-
Notifications
You must be signed in to change notification settings - Fork 120
Configuration Assessment
Joshua Hiller edited this page Jan 17, 2024
·
4 revisions
Operation ID | Description | ||||
---|---|---|---|---|---|
|
Search for assessments in your environment by providing an FQL filter and paging details. Returns a set of HostFinding entities which match the filter criteria | ||||
|
Get rules details for provided one or more rule IDs |
Search for assessments in your environment by providing an FQL filter and paging details. Returns a set of HostFinding entities which match the filter criteria
query_combined_assessments
Method | Route |
---|---|
/configuration-assessment/combined/assessments/v1 |
- Produces: application/json
Name | Service | Uber | Type | Data type | Description |
---|---|---|---|---|---|
after |
|
|
query | string | A pagination token used with the limit parameter to manage pagination of results. On your first request, don't provide an after token. On subsequent requests, provide the after token from the previous response to continue from that place in the results. |
limit |
|
|
query | integer | The number of items to return in this response (default: 100, max: 5000). Use with the after parameter to manage pagination of results. |
sort |
|
|
query | string | Sort assessment by their properties. Common sort options include:
|
filter |
|
|
query | string | Filter items using a query in Falcon Query Language (FQL). Wildcards * are unsupported. Common filter options include:
|
facet |
|
|
query | list of strings | Select various details blocks to be returned for each assessment entity. Supported values:
|
from falconpy.configuration_assessment import ConfigurationAssessment
falcon = ConfigurationAssessment(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.query_combined_assessments(after="string",
limit=integer,
sort="string",
filter="string",
facet=["string", "string"]
)
print(response)
from falconpy import ConfigurationAssessment
falcon = ConfigurationAssessment(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.getCombinedAssessmentsQuery(after="string",
limit=integer,
sort="string",
filter="string",
facet=["string", "string"]
)
print(response)
from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.command("getCombinedAssessmentsQuery",
after="string",
limit=integer,
sort="string",
filter="string",
facet=["string", "string"]
)
print(response)
Get rules details for provided one or more rule IDs
get_rule_details
Method | Route |
---|---|
/configuration-assessment/entities/rule-details/v1 |
- Produces: application/json
Name | Service | Uber | Type | Data type | Description |
---|---|---|---|---|---|
ids |
|
|
query | string or list of strings | One or more rules IDs (max: 400) |
from falconpy.configuration_assessment import ConfigurationAssessment
falcon = ConfigurationAssessment(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_rule_details(ids=id_list)
print(response)
from falconpy import ConfigurationAssessment
falcon = ConfigurationAssessment(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.getRuleDetails(ids=id_list)
print(response)
from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("getRuleDetails", ids=id_list)
print(response)
- Home
- Discussions Board
- Glossary of Terms
- Installation, Upgrades and Removal
- Samples Collection
- Using FalconPy
- API Operations
-
Service Collections
- Alerts
- API Integrations
- ASPM
- Certificate Based Exclusions
- Cloud Connect AWS (deprecated)
- Cloud Snapshots
- Compliance Assessments
- Configuration Assessment
- Configuration Assessment Evaluation Logic
- Container Alerts
- Container Detections
- Container Images
- Container Packages
- Container Vulnerabilities
- CSPM Registration
- Custom IOAs
- Custom Storage
- D4C Registration (deprecated)
- DataScanner
- Delivery Settings
- Detects
- Device Control Policies
- Discover
- Downloads
- Drift Indicators
- Event Streams
- Exposure Management
- Falcon Complete Dashboard
- Falcon Container
- Falcon Intelligence Sandbox
- FDR
- FileVantage
- Firewall Management
- Firewall Policies
- Foundry LogScale
- Host Group
- Host Migration
- Hosts
- Identity Protection
- Image Assessment Policies
- Incidents
- Installation Tokens
- Intel
- IOA Exclusions
- IOC
- IOCs (deprecated)
- Kubernetes Protection
- MalQuery
- Message Center
- ML Exclusions
- Mobile Enrollment
- MSSP (Flight Control)
- OAuth2
- ODS (On Demand Scan)
- Overwatch Dashboard
- Prevention Policy
- Quarantine
- Quick Scan
- Quick Scan Pro
- Real Time Response
- Real Time Response Admin
- Real Time Response Audit
- Recon
- Report Executions
- Response Policies
- Sample Uploads
- Scheduled Reports
- Sensor Download
- Sensor Update Policy
- Sensor Usage
- Sensor Visibility Exclusions
- Spotlight Evaluation Logic
- Spotlight Vulnerabilities
- Tailored Intelligence
- ThreatGraph
- Unidentified Containers
- User Management
- Workflows
- Zero Trust Assessment
- Documentation Support
-
CrowdStrike SDKs
- Crimson Falcon - Ruby
- FalconPy - Python 3
- FalconJS - Javascript
- goFalcon - Go
- PSFalcon - Powershell
- Rusty Falcon - Rust