparent_ifn_regex": "string",
        "host_groups": ["string"],
        "id": "string",
        "ifn_regex": "string",
        "name": "string",
        "parent_cl_regex": "string",
        "parent_ifn_regex": "string",
        "pattern_id": "string",
        "pattern_name": "string"
    }
]

response = falcon.ss_ioa_exclusions_update_v2(exclusions=exclusions)
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

BODY = {
    "exclusions": [
        {
            "cl_regex": "string",
            "comment": "string",
            "description": "string",
            "detection_json": "string",
            "grandparent_cl_regex": "string",
            "grandparent_ifn_regex": "string",
            "host_groups": ["string"],
            "id": "string",
            "ifn_regex": "string",
            "name": "string",
            "parent_cl_regex": "string",
            "parent_ifn_regex": "string",
            "pattern_id": "string",
            "pattern_name": "string"
        }
    ]
}

response = falcon.command("ss_ioa_exclusions_update_v2", body=BODY)
print(response)

Back to Table of Contents

ss_ioa_exclusions_delete_v2

Delete the Self Service IOA Exclusions rule by id.

PEP8 method name

delete_ss_exclusions

Endpoint

Method Route
DELETE /exclusions/entities/ss-ioa-exclusions/v2

Required Scope

self-service-ioa-exclusions_write:write

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
comment
Service Class Support
Uber Class Support
 query string The comment why these ss ioa exclusions were deleted.
ids
Service Class Support
Uber Class Support
 query string or list of strings The IDs of the exclusions to delete.
parameters
Service Class Support
Uber Class Support
 query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_ss_exclusions(comment="string", ids=id_list)
print(response)
Service class example (Operation ID syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.ss_ioa_exclusions_delete_v2(comment="string", ids=id_list)
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("ss_ioa_exclusions_delete_v2", comment="string", ids=id_list)
print(response)

Back to Table of Contents

ss_ioa_exclusions_matched_rule_v2

Get Self Service IOA Exclusions rules for matched IFN/CLI for child, parent and grandparent.

PEP8 method name

get_ss_exclusion_matched_rules

Endpoint

Method Route
POST /exclusions/entities/ss-ioa-matched-rules/v2

Required Scope

self-service-ioa-exclusions_write:write

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
aid
Service Class Support
No Uber Class Support
 body string Agent ID.
body
Service Class Support
Uber Class Support
 body dictionary Full body payload in JSON format.
command_line
Service Class Support
No Uber Class Support
 body string Command line.
grandparent_command_line
Service Class Support
No Uber Class Support
 body string Grandparent command line.
grandparent_image_file_name
Service Class Support
No Uber Class Support
 body string Grandparent image file name.
image_file_name
Service Class Support
No Uber Class Support
 body string Image file name.
parent_command_line
Service Class Support
No Uber Class Support
 body string Parent command line.
parent_image_file_name
Service Class Support
No Uber Class Support
 body string Parent image file name.
pattern_ids
Service Class Support
No Uber Class Support
 body list of strings Pattern IDs.

Usage

Service class example (PEP8 syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.get_ss_exclusion_matched_rules(aid="string",
                                                  command_line="string",
                                                  grandparent_command_line="string",
                                                  grandparent_image_file_name="string",
                                                  image_file_name="string",
                                                  parent_command_line="string",
                                                  parent_image_file_name="string",
                                                  pattern_ids=["string"]
                                                  )
print(response)
Service class example (Operation ID syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.ss_ioa_exclusions_matched_rule_v2(aid="string",
                                                     command_line="string",
                                                     grandparent_command_line="string",
                                                     grandparent_image_file_name="string",
                                                     image_file_name="string",
                                                     parent_command_line="string",
                                                     parent_image_file_name="string",
                                                     pattern_ids=["string"]
                                                     )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

BODY = {
    "aid": "string",
    "command_line": "string",
    "grandparent_command_line": "string",
    "grandparent_image_file_name": "string",
    "image_file_name": "string",
    "parent_command_line": "string",
    "parent_image_file_name": "string",
    "pattern_ids": ["string"]
}

response = falcon.command("ss_ioa_exclusions_matched_rule_v2", body=BODY)
print(response)

Back to Table of Contents

ss_ioa_exclusions_new_rules_v2

Get defaults for Self Service IOA Exclusions based on provided IFN/CLI for child, parent and grandparent.

PEP8 method name

get_default_ss_exclusions

Endpoint

Method Route
POST /exclusions/entities/ss-ioa-new-rules/v2

Required Scope

self-service-ioa-exclusions_write:write

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
aid
Service Class Support
No Uber Class Support
 body string Agent ID.
body
Service Class Support
Uber Class Support
 body dictionary Full body payload in JSON format.
command_line
Service Class Support
No Uber Class Support
 body string Command line.
grandparent_command_line
Service Class Support
No Uber Class Support
 body string Grandparent command line.
grandparent_image_file_name
Service Class Support
No Uber Class Support
 body string Grandparent image file name.
image_file_name
Service Class Support
No Uber Class Support
 body string Image file name.
parent_command_line
Service Class Support
No Uber Class Support
 body string Parent command line.
parent_image_file_name
Service Class Support
No Uber Class Support
 body string Parent image file name.

Usage

Service class example (PEP8 syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.get_default_ss_exclusions(aid="string",
                                            command_line="string",
                                            grandparent_command_line="string",
                                            grandparent_image_file_name="string",
                                            image_file_name="string",
                                            parent_command_line="string",
                                            parent_image_file_name="string"
                                            )
print(response)
Service class example (Operation ID syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.ss_ioa_exclusions_new_rules_v2(aid="string",
                                                  command_line="string",
                                                  grandparent_command_line="string",
                                                  grandparent_image_file_name="string",
                                                  image_file_name="string",
                                                  parent_command_line="string",
                                                  parent_image_file_name="string"
                                                  )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

BODY = {
    "aid": "string",
    "command_line": "string",
    "grandparent_command_line": "string",
    "grandparent_image_file_name": "string",
    "image_file_name": "string",
    "parent_command_line": "string",
    "parent_image_file_name": "string"
}

response = falcon.command("ss_ioa_exclusions_new_rules_v2", body=BODY)
print(response)

Back to Table of Contents

ss_ioa_exclusions_search_v2

Search for Self Service IOA Exclusions.

PEP8 method name

query_ss_exclusions

Endpoint

Method Route
GET /exclusions/queries/ss-ioa-exclusions/v2

Required Scope

ioa-exclusions:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
cl_regex
Service Class Support
Uber Class Support
 query string The cl_regex expression to filter exclusions by.
filter
Service Class Support
Uber Class Support
 query string The filter expression that should be used to limit the results.
grandparent_cl_regex
Service Class Support
Uber Class Support
 query string The grandparent_cl_regex expression to filter exclusions by.
grandparent_ifn_regex
Service Class Support
Uber Class Support
 query string The grandparent_ifn_regex expression to filter exclusions by.
ifn_regex
Service Class Support
Uber Class Support
 query string The ifn_regex expression to filter exclusions by.
limit
Service Class Support
Uber Class Support
 query integer The maximum records to return. [1-500]
offset
Service Class Support
Uber Class Support
 query integer The offset to start retrieving records from.
parameters
Service Class Support
Uber Class Support
 query dictionary Full query string parameters payload in JSON format.
parent_cl_regex
Service Class Support
Uber Class Support
 query string The parent_cl_regex expression to filter exclusions by.
parent_ifn_regex
Service Class Support
Uber Class Support
 query string The parent_ifn_regex expression to filter exclusions by.
sort
Service Class Support
Uber Class Support
 query string The sort expression that should be used to sort the results.

Usage

Service class example (PEP8 syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.query_ss_exclusions(filter="string",
                                      ifn_regex="string",
                                      cl_regex="string",
                                      parent_ifn_regex="string",
                                      parent_cl_regex="string",
                                      grandparent_ifn_regex="string",
                                      grandparent_cl_regex="string",
                                      offset=integer,
                                      limit=integer,
                                      sort="string"
                                      )
print(response)
Service class example (Operation ID syntax)
from falconpy import IOAExclusions

# Do not hardcode API credentials!
falcon = IOAExclusions(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.ss_ioa_exclusions_search_v2(filter="string",
                                               ifn_regex="string",
                                               cl_regex="string",
                                               parent_ifn_regex="string",
                                               parent_cl_regex="string",
                                               grandparent_ifn_regex="string",
                                               grandparent_cl_regex="string",
                                               offset=integer,
                                               limit=integer,
                                               sort="string"
                                               )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ss_ioa_exclusions_search_v2",
                          filter="string",
                          ifn_regex="string",
                          cl_regex="string",
                          parent_ifn_regex="string",
                          parent_cl_regex="string",
                          grandparent_ifn_regex="string",
                          grandparent_cl_regex="string",
                          offset=integer,
                          limit=integer,
                          sort="string"
                          )
print(response)

Back to Table of Contents

⚠️ **GitHub.com Fallback** ⚠️