Workflows - jshcodes/falconpy GitHub Wiki

CrowdStrike Falcon CrowdStrike Subreddit

Using the Workflows service collection

Uber class support Service class support Documentation Version Page Updated

Table of Contents

Operation ID Description
WorkflowActivitiesCombined
PEP 8 search_activities
Search for activities by name. Returns all supported activities if no filter is specified.
WorkflowActivitiesContentCombined
PEP 8 search_activities_content
Search for activities by name. Returns all supported activities if no filter is specified.
WorkflowExecute
PEP 8 execute
Executes an on-demand Workflow, the body is JSON used to trigger the execution, the response the execution ID(s)
WorkflowExecuteInternal
PEP 8 execute_internal
Executes an on-demand Workflow, the body is JSON used to trigger the execution, the response the execution ID(s)
WorkflowMockExecute
PEP 8 mock_execute
Executes an on-demand Workflow with mocks
WorkflowExecutionsAction
PEP 8 execution_action
Allows a user to resume/retry a failed workflow execution.
WorkflowExecutionResults
PEP 8 execution_results
Get execution result of a given execution
WorkflowSystemDefinitionsDeProvision
PEP 8 deprovision
Deprovisions a system definition that was previously provisioned on the target CID
WorkflowSystemDefinitionsPromote
PEP 8 promote
Promote a version of a system definition
WorkflowSystemDefinitionsProvision
PEP 8 provision
Provisions a system definition onto the target CID by using the template and provided parameters
WorkflowDefinitionsCombined
PEP 8 search_definitions
Search workflow definitions based on the provided filter
WorkflowTriggersCombined
PEP 8 search_triggers
Search for triggers by namespaced identifier, i.e. FalconAudit, Detection, or FalconAudit/Detection/Status. Returns all triggers if no filter is specified.
WorkflowExecutionsCombined
PEP 8 search_executions
Search workflow executions based on the provided filter
WorkflowDefinitionsExport
PEP 8 export_definition
Exports a workflow definition for the given definition ID
WorkflowDefinitionsImport
PEP 8 import_definition
Imports a workflow definition based on the provided model
WorkflowDefinitionsAction
PEP 8 workflow_definition_action
Enable or disable a workflow definition, or stop all executions for a definition.
WorkflowDefinitionsUpdate
PEP 8 update_definition
Updates a workflow definition based on the provided model.
WorkflowGetHumanInputV1
PEP 8 get_human_input
Gets one or more specific human inputs by their IDs.
WorkflowUpdateHumanInputV1
PEP 8 update_human_input
Provides an input in response to a human input action. Depending on action configuration, one or more of Approve, Decline, and/or Escalate are permitted.
v1_child_executions_query
PEP 8 query_child_executions
Search for child executions by providing a FQL filter and paging details.

Passing credentials

WARNING

client_id and client_secret are keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

WorkflowActivitiesCombined

Search for activities by name. Returns all supported activities if no filter is specified.

PEP8 method name

search_activities

Endpoint

Method Route
GET /workflows/combined/activities/v1

Required Scope

workflow:read

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter Service Class Support Uber Class Support query string FQL query specifying filter parameters.
offset Service Class Support Uber Class Support query string Starting pagination offset of records to return.
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.
limit Service Class Support Uber Class Support query integer Maximum number of records to return.
sort Service Class Support Uber Class Support query string Sort items by providing a comma separated list of property and direction (eg name.desc, time.asc). If direction is omitted, defaults to descending.

Usage

Service class example (PEP8 syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.search_activities(filter="string",
                                    offset="string",
                                    limit=integer,
                                    sort="string"
                                    )
print(response)
Service class example (Operation ID syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.WorkflowActivitiesCombined(filter="string",
                                             offset="string",
                                             limit=integer,
                                             sort="string"
                                             )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("WorkflowActivitiesCombined",
                          filter="string",
                          offset="string",
                          limit=integer,
                          sort="string"
                          )
print(response)

Back to Table of Contents

WorkflowActivitiesContentCombined

Search for activities by name. Returns all supported activities if no filter specified.

PEP8 method name

search_activities_content

Endpoint

Method Route
GET /workflows/combined/activity-content/v1

Required Scope

workflow:read

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter Service Class Support Uber Class Support query string FQL query specifying filter parameters.
limit Service Class Support Uber Class Support query integer Maximum number of records to return.
offset Service Class Support Uber Class Support query string Starting pagination offset of records to return.
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.
sort Service Class Support Uber Class Support query string Sort items by providing a comma separated list of property and direction (eg name.desc,time.asc). If direction is omitted, defaults to descending.

Usage

Service class example (PEP8 syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.search_activities_content(filter="string",
                                            offset="string",
                                            limit=integer,
                                            sort="string"
                                            )
print(response)
Service class example (Operation ID syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.WorkflowActivitiesContentCombined(filter="string",
                                                    offset="string",
                                                    limit=integer,
                                                    sort="string"
                                                    )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("WorkflowActivitiesContentCombined",
                          filter="string",
                          offset="string",
                          limit=integer,
                          sort="string"
                          )
print(response)

Back to Table of Contents

WorkflowExecute

Execute an on-demand workflow. Response will contain the execution ID.

PEP8 method name

execute

Endpoint

Method Route
POST /workflows/entities/execute/v1

Required Scope

workflow:write

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
definition_id
Service Class Support
Uber Class Support
 query string or list of strings Definition ID to execute, either a name or an ID can be specified.
execution_cid
Service Class Support
Uber Class Support
 query string or list of strings CID(s) to execute on.
name
Service Class Support
Uber Class Support
 query string Workflow name to execute, either a name or an ID can be specified.
key
Service Class Support
Uber Class Support
 query string Key used to help deduplicate executions, if unset a new UUID is used
depth
Service Class Support
Uber Class Support
 query integer Used to record the execution depth to help limit execution loops when a workflow triggers another. The maximum depth is 4.
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.
source_event_url
Service Class Support
Uber Class Support
 query string Used to record a URL to the source that led to triggering this workflow
body
Service Class Support
Uber Class Support
 body dictionary Full body payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

id_list = 'CID1,CID2,CID3'  # Can also pass a list here: ['CID1', 'CID2', 'CID3']

response = falcon.execute(definition_id=["string", "string"],
                          execution_cid=id_list,
                          name="string",
                          key="string",
                          depth=integer,
                          source_event_url="string"
                          )

print(response)
Service class example (Operation ID syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

id_list = 'CID1,CID2,CID3'  # Can also pass a list here: ['CID1', 'CID2', 'CID3']

response = falcon.WorkflowExecute(definition_id=["string", "string"],
                                  execution_cid=id_list,
                                  name="string",
                                  key="string",
                                  depth=integer,
                                  source_event_url="string"
                                  )

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

workflow_schema = {}

id_list = 'CID1,CID2,CID3'  # Can also pass a list here: ['CID1', 'CID2', 'CID3']

response = falcon.command("WorkflowExecute",
                          definition_id=["string", "string"],
                          execution_cid=id_list,
                          name="string",
                          key="string",
                          depth=integer,
                          source_event_url="string",
                          body=workflow_schema
                          )

print(response)

Back to Table of Contents

WorkflowExecuteInternal

Execute an on-demand workflow. Response will contain the execution ID.

PEP8 method name

execute_internal

Endpoint

Method Route
POST /workflows/entities/execute/internal/v1

Required Scope

workflow:write

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
batch_size
Service Class Support
Uber Class Support
 query integer Used to set the size of the batch.
definition_id
Service Class Support
Uber Class Support
 query string or list of strings Definition ID to execute, either a name or an ID can be specified.
execution_cid
Service Class Support
Uber Class Support
 query string or list of strings CID(s) to execute on.
name
Service Class Support
Uber Class Support
 query string Workflow name to execute, either a name or an ID can be specified.
key
Service Class Support
Uber Class Support
 query string Key used to help deduplicate executions, if unset a new UUID is used
depth
Service Class Support
Uber Class Support
 query integer Used to record the execution depth to help limit execution loops when a workflow triggers another. The maximum depth is 4.
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.
source_event_url
Service Class Support
Uber Class Support
 query string Used to record a URL to the source that led to triggering this workflow
body
Service Class Support
Uber Class Support
 body dictionary Full body payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

id_list = 'CID1,CID2,CID3'  # Can also pass a list here: ['CID1', 'CID2', 'CID3']

response = falcon.execute_internal(batch_size=integer,
                                   definition_id=["string", "string"],
                                   execution_cid=id_list,
                                   name="string",
                                   key="string",
                                   depth=integer,
                                   source_event_url="string"
                                   )
print(response)
Service class example (Operation ID syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

id_list = 'CID1,CID2,CID3'  # Can also pass a list here: ['CID1', 'CID2', 'CID3']

response = falcon.WorkflowExecuteInternal(batch_size=integer,
                                          definition_id=["string", "string"],
                                          execution_cid=id_list,
                                          name="string",
                                          key="string",
                                          depth=integer,
                                          source_event_url="string"
                                          )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

workflow_schema = {
    "schema details": "string"
}

id_list = 'CID1,CID2,CID3'  # Can also pass a list here: ['CID1', 'CID2', 'CID3']

response = falcon.command("WorkflowExecuteInternal",
                          batch_size=integer,
                          definition_id=["string", "string"],
                          execution_cid=id_list,
                          name="string",
                          key="string",
                          depth=integer,
                          source_event_url="string",
                          body=workflow_schema
                          )
print(response)

Back to Table of Contents

WorkflowMockExecute

Execute an on-demand workflow with mocks.

PEP8 method name

mock_execute

Endpoint

Method Route
POST /workflows/entities/mock-executions/v1

Required Scope

workflow:write

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
definition_id
Service Class Support
Uber Class Support
 query string or list of strings Definition ID to execute, either a name or an ID can be specified.
execution_cid
Service Class Support
Uber Class Support
 query string or list of strings CID(s) to execute on.
name
Service Class Support
Uber Class Support
 query string Workflow name to execute, either a name or an ID can be specified.
key
Service Class Support
Uber Class Support
 query string Key used to help deduplicate executions, if unset a new UUID is used
depth
Service Class Support
Uber Class Support
 query integer Used to record the execution depth to help limit execution loops when a workflow triggers another. The maximum depth is 4.
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.
source_event_url
Service Class Support
Uber Class Support
 query string Used to record a URL to the source that led to triggering this workflow
skip_validation
Service Class Support
Uber Class Support
 query boolean Skip validation of the workflow definition.
ignore_activity_mock_references
Service Class Support
Uber Class Support
 query boolean Ignore activity mock references during execution.
body
Service Class Support
Uber Class Support
 body dictionary Full body payload in JSON format containing the schema definition, mocks, and the on demand trigger.
validate_only
Service Class Support
Uber Class Support
 query boolean Prevent execution after validating mocks against definition.

Usage

Service class example (PEP8 syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

id_list = 'CID1,CID2,CID3'  # Can also pass a list here: ['CID1', 'CID2', 'CID3']

response = falcon.mock_execute(definition_id=["string", "string"],
                               execution_cid=id_list,
                               name="string",
                               key="string",
                               depth=integer,
                               source_event_url="string",
                               skip_validation=boolean,
                               ignore_activity_mock_references=boolean,
                               validate_only=boolean
                               )

print(response)
Service class example (Operation ID syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

id_list = 'CID1,CID2,CID3'  # Can also pass a list here: ['CID1', 'CID2', 'CID3']

response = falcon.WorkflowMockExecute(definition_id=["string", "string"],
                                      execution_cid=id_list,
                                      name="string",
                                      key="string",
                                      depth=integer,
                                      source_event_url="string",
                                      skip_validation=boolean,
                                      ignore_activity_mock_references=boolean,
                                      validate_only=boolean
                                      )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

body_payload = {
    "definition": {
        Workflow schema
    },
    "mocks": "string",
    "on_demand_trigger": "string"
}

id_list = 'CID1,CID2,CID3'  # Can also pass a list here: ['CID1', 'CID2', 'CID3']

response = falcon.command("WorkflowMockExecute",
                          definition_id=["string", "string"],
                          execution_cid=id_list,
                          name="string",
                          key="string",
                          depth=integer,
                          source_event_url="string",
                          body=body_payload,
                          validate_only=boolean
                          )
print(response)

Back to Table of Contents

WorkflowExecutionsAction

Allows a user to resume/retry a failed workflow execution.

PEP8 method name

execution_action

Endpoint

Method Route
POST /workflows/entities/execution-actions/v1

Required Scope

workflow:write

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
action_name
Service Class Support
Uber Class Support
 query string Specify one of these actions: - resume: resume/retry the workflow execution(s) specified in ids - cancel: cancel the workflow execution(s) specified in ids
action_parameters
Service Class Support
No Uber Class Support
 body list of dictionaries List of actions to perform.
body
Service Class Support
Uber Class Support
 body dictionary Full body payload in JSON format. Not required when using other keywords.
ids
Service Class Support
Uber Class Support
 body string or list of strings Execution IDs.

Usage

Service class example (PEP8 syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

response = falcon.execution_action(action_name="string",
                                   ids="string",
                                   name="string",
                                   value="string"
                                   )

print(response)
Service class example (Operation ID syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

response = falcon.WorkflowExecutionsAction(action_name="string",
                                           ids="string",
                                           name="string",
                                           value="string"
                                           )

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

body_payload = {
    "action_parameters": [
        {
            "name": "string",
            "value": "string"
        }
    ],
    "ids": [
        "string"
    ]
}

response = falcon.command("WorkflowExecutionsAction", action_name="string", body=body_payload)

print(response)

Back to Table of Contents

WorkflowExecutionResults

Get execution result of a given execution

PEP8 method name

execution_results

Endpoint

Method Route
GET /workflows/entities/execution-results/v1

Required Scope

workflow:read

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
ids
Service Class Support
Uber Class Support
 query string or list of strings Workflow execution ID to return results for.
parameters
Service Class Support
Uber Class Support
 query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.execution_results(ids=id_list)

print(response)
Service class example (Operation ID syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.WorkflowExecutionResults(ids=id_list)

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("WorkflowExecutionResults", ids=id_list)

print(response)

Back to Table of Contents

WorkflowSystemDefinitionsDeProvision

Deprovisions a system definition that was previously provisioned on the target CID.

PEP8 method name

deprovision

Endpoint

Method Route
POST /workflows/system-definitions/deprovision/v1

Required Scope

workflow:write

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
body
Service Class Support
Uber Class Support
 body dictionary Full body payload in JSON format. Not required when using other keywords.
definition_id
Service Class Support
No Uber Class Support
 body string Workflow definition ID.
deprovision_all
Service Class Support
No Uber Class Support
 body boolean Flag indicating if all workflows should be deprovisioned.
template_id
Service Class Support
No Uber Class Support
 body string Template ID.
template_name
Service Class Support
No Uber Class Support
 body string Template name.

Usage

Service class example (PEP8 syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

response = falcon.deprovision(definition_id="string",
                              deprovision_all=boolean,
                              template_id="string",
                              template_name="string",
                              )

print(response)
Service class example (Operation ID syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

response = falcon.WorkflowSystemDefinitionsDeProvision(definition_id="string",
                                                       deprovision_all=boolean,
                                                       template_id="string",
                                                       template_name="string",
                                                       )

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

body_payload = {
    "definition_id": "string",
    "deprovision_all": boolean,
    "template_id": "string",
    "template_name": "string"
}

response = falcon.command("WorkflowSystemDefinitionsDeProvision", body=body_payload)

print(response)

Back to Table of Contents

WorkflowSystemDefinitionsPromote

Promote a version of a system definition.

Tenant must be already provisioned. This allows the caller to apply an updated template version on a CID and expects all parameters to be supplied. If the template supports multi-instance, the customer scope definition ID must be supplied to determine which customer workflow should be update.

PEP8 method name

promote

Endpoint

Method Route
POST /workflows/system-definitions/promote/v1

Required Scope

workflow:write

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
activities
Service Class Support
No Uber Class Support
 body dictionary Dictionary of workflow activities.
body
Service Class Support
Uber Class Support
 body dictionary Full body payload in JSON format. Not required when using other keywords.
conditions
Service Class Support
No Uber Class Support
 body list of dictionaries List of workflow conditions.
customer_definition_id
Service Class Support
No Uber Class Support
 body string Customer definition ID.
name
Service Class Support
No Uber Class Support
 body string Name of the workflow.
parameters
Service Class Support
No Uber Class Support
 body dictionary Overrides specified activities, conditions and trigger keywords.
template_id
Service Class Support
No Uber Class Support
 body string Template ID.
template_name
Service Class Support
No Uber Class Support
 body string Template name.
template_version
Service Class Support
No Uber Class Support
 body string Template version.
trigger
Service Class Support
No Uber Class Support
 body dictionary Workflow trigger definition.

Usage

Service class example (PEP8 syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

activities = {
    "configuration": [
        {
            "node_id": "string",
            "properties": {}
        }
    ],
    "selection": [
        {
            "id": "string",
            "properties": {},
            "source": "string"
        }
    ]
}
conditions = [
    {
        "fields": [
            {
                "name": "string",
                "operator": "string"
            }
        ],
        "node_id": "string"
    }
]
trigger = {
    "fields": {},
    "node_id": "string"
}

response = falcon.promote(activities=activities,
                          conditions=conditions,
                          customer_definition_id="string",
                          name="string",
                          template_id="string",
                          template_name="string",
                          template_version="string",
                          trigger=trigger
                          )

print(response)
Service class example (Operation ID syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

activities = {
    "configuration": [
        {
            "node_id": "string",
            "properties": {}
        }
    ],
    "selection": [
        {
            "id": "string",
            "properties": {},
            "source": "string"
        }
    ]
}
conditions = [
    {
        "fields": [
            {
                "name": "string",
                "operator": "string"
            }
        ],
        "node_id": "string"
    }
]
trigger = {
    "fields": {},
    "node_id": "string"
}

response = falcon.WorkflowSystemDefinitionsPromote(activities=activities,
                                                   conditions=conditions,
                                                   customer_definition_id="string",
                                                   name="string",
                                                   template_id="string",
                                                   template_name="string",
                                                   template_version="string",
                                                   trigger=trigger
                                                   )

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

activities = {
    "configuration": [
        {
            "node_id": "string",
            "properties": {}
        }
    ],
    "selection": [
        {
            "id": "string",
            "properties": {},
            "source": "string"
        }
    ]
}
conditions = [
    {
        "fields": [
            {
                "name": "string",
                "operator": "string"
            }
        ],
        "node_id": "string"
    }
]
trigger = {
    "fields": {},
    "node_id": "string"
}
body_payload = {
    "customer_definition_id": "string",
    "name": "string",
    "parameters": {
        "activities": activities,
        "conditions": conditions,
        "trigger": trigger
    },
    "template_id": "string",
    "template_name": "string",
    "template_version": "string"
}

response = falcon.command("WorkflowSystemDefinitionsPromote", body=body_payload)

print(response)

Back to Table of Contents

WorkflowSystemDefinitionsProvision

Provisions a system definition onto the target CID by using the template and provided parameters.

PEP8 method name

provision

Endpoint

Method Route
POST /workflows/system-definitions/provision/v1

Required Scope

workflow:write

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
activities
Service Class Support
No Uber Class Support
 body dictionary Dictionary of workflow activities.
body
Service Class Support
Uber Class Support
 body dictionary Full body payload in JSON format. Not required when using other keywords.
conditions
Service Class Support
No Uber Class Support
 body list of dictionaries List of workflow conditions.
customer_definition_id
Service Class Support
No Uber Class Support
 body string Customer definition ID.
name
Service Class Support
No Uber Class Support
 body string Workflow name.
parameters
Service Class Support
No Uber Class Support
 body dictionary Overrides specified activities, conditions and trigger keywords.
template_id
Service Class Support
No Uber Class Support
 body string Template ID.
template_name
Service Class Support
No Uber Class Support
 body string Template name.
template_version
Service Class Support
No Uber Class Support
 body string Template version.
trigger
Service Class Support
No Uber Class Support
 body dictionary Workflow trigger definition.

Usage

Service class example (PEP8 syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

activities = {
    "configuration": [
        {
            "node_id": "string",
            "properties": {}
        }
    ],
    "selection": [
        {
            "id": "string",
            "properties": {},
            "source": "string"
        }
    ]
}
conditions = [
    {
        "fields": [
            {
                "name": "string",
                "operator": "string"
            }
        ],
        "node_id": "string"
    }
]
trigger = {
    "fields": {},
    "node_id": "string"
}

response = falcon.provision(activities=activities,
                            conditions=conditions,
                            customer_definition_id="string",
                            name="string",
                            template_id="string",
                            template_name="string",
                            template_version="string",
                            trigger=trigger
                            )

print(response)
Service class example (Operation ID syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

activities = {
    "configuration": [
        {
            "node_id": "string",
            "properties": {}
        }
    ],
    "selection": [
        {
            "id": "string",
            "properties": {},
            "source": "string"
        }
    ]
}
conditions = [
    {
        "fields": [
            {
                "name": "string",
                "operator": "string"
            }
        ],
        "node_id": "string"
    }
]
trigger = {
    "fields": {},
    "node_id": "string"
}

response = falcon.WorkflowSystemDefinitionsProvision(activities=activities,
                                                     conditions=conditions,
                                                     customer_definition_id="string",
                                                     name="string",
                                                     template_id="string",
                                                     template_name="string",
                                                     template_version="string",
                                                     trigger=trigger
                                                     )

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

activities = {
    "configuration": [
        {
            "node_id": "string",
            "properties": {}
        }
    ],
    "selection": [
        {
            "id": "string",
            "properties": {},
            "source": "string"
        }
    ]
}
conditions = [
    {
        "fields": [
            {
                "name": "string",
                "operator": "string"
            }
        ],
        "node_id": "string"
    }
]
trigger = {
    "fields": {},
    "node_id": "string"
}
body_payload = {
    "customer_definition_id": "string",
    "name": "string",
    "parameters": {
        "activities": activities,
        "conditions": conditions,
        "trigger": trigger
    },
    "template_id": "string",
    "template_name": "string",
    "template_version": "string"
}

response = falcon.command("WorkflowSystemDefinitionsProvision", body=body_payload)

print(response)

Back to Table of Contents

WorkflowDefinitionsCombined

Search workflow definitions based on the provided filter.

PEP8 method name

search_definitions

Endpoint

Method Route
GET /workflows/combined/definitions/v1

Required Scope

workflow:read

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter Service Class Support Uber Class Support query string FQL query specifying filter parameters.
offset Service Class Support Uber Class Support query string Starting pagination offset of records to return.
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.
limit Service Class Support Uber Class Support query integer Maximum number of records to return.
sort Service Class Support Uber Class Support query string Sort items by providing a comma separated list of property and direction (eg name.desc, time.asc). If direction is omitted, defaults to descending.

Usage

Service class example (PEP8 syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.search_definitions(filter="string",
                                     offset="string",
                                     limit=integer,
                                     sort="string"
                                     )
print(response)
Service class example (Operation ID syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.WorkflowDefinitionsCombined(filter="string",
                                              offset="string",
                                              limit=integer,
                                              sort="string"
                                              )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("WorkflowDefinitionsCombined",
                          filter="string",
                          offset="string",
                          limit=integer,
                          sort="string"
                          )
print(response)

Back to Table of Contents

WorkflowExecutionsCombined

Search workflow executions based on the provided filter.

PEP8 method name

search_executions

Endpoint

Method Route
GET /workflows/combined/executions/v1

Required Scope

workflow:read

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter Service Class Support Uber Class Support query string FQL query specifying filter parameters.
offset Service Class Support Uber Class Support query string Starting pagination offset of records to return.
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.
limit Service Class Support Uber Class Support query integer Maximum number of records to return.
sort Service Class Support Uber Class Support query string Sort items by providing a comma separated list of property and direction (eg name.desc, time.asc). If direction is omitted, defaults to descending.

Usage

Service class example (PEP8 syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.search_executions(filter="string",
                                    offset="string",
                                    limit=integer,
                                    sort="string"
                                    )
print(response)
Service class example (Operation ID syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.WorkflowExecutionsCombined(filter="string",
                                             offset="string",
                                             limit=integer,
                                             sort="string"
                                             )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("WorkflowExecutionsCombined",
                          filter="string",
                          offset="string",
                          limit=integer,
                          sort="string"
                          )
print(response)

Back to Table of Contents

WorkflowTriggersCombined

Search for triggers by namespaced identifier, i.e. FalconAudit, Detection, or FalconAudit/Detection/Status. Returns all triggers if no filter is specified.

PEP8 method name

search_triggers

Endpoint

Method Route
GET /workflows/combined/triggers/v1

Required Scope

workflow:read

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter Service Class Support Uber Class Support query string FQL query specifying filter parameters.
offset Service Class Support Uber Class Support query string Starting pagination offset of records to return.
limit Service Class Support Uber Class Support query integer Maximum number of records to return.
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.search_triggers(filter="string")

print(response)
Service class example (Operation ID syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.WorkflowTriggersCombined(filter="string")

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("WorkflowTriggersCombined", filter="string")

print(response)

Back to Table of Contents

WorkflowDefinitionsExport

Exports a workflow definition for the given definition ID.

PEP8 method name

export_definition

Endpoint

Method Route
GET /workflows/entities/definitions/export/v1

Required Scope

workflow:read

Content-Type

  • Consumes: application/json
  • Produces: application/yaml

Keyword Arguments

Name Service Uber Type Data type Description
id Service Class Support Uber Class Support query string ID of workflow definitions to return details for.
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.
sanitize Service Class Support Uber Class Support query boolean Sanitize PII from workflow before it is exported.

Usage

Service class example (PEP8 syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.export_definition(id="string", sanitize=boolean)

print(response)
Service class example (Operation ID syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.WorkflowDefinitionsExport(id="string", sanitize=boolean)

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("WorkflowDefinitionsExport", id="string", sanitize=boolean)

print(response)

Back to Table of Contents

WorkflowDefinitionsImport

Imports a workflow definition based on the provided model

PEP8 method name

import_definition

Endpoint

Method Route
POST /workflows/entities/definitions/import/v1

Required Scope

workflow:write

Content-Type

  • Consumes: multipart/form-data
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
data_file Service Class Support Uber Class Support formData file A workflow definition in YAML format to import. Can be the file location or the file contents.
name Service Class Support Uber Class Support query string Workflow name to override.
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.
validate_only Service Class Support Uber Class Support query boolean When enabled, prevents saving workflow after validating.

Usage

Service class example (PEP8 syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

with open("filename.yml", "r") as yaml_file:
    response = falcon.import_definition(name="string", validate_only=boolean, data_file=yaml_file)

print(response)
Service class example (Operation ID syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

with open("filename.yml", "r") as yaml_file:
    response = falcon.WorkflowDefinitionsImport(name="string",
                                                validate_only=boolean,
                                                data_file=yaml_file
                                                )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

with open("filename.yml", "r") as yaml_file:
    response = falcon.command("WorkflowDefinitionsImport",
                              name="string",
                              validate_only=boolean,
                              data_file=yaml_file
                              )
print(response)

Back to Table of Contents

WorkflowDefinitionsAction

Enable or disable a workflow definition, or stop all executions for a definition.

When a definition is disabled it will not execute against any new trigger events.

PEP8 method name

workflow_definition_action

Endpoint

Method Route
POST /workflows/entities/definition-actions/v1

Required Scope

workflow:write

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Name Service Uber Type Data type Description
action_name
Service Class Support
Uber Class Support
 query string Specify one of these actions: enable - enable the workflow(s) specified in ids, disable - disable the workflow(s) specified in ids, cancel - cancel all in-flight executions for the workflow specified in ids. Required parameter.
ids Service Class Support No Uber Class Support body string or list of strings ID(s) of workflow definitions to perform the action against.
body
Service Class Support
Uber Class Support
 body dictionary Full body payload in JSON format. Required parameter.
parameters
Service Class Support
Uber Class Support
 query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.workflow_definition_action(action_name="string",
                                             ids=["string"]
                                             )
print(response)
Service class example (Operation ID syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.WorkflowDefinitionsAction(action_name="string",
                                            ids=["string"]
                                            )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "ids": [
        "string"
    ]
}

response = falcon.command("WorkflowDefinitionsAction",
                          action_name="string",
                          body=body_payload
                          )
print(response)

Back to Table of Contents

WorkflowDefinitionsUpdate

Updates a workflow definition based on the provided model.

PEP8 method name

update_definition

Endpoint

Method Route
PUT /workflows/entities/definitions/v1

Required Scope

workflow:write

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
body Service Class Support Uber Class Support body dictionary Full workflow definition with all parameters in JSON format.
change_log Service Class Support No Uber Class Support body string Workflow revision change log comment.
definition Service Class Support No Uber Class Support body dictionary Workflow definition parameters.
flight_control Service Class Support No Uber Class Support body dictionary Workflow flight control functionality definitions.
id Service Class Support No Uber Class Support body string Workflow ID to update.
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.
validate_only Service Class Support Uber Class Support query boolean When enabled, prevents saving workflow after validating.

Usage

Service class example (PEP8 syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

workflow_definition = {
    "Workflow definition in JSON format"
}
fc_params = {
    "all_cids": boolean,
    "excluded_cids": [
        "string"
    ],
    "include_parent_cid": boolean,
    "selected_cids": [
        "string"
    ]
}

response = falcon.update_definition(change_log="string",
                                    definition=workflow_definition,
                                    flight_control=fc_params,
                                    id="string",
                                    validate_only=boolean
                                    )
print(response)
Service class example (Operation ID syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

workflow_definition = {
    "Workflow definition in JSON format"
}
fc_params = {
    "all_cids": boolean,
    "excluded_cids": [
        "string"
    ],
    "include_parent_cid": boolean,
    "selected_cids": [
        "string"
    ]
}
response = falcon.WorkflowDefinitionsUpdate(change_log="string",
                                            definition=workflow_definition,
                                            flight_control=fc_params,
                                            id="string",
                                            validate_only=boolean
                                            )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

workflow_definition = {
    "Workflow definition in JSON format"
}
fc_params = {
    "all_cids": boolean,
    "excluded_cids": [
        "string"
    ],
    "include_parent_cid": boolean,
    "selected_cids": [
        "string"
    ]
}
body_payload = {
    "Definition": workflow_definition,
    "change_log": "string",
    "enabled": boolean,
    "flight_control": fc_params,
    "id": "string"
}
response = falcon.command("WorkflowDefinitionsUpdate", body=body_payload)

print(response)

Back to Table of Contents

WorkflowGetHumanInputV1

Gets one or more specific human inputs by their IDs.

PEP8 method name

get_human_input

Endpoint

Method Route
GET /workflows/entities/human-inputs/v1

Required Scope

workflow:read

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
ids Service Class Support Uber Class Support query string or list of strings ID(s) of human inputs to retrieve.
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_human_input(ids=id_list)

print(response)
Service class example (Operation ID syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.WorkflowGetHumanInputV1(ids=id_list)

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("WorkflowGetHumanInputV1", ids=id_list)

print(response)

Back to Table of Contents

WorkflowUpdateHumanInputV1

Provides an input in response to a human input action. Depending on action configuration, one or more of Approve, Decline, and/or Escalate are permitted.

PEP8 method name

update_human_input

Endpoint

Method Route
PATCH /workflows/entities/human-inputs/v1

Required Scope

workflow:write

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
body Service Class Support Uber Class Support body dictionary Full body payload in JSON format.
id Service Class Support Uber Class Support query string ID of human input to provide an input to.
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.
input Service Class Support No Uber Class Support body string Input value.
note Service Class Support No Uber Class Support body string Input note.

Usage

Service class example (PEP8 syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.update_human_input(id="string", input="string", note="string")

print(response)
Service class example (Operation ID syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.WorkflowUpdateHumanInputV1(id="string", input="string", note="string")

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "input": "string",
    "note": "string"
}

response = falcon.command("WorkflowUpdateHumanInputV1", id="string", body=body_payload)

print(response)

Back to Table of Contents

v1_child_executions_query

Search for child executions by providing a FQL filter and paging details. Returns the set of child workflow execution IDs which match the filter criteria.

PEP8 method name

query_child_executions

Endpoint

Method Route
GET /workflows/queries/child-executions/v1

Required Scope

workflow:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter Service Class Support Uber Class Support query string FQL query specifying filter parameters.
offset Service Class Support Uber Class Support query string Starting pagination offset of records to return.
limit Service Class Support Uber Class Support query integer Maximum number of records to return.
sort Service Class Support Uber Class Support query string Sort items by providing a comma separated list of property and direction (eg name.desc, time.asc). If direction is omitted, defaults to descending.
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.query_child_executions(filter="string",
                                         offset="string",
                                         limit=integer,
                                         sort="string"
                                         )
print(response)
Service class example (Operation ID syntax)
from falconpy import Workflows

# Do not hardcode API credentials!
falcon = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.v1_child_executions_query(filter="string",
                                            offset="string",
                                            limit=integer,
                                            sort="string"
                                            )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("v1_child_executions_query",
                          filter="string",
                          offset="string",
                          limit=integer,
                          sort="string"
                          )
print(response)

Back to Table of Contents

⚠️ **GitHub.com Fallback** ⚠️