ML Exclusions - CrowdStrike/falconpy GitHub Wiki
Operation ID | Description | ||||
---|---|---|---|---|---|
|
Get a set of ML Exclusions by specifying their IDs. | ||||
|
Create the ML exclusions. | ||||
|
Delete the ML exclusions by ID. | ||||
|
Update the ML exclusions. | ||||
|
Search for ML exclusions. |
WARNING
client_id
andclient_secret
are keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.
Get a set of ML Exclusions by specifying their IDs
get_exclusions
Method | Route |
---|---|
/policy/entities/ml-exclusions/v1 |
- Produces: application/json
Name | Service | Uber | Type | Data type | Description |
---|---|---|---|---|---|
ids |
|
|
query | string or list of strings | The IDs of the exclusions to retrieve. |
parameters |
|
|
query | dictionary | Full query string parameters payload in JSON format. |
from falconpy import MLExclusions
# Do not hardcode API credentials!
falcon = MLExclusions(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_exclusions(ids=id_list)
print(response)
from falconpy import MLExclusions
# Do not hardcode API credentials!
falcon = MLExclusions(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.getMLExclusionsV1(ids=id_list)
print(response)
from falconpy import APIHarnessV2
# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("getMLExclusionsV1", ids=id_list)
print(response)
Create the ML exclusions
create_exclusions
Method | Route |
---|---|
/policy/entities/ml-exclusions/v1 |
- Produces: application/json
Name | Service | Uber | Type | Data type | Description |
---|---|---|---|---|---|
body |
|
|
body | dictionary | Full body payload in JSON format. |
comment |
|
|
body | string | String comment describing why the exclusions was created. |
excluded_from |
|
|
body | list of strings | Group ID(s) explicitly excluded from the exclusion. |
groups |
|
|
body | list of strings | Group ID(s) impacted by the exclusion. Defaults to ["all"] when not specified while using a Service Class. This default must be provided by the developer when using the Uber Class. |
value |
|
|
body | string | Value to match for the exclusion. |
from falconpy import MLExclusions
# Do not hardcode API credentials!
falcon = MLExclusions(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
group_list = ['ID1', 'ID2', 'ID3']
exclude_list = ['EX1', 'EX2', 'EX3']
response = falcon.create_exclusions(comment="string",
groups=group_list,
excluded_from=exclude_list,
value="string"
)
print(response)
from falconpy import MLExclusions
# Do not hardcode API credentials!
falcon = MLExclusions(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
group_list = ['ID1', 'ID2', 'ID3']
exclude_list = ['EX1', 'EX2', 'EX3']
response = falcon.createMLExclusionsV1(comment="string",
groups=group_list,
excluded_from=exclude_list,
value="string"
)
print(response)
from falconpy import APIHarnessV2
# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
group_list = ['ID1', 'ID2', 'ID3'] # If not specifying a group ID, you must submit ["all"].
exclude_list = ['EX1', 'EX2', 'EX3']
BODY = {
"comment": "string",
"excluded_from": exclude_list,
"groups": group_list,
"value": "string"
}
response = falcon.command("createMLExclusionsV1", body=BODY)
print(response)
Delete the ML exclusions by id
delete_exclusions
Method | Route |
---|---|
/policy/entities/ml-exclusions/v1 |
- Produces: application/json
Name | Service | Uber | Type | Data type | Description |
---|---|---|---|---|---|
comment |
|
|
query | string | Explains why this exclusion was deleted. |
ids |
|
|
query | string or list of strings | The IDs of the exclusions to retrieve. |
parameters |
|
|
query | dictionary | Full query string parameters payload in JSON format. |
from falconpy import MLExclusions
# Do not hardcode API credentials!
falcon = MLExclusions(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.delete_exclusions(comment="string", ids=id_list)
print(response)
from falconpy import MLExclusions
# Do not hardcode API credentials!
falcon = MLExclusions(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.deleteMLExclusionsV1(comment="string", ids=id_list)
print(response)
from falconpy import APIHarnessV2
# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("deleteMLExclusionsV1", comment="string", ids=id_list)
print(response)
Update the ML exclusions
update_exclusions
Method | Route |
---|---|
/policy/entities/ml-exclusions/v1 |
- Produces: application/json
Name | Service | Uber | Type | Data type | Description |
---|---|---|---|---|---|
body |
|
|
body | dictionary | Full body payload in JSON format. |
comment |
|
|
body | string | String comment describing why the exclusions was created. |
groups |
|
|
body | list of strings | Group ID(s) impacted by the exclusion. |
id |
|
|
body | string | The ID of the exclusion to update. |
value |
|
|
body | string | Value to match for the exclusion. |
from falconpy import MLExclusions
# Do not hardcode API credentials!
falcon = MLExclusions(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
group_list = ['ID1', 'ID2', 'ID3']
response = falcon.update_exclusions(comment="string",
groups=group_list,
value="string",
id="string"
)
print(response)
from falconpy import MLExclusions
# Do not hardcode API credentials!
falcon = MLExclusions(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
group_list = ['ID1', 'ID2', 'ID3']
response = falcon.updateMLExclusionsV1(comment="string",
groups=group_list,
value="string",
id="string"
)
print(response)
from falconpy import APIHarnessV2
# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
group_list = ['ID1', 'ID2', 'ID3']
BODY = {
"comment": "string",
"groups": group_list,
"id": "string",
"value": "string"
}
response = falcon.command("updateMLExclusionsV1", body=BODY)
print(response)
Search for ML exclusions.
query_exclusions
Method | Route |
---|---|
/policy/queries/ml-exclusions/v1 |
- Produces: application/json
Name | Service | Uber | Type | Data type | Description |
---|---|---|---|---|---|
filter |
|
|
query | string | The filter expression that should be used to limit the results. FQL syntax. Available filters:
|
limit |
|
|
query | integer | The maximum number of records to return. [1-500] |
offset |
|
|
query | integer | The offset to start retrieving records from. |
parameters |
|
|
query | dictionary | Full query string parameters payload in JSON format. |
sort |
|
|
query | string | The property to sort by. FQL syntax. (e.g. last_behavior|asc) Available sort fields:
|
from falconpy import MLExclusions
# Do not hardcode API credentials!
falcon = MLExclusions(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.query_exclusions(filter="string",
offset=integer,
limit=integer,
sort="string"
)
print(response)
from falconpy import MLExclusions
# Do not hardcode API credentials!
falcon = MLExclusions(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.queryMLExclusionsV1(filter="string",
offset=integer,
limit=integer,
sort="string"
)
print(response)
from falconpy import APIHarnessV2
# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.command("queryMLExclusionsV1",
filter="string",
offset=integer,
limit=integer,
sort="string"
)
print(response)