Using the SaaS Security service collection

Uber class support Service class support Documentation Version Page Updated

Operation ID

Description

DismissAffectedEntityV3
PEP 8	dismiss_affected_entity

Dismiss affected entity.

DismissSecurityCheckV3
PEP 8	dismiss_security_check

Dismiss security check.

GetActivityMonitorV3
PEP 8	get_activity_monitor

Get activity monitor.

GetAlertsV3
PEP 8	get_alerts

Get alerts.

GetAppInventory
PEP 8	get_application_inventory

Get application inventory.

GetAppInventoryUsers
PEP 8	get_application_users

Get application inventory users.

GetAssetInventoryV3
PEP 8	get_asset_inventory

Get asset inventory.

GetDeviceInventoryV3
PEP 8	get_device_inventory

Get device inventory.

GetIntegrationsV3
PEP 8	get_integrations

Get integrations.

GetMetricsV3
PEP 8	get_metrics

Get metrics.

GetSecurityCheckAffectedV3
PEP 8	get_security_check

Get affected resources for security checks.

GetSecurityCheckComplianceV3
PEP 8	get_security_check_compliance

Get security check compliance.

GetSecurityChecksV3
PEP 8	get_security_checks

Get security checks.

GetSupportedSaasV3
PEP 8	get_supported_saas

Get supported SaaS applications.

GetSystemLogsV3
PEP 8	get_system_logs

Get system logs.

GetSystemUsersV3
PEP 8	get_system_users

Get system users.

GetUserInventoryV3
PEP 8	get_user_inventory

Get user inventory.

IntegrationBuilderEndTransactionV3
PEP 8	complete_integration_upload

End integration builder transaction.

IntegrationBuilderGetStatusV3
PEP 8	get_integration_builder_status

Get integration builder status.

IntegrationBuilderResetV3
PEP 8	reset_integration_builder

Reset integration builder.

IntegrationBuilderUploadV3
PEP 8	upload_integration_builder

Upload integration builder.

Passing credentials

DismissAffectedEntityV3

Dismiss affected entity for a security check.

PEP8 method name

dismiss_affected_entity

Endpoint

Method	Route
	`/saas-security/entities/check-dismiss-affected/v3`

Required Scope

saas-security:write

Content-Type

Consumes: application/json
Produces: application/json

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format. Not required if using other keywords.
entities	body	string	Entities.
id	query	string	Security Check ID.
parameters	query	dictionary	Full parameters payload in JSON format.
reason	body	string	Reason for dismiss.

Usage

Service class example (PEP8 syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.dismiss_affected_entity(entities="string",
                                             id="string",
                                             reason="string"
                                             )
print(response)

Service class example (Operation ID syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.DismissAffectedEntityV3(entities="string",
                                          id="string",
                                          reason="string"
                                          )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "entities": "string",
    "reason": "string"
}

response = falcon.command("DismissAffectedEntityV3",
                          body=body_payload,
                          id="string"
                          )
print(response)

DismissSecurityCheckV3

Dismiss security check by ID.

PEP8 method name

dismiss_security_check

Endpoint

Method	Route
	`/saas-security/entities/check-dismiss/v3`

Required Scope

saas-security:write

Content-Type

Consumes: application/json
Produces: application/json

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format. Not required if using other keywords.
id	query	string	Security Check ID.
parameters	query	dictionary	Full parameters payload in JSON format.
reason	body	string	Reason for dismissal.

Usage

Service class example (PEP8 syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.dismiss_security_check(id="string",
                                            reason="string"
                                            )
print(response)

Service class example (Operation ID syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.DismissSecurityCheckV3(id="string",
                                         reason="string"
                                         )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "reason": "string"
}

response = falcon.command("DismissSecurityCheckV3",
                          body=body_payload,
                          id="string"
                          )
print(response)

GetActivityMonitorV3

Get activity monitor data for SaaS security monitoring.

PEP8 method name

get_activity_monitor

Endpoint

Method	Route
	`/saas-security/entities/monitor/v3`

Required Scope

saas-security:read

Content-Type

Produces: application/json

Parameters

Name	Type	Data type	Description
actor	query	string	Actor.
category	query	string	Comma separated list of categories.
from_date	query	string	From Date.
integration_id	query	string	Integration ID.
limit	query	integer	Max number of logs to fetch.
projection	query	string	Comma separated list of projections.
skip	query	integer	Number of logs to skip.
to_date	query	string	To Date.
parameters	query	dictionary	Full parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.get_activity_monitor(integration_id="string",
                                       actor="string",
                                       category="string",
                                       projection="string",
                                       from_date="2023-01-01T00:00:00Z",
                                       to_date="2023-01-31T23:59:59Z",
                                       limit=integer,
                                       skip=integer
                                       )
print(response)

Service class example (Operation ID syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.GetActivityMonitorV3(integration_id="string",
                                       actor="string",
                                       category="string",
                                       projection="string",
                                       from_date="2023-01-01T00:00:00Z",
                                       to_date="2023-01-31T23:59:59Z",
                                       limit=integer,
                                       skip=integer
                                       )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetActivityMonitorV3",
                          integration_id="string",
                          actor="string",
                          category="string",
                          projection="string",
                          from_date="2023-01-01T00:00:00Z",
                          to_date="2023-01-31T23:59:59Z",
                          limit=integer,
                          skip=integer
                          )
print(response)

GetAlertsV3

Get alerts for SaaS security monitoring.

PEP8 method name

get_alerts

Endpoint

Method	Route
	`/saas-security/entities/alerts/v3`

Required Scope

saas-security:read

Content-Type

Produces: application/json

Parameters

Name	Type	Data type	Description
ascending	query	boolean	Sort in ascending order.
from_date	query	string	The start date of the alert you want to get (in YYYY-MM-DD format).
id	query	string	Alert ID.
integration_id	query	string	Comma separated list of integration ID's of the alert you want to get.
last_id	query	string	The last id of the alert you want to get.
limit	query	integer	The maximum number of objects to return.
offset	query	integer	The starting index of the results.
to_date	query	string	The end date of the alert you want to get (in YYYY-MM-DD format).
type	query	string	The type of alert you want to get. Allowed values: `configuration_drift`, `check_degraded`, `integration_failure`, `Threat`.
parameters	query	dictionary	Full parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.get_alerts(id="string",
                             limit=integer,
                             offset=integer,
                             last_id="string",
                             type="string",
                             integration_id="string",
                             from_date="string",
                             to_date="string",
                             ascending=boolean
                             )
print(response)

Service class example (Operation ID syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.GetAlertsV3(id="string",
                              limit=integer,
                              offset=integer,
                              last_id="string",
                              type="string",
                              integration_id="string",
                              from_date="string",
                              to_date="string",
                              ascending=boolean
                              )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetAlertsV3",
                         id="string",
                         limit=integer,
                         offset=integer,
                         last_id="string",
                         type="string",
                         integration_id="string",
                         from_date="string",
                         to_date="string",
                         ascending=boolean
                         )
print(response)

GetAppInventory

Get application inventory data.

PEP8 method name

get_application_inventory

Endpoint

Method	Route
	`/saas-security/entities/apps/v3`

Required Scope

saas-security:read

Content-Type

Produces: application/json

Parameters

Name	Type	Data type	Description
access_level	query	string	Comma separated list of access levels.
groups	query	string	Comma separated list of groups.
integration_id	query	string	Comma separated list of integration IDs.
last_activity	query	string	Last activity was within or was not within the last 'value' days. Format: 'was value' or 'was not value' or 'value' (implies 'was value'). 'value' is an integer.
limit	query	integer	The maximum number of objects to return.
offset	query	integer	The starting index of the results.
scopes	query	string	Comma separated list of scopes.
status	query	string	Comma separated list of application statuses. Allowed values: `approved`, `in review`, `rejected`, `unclassified`.
type	query	string	Comma separated list of app types.
users	query	string	Users. Format: 'is equal value' or 'contains value' or 'value' (implies 'is equal value').
parameters	query	dictionary	Full parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.get_application_inventory(type="string",
                                  limit=integer,
                                  offset=integer,
                                  status="string",
                                  access_level="string",
                                  scopes="string",
                                  users="string",
                                  groups="string",
                                  last_activity="string",
                                  integration_id="string"
                                  )
print(response)

Service class example (Operation ID syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.GetAppInventory(type="string",
                                limit=integer,
                                offset=integer,
                                status="string",
                                access_level="string",
                                scopes="string",
                                users="string",
                                groups="string",
                                last_activity="string",
                                integration_id="string"
                                )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetAppInventory",
                         type="string",
                         limit=integer,
                         offset=integer,
                         status="string",
                         access_level="string",
                         scopes="string",
                         users="string",
                         groups="string",
                         last_activity="string",
                         integration_id="string"
                         )
print(response)

GetAppInventoryUsers

Get application inventory users for a specific application.

PEP8 method name

get_application_users

Endpoint

Method	Route
	`/saas-security/entities/app-users/v3`

Required Scope

saas-security:read

Content-Type

Produces: application/json

Parameters

Name	Service	Uber	Type	Data type	Description
item_id			query	string	Item ID in format: 'integration_id\|\|\|app_id' (item_id).

Usage

Service class example (PEP8 syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.get_application_users(item_id="string")
print(response)

Service class example (Operation ID syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.GetAppInventoryUsers(item_id="string")
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetAppInventoryUsers",
                         item_id="string"
                         )
print(response)

GetAssetInventoryV3

Get data inventory from SaaS security monitoring.

PEP8 method name

get_asset_inventory

Endpoint

Method	Route
	`/saas-security/entities/data/v3`

Required Scope

saas-security:read

Content-Type

Produces: application/json

Parameters

Name	Type	Data type	Description
access_level	query	string	Comma separated list of access levels.
integration_id	query	string	Comma separated list of integration IDs.
last_accessed	query	string	Last accessed date was within or was not within the last 'value' days. Format: 'was value' or 'was not value' or 'value' (implies 'was value'). 'value' is an integer.
last_modified	query	string	Last modified date was within or was not within the last 'value' days. Format: 'was value' or 'was not value' or 'value' (implies 'was value'). 'value' is an integer.
limit	query	integer	The maximum number of objects to return.
offset	query	integer	The starting index of the results.
password_protected	query	boolean	Password protected.
resource_name	query	string	Resource name contains 'value' (case insensitive).
resource_owner	query	string	Resource owner contains 'value' (case insensitive).
resource_owner_enabled	query	boolean	Resource owner enabled.
resource_type	query	string	Comma separated list of resource types.
unmanaged_domain	query	string	Comma separated list of unmanaged domains.
parameters	query	dictionary	Full parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.get_asset_inventory(integration_id="string",
                                      limit=integer,
                                      offset=integer,
                                      resource_type="string",
                                      access_level="string",
                                      last_accessed="string",
                                      last_modified="string",
                                      resource_name="string",
                                      password_protected=boolean,
                                      resource_owner="string",
                                      resource_owner_enabled=boolean,
                                      unmanaged_domain="string"
                                      )
print(response)

Service class example (Operation ID syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.GetAssetInventoryV3(integration_id="string",
                                      limit=integer,
                                      offset=integer,
                                      resource_type="string",
                                      access_level="string",
                                      last_accessed="string",
                                      last_modified="string",
                                      resource_name="string",
                                      password_protected=boolean,
                                      resource_owner="string",
                                      resource_owner_enabled=boolean,
                                      unmanaged_domain="string"
                                      )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetAssetInventoryV3",
                          integration_id="string",
                          limit=integer,
                          offset=integer,
                          resource_type="string",
                          access_level="string",
                          last_accessed="string",
                          last_modified="string",
                          resource_name="string",
                          password_protected=boolean,
                          resource_owner="string",
                          resource_owner_enabled=boolean,
                          unmanaged_domain="string"
                          )
print(response)

GetDeviceInventoryV3

Get device inventory from SaaS security monitoring.

PEP8 method name

get_device_inventory

Endpoint

Method	Route
	`/saas-security/entities/devices/v3`

Required Scope

saas-security:read

Content-Type

Produces: application/json

Parameters

Name	Type	Data type	Description
email	query	string	Email.
integration_id	query	string	Comma separated integration ID's.
limit	query	integer	The maximum number of objects to return.
offset	query	integer	The starting index of the results.
privileged_only	query	boolean	Privileged Only.
unassociated_devices	query	boolean	Unassociated Devices.
parameters	query	dictionary	Full parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.get_device_inventory(integration_id="string",
                                        limit=integer,
                                        offset=integer,
                                        email="string",
                                        privileged_only=boolean,
                                        unassociated_devices=boolean
                                        )
print(response)

Service class example (Operation ID syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.GetDeviceInventoryV3(integration_id="string",
                                     limit=integer,
                                     offset=integer,
                                     email="string",
                                     privileged_only=boolean,
                                     unassociated_devices=boolean
                                     )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetDeviceInventoryV3",
                         integration_id="string",
                         limit=integer,
                         offset=integer,
                         email="string",
                         privileged_only=boolean,
                         unassociated_devices=boolean
                         )
print(response)

GetIntegrationsV3

Get integrations configured for SaaS security monitoring.

PEP8 method name

get_integrations

Endpoint

Method	Route
	`/saas-security/entities/integrations/v3`

Required Scope

saas-security:read

Content-Type

Produces: application/json

Parameters

Name	Service	Uber	Type	Data type	Description
saas_id			query	string	Comma separated SaaS ID's.
parameters			query	dictionary	Full parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.get_integrations(saas_id="string")
print(response)

Service class example (Operation ID syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.GetIntegrationsV3(saas_id="string")
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetIntegrationsV3",
                         saas_id="string"
                         )
print(response)

GetMetricsV3

Get metrics for SaaS security checks and exposures.

PEP8 method name

get_metrics

Endpoint

Method	Route
	`/saas-security/aggregates/check-metrics/v3`

Required Scope

saas-security:read

Content-Type

Produces: application/json

Parameters

Name	Type	Data type	Description
check_type	query	string	Check Type. Allowed values: `apps`, `devices`, `users`, `assets`, `permissions`, `Falcon Shield Security Check`, `custom`.
compliance	query	boolean	Compliance.
impact	query	string	Impact. Allowed values: `1`, `2`, `3`.
integration_id	query	string	Comma separated list of integration IDs.
limit	query	integer	The maximum number of objects to return.
offset	query	integer	The starting index of the results.
status	query	string	Exposure status. Allowed values: `Passed`, `Failed`, `Dismissed`, `Pending`, `Can't Run`, `Stale`.
parameters	query	dictionary	Full parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.get_metrics(status="string",
                               limit=integer,
                               offset=integer,
                               integration_id="string",
                               impact="string",
                               compliance=boolean,
                               check_type="string"
                               )
print(response)

Service class example (Operation ID syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.GetMetricsV3(status="string",
                             limit=integer,
                             offset=integer,
                             integration_id="string",
                             impact="string",
                             compliance=boolean,
                             check_type="string"
                             )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetMetricsV3",
                         status="string",
                         limit=integer,
                         offset=integer,
                         integration_id="string",
                         impact="string",
                         compliance=boolean,
                         check_type="string"
                         )
print(response)

GetSecurityCheckAffectedV3

Get affected resources for security checks.

PEP8 method name

get_security_check

Endpoint

Method	Route
	`/saas-security/entities/check-affected/v3`

Required Scope

saas-security:read

Content-Type

Produces: application/json

Parameters

Name	Type	Data type	Description
id	query	string	Security Check ID.
limit	query	integer	The maximum number of objects to return.
offset	query	integer	The starting index of the results.
parameters	query	dictionary	Full parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.get_security_check(id="string",
                                               limit=integer,
                                               offset=integer
                                               )
print(response)

Service class example (Operation ID syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.GetSecurityCheckAffectedV3(id="string",
                                           limit=integer,
                                           offset=integer
                                           )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetSecurityCheckAffectedV3",
                         id="string",
                         limit=integer,
                         offset=integer
                         )
print(response)

GetSecurityCheckComplianceV3

Get security check compliance information.

PEP8 method name

get_security_check_compliance

Endpoint

Method	Route
	`/saas-security/entities/compliance/v3`

Required Scope

saas-security:read

Content-Type

Produces: application/json

Parameters

Name	Service	Uber	Type	Data type	Description
id			query	string	Security Check ID.
parameters			query	dictionary	Full parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.get_security_check_compliance(id="string")
print(response)

Service class example (Operation ID syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.GetSecurityCheckComplianceV3(id="string")
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetSecurityCheckComplianceV3",
                         id="string"
                         )
print(response)

GetSecurityChecksV3

Get security checks from SaaS security monitoring.

PEP8 method name

get_security_checks

Endpoint

Method	Route
	`/saas-security/entities/checks/v3`

Required Scope

saas-security:read

Content-Type

Produces: application/json

Parameters

Name	Type	Data type	Description
check_tags	query	string	Comma separated list of check tags names or ids.
check_type	query	string	Check Type. Allowed values: `apps`, `devices`, `users`, `assets`, `permissions`, `Falcon Shield Security Check`, `custom`.
compliance	query	boolean	Compliance.
id	query	string	Security Check ID.
impact	query	string	Impact. Allowed values: `Low`, `Medium`, `High`.
integration_id	query	string	Comma separated list of integration IDs.
limit	query	integer	The maximum number of objects to return.
offset	query	integer	The starting index of the results.
status	query	string	Exposure status. Allowed values: `Passed`, `Failed`, `Dismissed`, `Pending`, `Can't Run`, `Stale`.
parameters	query	dictionary	Full parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.get_security_checks(id="string",
                                      limit=integer,
                                      offset=integer,
                                      status="string",
                                      integration_id="string",
                                      impact="string",
                                      compliance=boolean,
                                      check_type="string",
                                      check_tags="string"
                                      )
print(response)

Service class example (Operation ID syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.GetSecurityChecksV3(id="string",
                                      limit=integer,
                                      offset=integer,
                                      status="string",
                                      integration_id="string",
                                      impact="string",
                                      compliance=boolean,
                                      check_type="string",
                                      check_tags="string"
                                      )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetSecurityChecksV3",
                          id="string",
                          limit=integer,
                          offset=integer,
                          status="string",
                          integration_id="string",
                          impact="string",
                          compliance=boolean,
                          check_type="string",
                          check_tags="string"
                          )
print(response)

GetSupportedSaasV3

Get supported SaaS applications for security monitoring.

PEP8 method name

get_supported_saas

Endpoint

Method	Route
	`/saas-security/entities/supported-saas/v3`

Required Scope

saas-security:read

Content-Type

Produces: application/json

Parameters

Name	Service	Uber	Type	Data type	Description
parameters			query	dictionary	Full parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.get_supported_saas()
print(response)

Service class example (Operation ID syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.GetSupportedSaasV3()
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetSupportedSaasV3")
print(response)

GetSystemLogsV3

Get system logs from SaaS security monitoring.

PEP8 method name

get_system_logs

Endpoint

Method	Route
	`/saas-security/entities/system-logs/v3`

Required Scope

saas-security:read

Content-Type

Produces: application/json

Parameters

Name	Type	Data type	Description
from_date	query	string	From Date (in YYYY-MM-DD format).
limit	query	integer	The maximum number of objects to return.
offset	query	integer	The starting index of the results.
to_date	query	string	To Date (in YYYY-MM-DD format).
total_count	query	boolean	Fetch Total Count?
parameters	query	dictionary	Full parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.get_system_logs(from_date="string",
                                  limit=integer,
                                  offset=integer,
                                  to_date="string",
                                  total_count=boolean
                                  )
print(response)

Service class example (Operation ID syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.GetSystemLogsV3(from_date="string",
                                  limit=integer,
                                  offset=integer,
                                  to_date="string",
                                  total_count=boolean
                                  )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetSystemLogsV3",
                          from_date="string",
                          limit=integer,
                          offset=integer,
                          to_date="string",
                          total_count=boolean
                          )
print(response)

GetSystemUsersV3

Get system users from SaaS security monitoring.

PEP8 method name

get_system_users

Endpoint

Method	Route
	`/saas-security/entities/system-users/v3`

Required Scope

saas-security:read

Content-Type

Produces: application/json

Parameters

Name	Service	Uber	Type	Data type	Description
parameters			query	dictionary	Full parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )


response = falcon.get_system_users()
print(response)

Service class example (Operation ID syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.GetSystemUsersV3()
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetSystemUsersV3")
print(response)

GetUserInventoryV3

Get user inventory from SaaS security monitoring.

PEP8 method name

get_user_inventory

Endpoint

Method	Route
	`/saas-security/entities/users/v3`

Required Scope

saas-security:read

Content-Type

Produces: application/json

Parameters

Name	Type	Data type	Description
email	query	string	Email.
integration_id	query	string	Comma separated integration ID's.
limit	query	integer	The maximum number of objects to return.
offset	query	integer	The starting index of the results.
privileged_only	query	boolean	Privileged Only.
parameters	query	dictionary	Full parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.get_user_inventory(integration_id="string",
                                     limit=integer,
                                     offset=integer,
                                     email="string",
                                     privileged_only=boolean
                                     )
print(response)

Service class example (Operation ID syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.GetUserInventoryV3(integration_id="string",
                                     limit=integer,
                                     offset=integer,
                                     email="string",
                                     privileged_only=boolean
                                     )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetUserInventoryV3",
                          integration_id="string",
                          limit=integer,
                          offset=integer,
                          email="string",
                          privileged_only=boolean
                          )
print(response)

IntegrationBuilderEndTransactionV3

End data upload transaction for custom integration.

PEP8 method name

complete_integration_upload

Endpoint

Method	Route
	`/saas-security/entities/custom-integration-close/v3`

Required Scope

saas-security:write

Content-Type

Produces: application/json

Parameters

Name	Service	Uber	Type	Data type	Description
id			query	string	Integration ID.
parameters			query	dictionary	Full parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.complete_integration_upload(id="string")
print(response)

Service class example (Operation ID syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.IntegrationBuilderEndTransactionV3(id="string")
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("IntegrationBuilderEndTransactionV3",
                          id="string"
                          )
print(response)

IntegrationBuilderGetStatusV3

Get status of custom integration builder.

PEP8 method name

get_integration_builder_status

Endpoint

Method	Route
	`/saas-security/entities/custom-integration-status/v3`

Required Scope

saas-security:read

Content-Type

Produces: application/json

Parameters

Name	Service	Uber	Type	Data type	Description
id			query	string	Integration ID.
parameters			query	dictionary	Full parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

response = falcon.get_integration_builder_status(id="string")
print(response)

Service class example (Operation ID syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.IntegrationBuilderGetStatusV3(id="string")
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("IntegrationBuilderGetStatusV3",
                          id="string"
                          )
print(response)

IntegrationBuilderResetV3

Reset custom integration builder.

PEP8 method name

reset_integration_builder

Endpoint

Method	Route
	`/saas-security/entities/custom-integration-reset/v3`

Required Scope

saas-security:write

Content-Type

Produces: application/json

Parameters

Name	Service	Uber	Type	Data type	Description
id			query	string	Integration ID.
parameters			query	dictionary	Full parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.reset_integration_builder(id="string")
print(response)

Service class example (Operation ID syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.IntegrationBuilderResetV3(id="string")
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("IntegrationBuilderResetV3",
                         id="string"
                         )
print(response)

IntegrationBuilderUploadV3

Upload data for custom integration builder.

PEP8 method name

upload_integration_builder

Endpoint

Method	Route
	`/saas-security/entities/custom-integration-upload/v3`

Required Scope

saas-security:write

Content-Type

Consumes: application/json
Produces: application/json

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
data	body	string	Data.
id	query	string	Integration ID.
source_id	query	string	Source ID.
parameters	query	dictionary	Full parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.upload_integration_builder(data="string",
					     id="string",
					     source_id="string"
					     )
print(response)

Service class example (Operation ID syntax)

from falconpy import SaasSecurity

# Do not hardcode API credentials!
falcon = SaasSecurity(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.IntegrationBuilderUploadV3(data="string",
                                             id="string",
                                             source_id="string"
                                             )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "data": "string"
}

response = falcon.command("IntegrationBuilderUploadV3",
                          body=body_payload,
                          id="string",
                          source_id="string"
                          )

print(response)

SaaS Security - jshcodes/falconpy GitHub Wiki

Using the SaaS Security service collection

Table of Contents

Passing credentials

DismissAffectedEntityV3

PEP8 method name

Endpoint

Required Scope

Content-Type

Parameters

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

DismissSecurityCheckV3

PEP8 method name

Endpoint

Required Scope

Content-Type

Parameters

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

GetActivityMonitorV3

PEP8 method name

Endpoint

Required Scope

Content-Type

Parameters

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

GetAlertsV3

PEP8 method name

Endpoint

Required Scope

Content-Type

Parameters

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

GetAppInventory

PEP8 method name

Endpoint

Required Scope

Content-Type

Parameters

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

GetAppInventoryUsers

PEP8 method name

Endpoint

Required Scope

Content-Type

Parameters

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

GetAssetInventoryV3

PEP8 method name

Endpoint

Required Scope

Content-Type

Parameters

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

GetDeviceInventoryV3

PEP8 method name

Endpoint

Required Scope

Content-Type

Parameters