Crimson Falcon - The CrowdStrike Falcon SDK for Ruby

Welcome to Crimson Falcon, the Ruby SDK for the CrowdStrike Falcon Platform. This is where the power of the CrowdStrike Falcon Platform meets the elegance and simplicity of Ruby.

"Why Ruby?" you might ask.

Well, Ruby is a dynamic, open source programming language with a focus on simplicity and productivity. It has an elegant syntax that is natural to read and easy to write. It's unique balance of simplicity, productivity, and just sheer fun, makes coding feel less like a task and more like a hobby. It's like your favorite pair of comfy shoes - familiar, comfortable, and always reliable. 😉

That's what we aim to achieve with Crimson Falcon - a tool that brings together the robust capabilities of CrowdStrike Falcon with the friendly charm of Ruby.

Ready to bring some fun to your cybersecurity game with Ruby and Crimson Falcon? Let's jump right in!

Installation
Getting Started
Contribute to Crimson Falcon
Crimson Falcon API Docs

Installation

From RubyGems (This is the way)

To install from RubyGems, use the following command:

gem install crimson-falcon

Add this to the Gemfile:

    gem 'crimson-falcon', '~> 0.4.1'

From Source to Gem: Building the Ruby Code

To build the Ruby code into a gem:

gem build crimson-falcon.gemspec

Then install the gem locally:

gem install ./crimson-falcon-0.4.1.gem

Finally, add this to the Gemfile:

    gem 'crimson-falcon', '~> 0.4.1'

Install from Git

If the Ruby gem is hosted at a git repository: https://github.com/GIT_USER_ID/GIT_REPO_ID, then add the following in the Gemfile:

    # Example
    gem 'crimson-falcon', :git => 'https://github.com/CrowdStrike/crimson-falcon.git'

Getting Started

Samples

We have a collection of sample code that demonstrates how to use the Crimson Falcon SDK. These samples are a great way to get started with the SDK. You can find the samples in the samples directory.

Take Flight

Eager to take flight? Follow the installation process, and then launch into the following code:

# Load the gem
require 'crimson-falcon'

# Setup authorization
Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = "us-2" # or "us-2", "eu-1", "us-gov1"
end

# Create a new API instance
api_instance = Falcon::SensorDownloadApi.new

begin
  # Get CCID to use with sensor installers
  result = api_instance.get_sensor_installers_ccidby_query
  p result.resources
rescue Falcon::ApiError => e
  puts "Error when calling SensorDownloadApi->get_sensor_installers_ccidby_query: #{e}"
end

Welcome aboard the Crimson Falcon! Fly high, code with grace.

Contribute to Crimson Falcon

We are always excited to have contributions from the community! It's what makes open source truly powerful. If you are looking to help out, that's awesome and we thank you in advance.

To get started, please read our Contributing Guide that explains the development process, the project structure, how to propose bugfixes and improvements, and how to build and test your changes to the project. It's a set of directions that will help establish a baseline of expectation for any contributions.

Please make sure you also follow our Code of Conduct. It outlines our expectations for participant behavior as well as the steps for reporting unacceptable behavior.

We appreciate your interest in our project and look forward to collaborating with you!

Crimson Falcon API Docs

♻️ API Docs are automatically generated from the CrowdStrike API specification. ♻️

Class: Falcon::AlertsApi

Operation: get_queries_alerts_v1
GET: /alerts/queries/alerts/v1
Description: retrieves all Alerts ids that match a given query

Class: Falcon::AlertsApi

Operation: get_queries_alerts_v2
GET: /alerts/queries/alerts/v2
Description: retrieves all Alerts ids that match a given query

Class: Falcon::AlertsApi

Operation: patch_entities_alerts_v2
PATCH: /alerts/entities/alerts/v2
Description: Perform actions on Alerts identified by composite ID(s) in request. Each action has a name and a description which describes what the action does. If a request adds and removes tag in a single request, the order of processing would be to remove tags before adding new ones in.

Class: Falcon::AlertsApi

Operation: patch_entities_alerts_v3
PATCH: /alerts/entities/alerts/v3
Description: Perform actions on Alerts identified by composite ID(s) in request. Each action has a name and a description which describes what the action does. If a request adds and removes tag in a single request, the order of processing would be to remove tags before adding new ones in.

Class: Falcon::AlertsApi

Operation: post_aggregates_alerts_v1
POST: /alerts/aggregates/alerts/v1
Description: retrieves aggregate values for Alerts across all CIDs

Class: Falcon::AlertsApi

Operation: post_aggregates_alerts_v2
POST: /alerts/aggregates/alerts/v2
Description: retrieves aggregate values for Alerts across all CIDs

Class: Falcon::AlertsApi

Operation: post_entities_alerts_v1
POST: /alerts/entities/alerts/v1
Description: retrieves all Alerts given their ids

Class: Falcon::AlertsApi

Operation: post_entities_alerts_v2
POST: /alerts/entities/alerts/v2
Description: retrieves all Alerts given their composite ids

Class: Falcon::CloudConnectAwsApi

Operation: create_or_update_aws_settings
POST: /cloud-connect-aws/entities/settings/v1
Description: Create or update Global Settings which are applicable to all provisioned AWS accounts

Class: Falcon::CloudConnectAwsApi

Operation: delete_aws_accounts
DELETE: /cloud-connect-aws/entities/accounts/v1
Description: Delete a set of AWS Accounts by specifying their IDs

Class: Falcon::CloudConnectAwsApi

Operation: get_aws_accounts
GET: /cloud-connect-aws/entities/accounts/v1
Description: Retrieve a set of AWS Accounts by specifying their IDs

Class: Falcon::CloudConnectAwsApi

Operation: get_aws_settings
GET: /cloud-connect-aws/combined/settings/v1
Description: Retrieve a set of Global Settings which are applicable to all provisioned AWS accounts

Class: Falcon::CloudConnectAwsApi

Operation: provision_aws_accounts
POST: /cloud-connect-aws/entities/accounts/v1
Description: Provision AWS Accounts by specifying details about the accounts to provision

Class: Falcon::CloudConnectAwsApi

Operation: query_aws_accounts
GET: /cloud-connect-aws/combined/accounts/v1
Description: Search for provisioned AWS Accounts by providing an FQL filter and paging details. Returns a set of AWS accounts which match the filter criteria

Class: Falcon::CloudConnectAwsApi

Operation: query_aws_accounts_for_ids
GET: /cloud-connect-aws/queries/accounts/v1
Description: Search for provisioned AWS Accounts by providing an FQL filter and paging details. Returns a set of AWS account IDs which match the filter criteria

Class: Falcon::CloudConnectAwsApi

Operation: update_aws_accounts
PATCH: /cloud-connect-aws/entities/accounts/v1
Description: Update AWS Accounts by specifying the ID of the account and details to update

Class: Falcon::CloudConnectAwsApi

Operation: verify_aws_account_access
POST: /cloud-connect-aws/entities/verify-account-access/v1
Description: Performs an Access Verification check on the specified AWS Account IDs

Class: Falcon::CloudSnapshotsApi

Operation: register_cspm_snapshot_account
POST: /snapshots/entities/accounts/v1
Description: Register customer cloud account for snapshot scanning

Class: Falcon::ConfigurationAssessmentApi

Operation: get_combined_assessments_query
GET: /configuration-assessment/combined/assessments/v1
Description: Search for assessments in your environment by providing an FQL filter and paging details. Returns a set of HostFinding entities which match the filter criteria

Class: Falcon::ConfigurationAssessmentApi

Operation: get_rule_details
GET: /configuration-assessment/entities/rule-details/v1
Description: Get rules details for provided one or more rule IDs

Class: Falcon::ConfigurationAssessmentEvaluationLogicApi

Operation: get_evaluation_logic_mixin0
GET: /configuration-assessment/entities/evaluation-logic/v1
Description: Get details on evaluation logic items by providing one or more finding IDs.

Class: Falcon::ContainerAlertsApi

Operation: read_container_alerts_count
GET: /container-security/aggregates/container-alerts/count/v1
Description: Search Container Alerts by the provided search criteria

Class: Falcon::ContainerAlertsApi

Operation: read_container_alerts_count_by_severity
GET: /container-security/aggregates/container-alerts/count-by-severity/v1
Description: Get Container Alerts counts by severity

Class: Falcon::ContainerAlertsApi

Operation: search_and_read_container_alerts
GET: /container-security/combined/container-alerts/v1
Description: Search Container Alerts by the provided search criteria

Class: Falcon::ContainerDetectionsApi

Operation: read_combined_detections
GET: /container-security/combined/detections/v1
Description: Retrieve image assessment detections identified by the provided filter criteria

Class: Falcon::ContainerDetectionsApi

Operation: read_detections
GET: /container-security/entities/detections/v1
Description: Retrieve image assessment detection entities identified by the provided filter criteria

Class: Falcon::ContainerDetectionsApi

Operation: read_detections_count
GET: /container-security/aggregates/detections/count/v1
Description: Aggregate count of detections

Class: Falcon::ContainerDetectionsApi

Operation: read_detections_count_by_severity
GET: /container-security/aggregates/detections/count-by-severity/v1
Description: Aggregate counts of detections by severity

Class: Falcon::ContainerDetectionsApi

Operation: read_detections_count_by_type
GET: /container-security/aggregates/detections/count-by-type/v1
Description: Aggregate counts of detections by detection type

Class: Falcon::ContainerDetectionsApi

Operation: search_detections
GET: /container-security/queries/detections/v1
Description: Retrieve image assessment detection entities identified by the provided filter criteria

Class: Falcon::ContainerImagesApi

Operation: aggregate_image_assessment_history
GET: /container-security/aggregates/images/assessment-history/v1
Description: Image assessment history

Class: Falcon::ContainerImagesApi

Operation: aggregate_image_count
GET: /container-security/aggregates/images/count/v1
Description: Aggregate count of images

Class: Falcon::ContainerImagesApi

Operation: aggregate_image_count_by_base_os
GET: /container-security/aggregates/images/count-by-os-distribution/v1
Description: Aggregate count of images grouped by Base OS distribution

Class: Falcon::ContainerImagesApi

Operation: aggregate_image_count_by_state
GET: /container-security/aggregates/images/count-by-state/v1
Description: Aggregate count of images grouped by state

Class: Falcon::ContainerImagesApi

Operation: combined_image_by_vulnerability_count
GET: /container-security/combined/images/by-vulnerability-count/v1
Description: Retrieve top x images with the most vulnerabilities

Class: Falcon::ContainerImagesApi

Operation: combined_image_detail
GET: /container-security/combined/images/detail/v1
Description: Retrieve image entities identified by the provided filter criteria

Class: Falcon::ContainerImagesApi

Operation: combined_image_issues_summary
GET: /container-security/combined/images/issues-summary/v1
Description: Retrieve image issues summary such as Image detections, Runtime detections, Policies, vulnerabilities

Class: Falcon::ContainerImagesApi

Operation: combined_image_vulnerability_summary
GET: /container-security/combined/images/vulnerabilities-summary/v1
Description: aggregates information about vulnerabilities for an image

Class: Falcon::ContainerImagesApi

Operation: get_combined_images
GET: /container-security/combined/image-assessment/images/v1
Description: Get image assessment results by providing an FQL filter and paging details

Class: Falcon::ContainerImagesApi

Operation: read_combined_images_export
GET: /container-security/combined/images/export/v1
Description: Retrieve images with an option to expand aggregated vulnerabilities/detections

Class: Falcon::ContainerPackagesApi

Operation: read_packages_by_fixable_vuln_count
GET: /container-security/combined/packages/app-by-fixable-vulnerability-count/v1
Description: Retrieve top x app packages with the most fixable vulnerabilities

Class: Falcon::ContainerPackagesApi

Operation: read_packages_by_vuln_count
GET: /container-security/combined/packages/by-vulnerability-count/v1
Description: Retrieve top x packages with the most vulnerabilities

Class: Falcon::ContainerPackagesApi

Operation: read_packages_combined
GET: /container-security/combined/packages/v1
Description: Retrieve packages identified by the provided filter criteria

Class: Falcon::ContainerPackagesApi

Operation: read_packages_combined_export
GET: /container-security/combined/packages/export/v1
Description: Retrieve packages identified by the provided filter criteria for the purpose of export

Class: Falcon::ContainerPackagesApi

Operation: read_packages_count_by_zero_day
GET: /container-security/aggregates/packages/count-by-zero-day/v1
Description: Retrieve packages count affected by zero day vulnerabilities

Class: Falcon::ContainerVulnerabilitiesApi

Operation: read_combined_vulnerabilities
GET: /container-security/combined/vulnerabilities/v1
Description: Retrieve vulnerability and aggregate data filtered by the provided FQL

Class: Falcon::ContainerVulnerabilitiesApi

Operation: read_combined_vulnerabilities_details
GET: /container-security/combined/vulnerabilities/details/v1
Description: Retrieve vulnerability details related to an image

Class: Falcon::ContainerVulnerabilitiesApi

Operation: read_combined_vulnerabilities_info
GET: /container-security/combined/vulnerabilities/info/v1
Description: Retrieve vulnerability and package related info for this customer

Class: Falcon::ContainerVulnerabilitiesApi

Operation: read_vulnerabilities_by_image_count
GET: /container-security/combined/vulnerabilities/by-image-count/v1
Description: Retrieve top x vulnerabilities with the most impacted images

Class: Falcon::ContainerVulnerabilitiesApi

Operation: read_vulnerabilities_publication_date
GET: /container-security/combined/vulnerabilities/by-published-date/v1
Description: Retrieve top x vulnerabilities with the most recent publication date

Class: Falcon::ContainerVulnerabilitiesApi

Operation: read_vulnerability_count
GET: /container-security/aggregates/vulnerabilities/count/v1
Description: Aggregate count of vulnerabilities

Class: Falcon::ContainerVulnerabilitiesApi

Operation: read_vulnerability_count_by_actively_exploited
GET: /container-security/aggregates/vulnerabilities/count-by-actively-exploited/v1
Description: Aggregate count of vulnerabilities grouped by actively exploited

Class: Falcon::ContainerVulnerabilitiesApi

Operation: read_vulnerability_count_by_cps_rating
GET: /container-security/aggregates/vulnerabilities/count-by-cps-rating/v1
Description: Aggregate count of vulnerabilities grouped by csp_rating

Class: Falcon::ContainerVulnerabilitiesApi

Operation: read_vulnerability_count_by_cvss_score
GET: /container-security/aggregates/vulnerabilities/count-by-cvss-score/v1
Description: Aggregate count of vulnerabilities grouped by cvss score

Class: Falcon::ContainerVulnerabilitiesApi

Operation: read_vulnerability_count_by_severity
GET: /container-security/aggregates/vulnerabilities/count-by-severity/v1
Description: Aggregate count of vulnerabilities grouped by severity

Class: Falcon::CspmRegistrationApi

Operation: azure_download_certificate
GET: /cloud-connect-cspm-azure/entities/download-certificate/v1
Description: Returns JSON object(s) that contain the base64 encoded certificate for a service principal.

Class: Falcon::CspmRegistrationApi

Operation: connect_cspmgcp_account
POST: /cloud-connect-cspm-gcp/entities/account/v2
Description: Creates a new GCP account with newly-uploaded service account or connects with existing service account with only the following fields: parent_id, parent_type and service_account_id

Class: Falcon::CspmRegistrationApi

Operation: create_cspm_aws_account
POST: /cloud-connect-cspm-aws/entities/account/v1
Description: Creates a new account in our system for a customer and generates a script for them to run in their AWS cloud environment to grant us access.

Class: Falcon::CspmRegistrationApi

Operation: create_cspm_azure_account
POST: /cloud-connect-cspm-azure/entities/account/v1
Description: Creates a new account in our system for a customer and generates a script for them to run in their cloud environment to grant us access.

Class: Falcon::CspmRegistrationApi

Operation: create_cspm_azure_management_group
POST: /cloud-connect-cspm-azure/entities/management-group/v1
Description: Creates a new management group in our system for a customer.

Class: Falcon::CspmRegistrationApi

Operation: create_cspmgcp_account
POST: /cloud-connect-cspm-gcp/entities/account/v1
Description: Creates a new account in our system for a customer and generates a new service account for them to add access to in their GCP environment to grant us access.

Class: Falcon::CspmRegistrationApi

Operation: delete_cspm_aws_account
DELETE: /cloud-connect-cspm-aws/entities/account/v1
Description: Deletes an existing AWS account or organization in our system.

Class: Falcon::CspmRegistrationApi

Operation: delete_cspm_azure_account
DELETE: /cloud-connect-cspm-azure/entities/account/v1
Description: Deletes an Azure subscription from the system.

Class: Falcon::CspmRegistrationApi

Operation: delete_cspmgcp_account
DELETE: /cloud-connect-cspm-gcp/entities/account/v1
Description: Deletes a GCP account from the system.

Class: Falcon::CspmRegistrationApi

Operation: get_behavior_detections
GET: /detects/entities/ioa/v1
Description: Get list of detected behaviors

Class: Falcon::CspmRegistrationApi

Operation: get_configuration_detection_entities
GET: /detects/entities/iom/v2
Description: Get misconfigurations based on the ID - including custom policy detections in addition to default policy detections.

Class: Falcon::CspmRegistrationApi

Operation: get_configuration_detection_ids_v2
GET: /detects/queries/iom/v2
Description: Get list of active misconfiguration ids - including custom policy detections in addition to default policy detections.

Class: Falcon::CspmRegistrationApi

Operation: get_configuration_detections
GET: /detects/entities/iom/v1
Description: Get list of active misconfigurations. This endpoint is deprecated, please use /queries/iom/v2 and /entities/iom/v2 instead

Class: Falcon::CspmRegistrationApi

Operation: get_cspm_aws_account
GET: /cloud-connect-cspm-aws/entities/account/v1
Description: Returns information about the current status of an AWS account.

Class: Falcon::CspmRegistrationApi

Operation: get_cspm_aws_account_scripts_attachment
GET: /cloud-connect-cspm-aws/entities/user-scripts-download/v1
Description: Return a script for customer to run in their cloud environment to grant us access to their AWS environment as a downloadable attachment.

Class: Falcon::CspmRegistrationApi

Operation: get_cspm_aws_console_setup_urls
GET: /cloud-connect-cspm-aws/entities/console-setup-urls/v1
Description: Return a URL for customer to visit in their cloud environment to grant us access to their AWS environment.

Class: Falcon::CspmRegistrationApi

Operation: get_cspm_azure_account
GET: /cloud-connect-cspm-azure/entities/account/v1
Description: Return information about Azure account registration

Class: Falcon::CspmRegistrationApi

Operation: get_cspm_azure_management_group
GET: /cloud-connect-cspm-azure/entities/management-group/v1
Description: Return information about Azure management group registration

Class: Falcon::CspmRegistrationApi

Operation: get_cspm_azure_user_scripts_attachment
GET: /cloud-connect-cspm-azure/entities/user-scripts-download/v1
Description: Return a script for customer to run in their cloud environment to grant us access to their Azure environment as a downloadable attachment

Class: Falcon::CspmRegistrationApi

Operation: get_cspm_policies_details
GET: /settings/entities/policy-details/v2
Description: Given an array of policy IDs, returns detailed policies information.

Class: Falcon::CspmRegistrationApi

Operation: get_cspm_policy
GET: /settings/entities/policy-details/v1
Description: Given a policy ID, returns detailed policy information.

Class: Falcon::CspmRegistrationApi

Operation: get_cspm_policy_settings
GET: /settings/entities/policy/v1
Description: Returns information about current policy settings.

Class: Falcon::CspmRegistrationApi

Operation: get_cspm_scan_schedule
GET: /settings/scan-schedule/v1
Description: Returns scan schedule configuration for one or more cloud platforms.

Class: Falcon::CspmRegistrationApi

Operation: get_cspmcgp_account
GET: /cloud-connect-cspm-gcp/entities/account/v1
Description: Returns information about the current status of an GCP account.

Class: Falcon::CspmRegistrationApi

Operation: get_cspmgcp_service_accounts_ext
GET: /cloud-connect-cspm-gcp/entities/service-accounts/v1
Description: Returns the service account id and client email for external clients.

Class: Falcon::CspmRegistrationApi

Operation: get_cspmgcp_user_scripts_attachment
GET: /cloud-connect-cspm-gcp/entities/user-scripts-download/v1
Description: Return a script for customer to run in their cloud environment to grant us access to their GCP environment as a downloadable attachment

Class: Falcon::CspmRegistrationApi

Operation: patch_cspm_aws_account
PATCH: /cloud-connect-cspm-aws/entities/account/v1
Description: Patches a existing account in our system for a customer.

Class: Falcon::CspmRegistrationApi

Operation: update_cspm_azure_account
PATCH: /cloud-connect-cspm-azure/entities/account/v1
Description: Patches a existing account in our system for a customer.

Class: Falcon::CspmRegistrationApi

Operation: update_cspm_azure_account_client_id
PATCH: /cloud-connect-cspm-azure/entities/client-id/v1
Description: Update an Azure service account in our system by with the user-created client_id created with the public key we've provided

Class: Falcon::CspmRegistrationApi

Operation: update_cspm_azure_tenant_default_subscription_id
PATCH: /cloud-connect-cspm-azure/entities/default-subscription-id/v1
Description: Update an Azure default subscription_id in our system for given tenant_id

Class: Falcon::CspmRegistrationApi

Operation: update_cspm_policy_settings
PATCH: /settings/entities/policy/v1
Description: Updates a policy setting - can be used to override policy severity or to disable a policy entirely.

Class: Falcon::CspmRegistrationApi

Operation: update_cspm_scan_schedule
POST: /settings/scan-schedule/v1
Description: Updates scan schedule configuration for one or more cloud platforms.

Class: Falcon::CspmRegistrationApi

Operation: update_cspmgcp_account
PATCH: /cloud-connect-cspm-gcp/entities/account/v1
Description: Patches a existing account in our system for a customer.

Class: Falcon::CustomIoaApi

Operation: create_rule
POST: /ioarules/entities/rules/v1
Description: Create a rule within a rule group. Returns the rule.

Class: Falcon::CustomIoaApi

Operation: create_rule_group_mixin0
POST: /ioarules/entities/rule-groups/v1
Description: Create a rule group for a platform with a name and an optional description. Returns the rule group.

Class: Falcon::CustomIoaApi

Operation: delete_rule_groups_mixin0
DELETE: /ioarules/entities/rule-groups/v1
Description: Delete rule groups by ID.

Class: Falcon::CustomIoaApi

Operation: delete_rules
DELETE: /ioarules/entities/rules/v1
Description: Delete rules from a rule group by ID.

Class: Falcon::CustomIoaApi

Operation: get_patterns
GET: /ioarules/entities/pattern-severities/v1
Description: Get pattern severities by ID.

Class: Falcon::CustomIoaApi

Operation: get_platforms_mixin0
GET: /ioarules/entities/platforms/v1
Description: Get platforms by ID.

Class: Falcon::CustomIoaApi

Operation: get_rule_groups_mixin0
GET: /ioarules/entities/rule-groups/v1
Description: Get rule groups by ID.

Class: Falcon::CustomIoaApi

Operation: get_rule_types
GET: /ioarules/entities/rule-types/v1
Description: Get rule types by ID.

Class: Falcon::CustomIoaApi

Operation: get_rules_get
POST: /ioarules/entities/rules/GET/v1
Description: Get rules by ID and optionally with cid and/or version in the following format: `[cid:]ID[:version]`.

Class: Falcon::CustomIoaApi

Operation: get_rules_mixin0
GET: /ioarules/entities/rules/v1
Description: Get rules by ID and optionally with cid and/or version in the following format: `[cid:]ID[:version]`. The max number of IDs is constrained by URL size.

Class: Falcon::CustomIoaApi

Operation: query_patterns
GET: /ioarules/queries/pattern-severities/v1
Description: Get all pattern severity IDs.

Class: Falcon::CustomIoaApi

Operation: query_platforms_mixin0
GET: /ioarules/queries/platforms/v1
Description: Get all platform IDs.

Class: Falcon::CustomIoaApi

Operation: query_rule_groups_full
GET: /ioarules/queries/rule-groups-full/v1
Description: Find all rule groups matching the query with optional filter.

Class: Falcon::CustomIoaApi

Operation: query_rule_groups_mixin0
GET: /ioarules/queries/rule-groups/v1
Description: Finds all rule group IDs matching the query with optional filter.

Class: Falcon::CustomIoaApi

Operation: query_rule_types
GET: /ioarules/queries/rule-types/v1
Description: Get all rule type IDs.

Class: Falcon::CustomIoaApi

Operation: query_rules_mixin0
GET: /ioarules/queries/rules/v1
Description: Finds all rule IDs matching the query with optional filter.

Class: Falcon::CustomIoaApi

Operation: update_rule_group_mixin0
PATCH: /ioarules/entities/rule-groups/v1
Description: Update a rule group. The following properties can be modified: name, description, enabled.

Class: Falcon::CustomIoaApi

Operation: update_rules
PATCH: /ioarules/entities/rules/v1
Description: Update rules within a rule group. Return the updated rules.

Class: Falcon::CustomIoaApi

Operation: validate
POST: /ioarules/entities/rules/validate/v1
Description: Validates field values and checks for matches if a test string is provided.

Class: Falcon::CustomStorageApi

Operation: delete_object
DELETE: /customobjects/v1/collections/{collection_name}/objects/{object_key}
Description: Delete the specified object

Class: Falcon::CustomStorageApi

Operation: get_object
GET: /customobjects/v1/collections/{collection_name}/objects/{object_key}
Description: Get the bytes for the specified object

Class: Falcon::CustomStorageApi

Operation: get_object_metadata
GET: /customobjects/v1/collections/{collection_name}/objects/{object_key}/metadata
Description: Get the metadata for the specified object

Class: Falcon::CustomStorageApi

Operation: list_objects
GET: /customobjects/v1/collections/{collection_name}/objects
Description: List the object keys in the specified collection in alphabetical order

Class: Falcon::CustomStorageApi

Operation: put_object
PUT: /customobjects/v1/collections/{collection_name}/objects/{object_key}
Description: Put the specified new object at the given key or overwrite an existing object at the given key

Class: Falcon::CustomStorageApi

Operation: search_objects
POST: /customobjects/v1/collections/{collection_name}/objects
Description: Search for objects that match the specified filter criteria (returns metadata, not actual objects)

Class: Falcon::D4cRegistrationApi

Operation: connect_d4_cgcp_account
POST: /cloud-connect-gcp/entities/account/v2
Description: Creates a new GCP account with newly-uploaded service account or connects with existing service account with only the following fields: parent_id, parent_type and service_account_id

Class: Falcon::D4cRegistrationApi

Operation: create_d4_c_aws_account
POST: /cloud-connect-aws/entities/account/v2
Description: Creates a new account in our system for a customer and generates a script for them to run in their AWS cloud environment to grant us access.

Class: Falcon::D4cRegistrationApi

Operation: create_d4_cgcp_account
POST: /cloud-connect-gcp/entities/account/v1
Description: Creates a new account in our system for a customer and generates a new service account for them to add access to in their GCP environment to grant us access.

Class: Falcon::D4cRegistrationApi

Operation: create_discover_cloud_azure_account
POST: /cloud-connect-azure/entities/account/v1
Description: Creates a new account in our system for a customer and generates a script for them to run in their cloud environment to grant us access.

Class: Falcon::D4cRegistrationApi

Operation: delete_d4_c_aws_account
DELETE: /cloud-connect-aws/entities/account/v2
Description: Deletes an existing AWS account or organization in our system.

Class: Falcon::D4cRegistrationApi

Operation: delete_d4_cgcp_account
DELETE: /cloud-connect-gcp/entities/account/v1
Description: Deletes a GCP account from the system.

Class: Falcon::D4cRegistrationApi

Operation: discover_cloud_azure_download_certificate
GET: /cloud-connect-azure/entities/download-certificate/v1
Description: Returns JSON object(s) that contain the base64 encoded certificate for a service principal.

Class: Falcon::D4cRegistrationApi

Operation: get_d4_c_aws_account
GET: /cloud-connect-aws/entities/account/v2
Description: Returns information about the current status of an AWS account.

Class: Falcon::D4cRegistrationApi

Operation: get_d4_c_aws_console_setup_urls
GET: /cloud-connect-aws/entities/console-setup-urls/v1
Description: Return a URL for customer to visit in their cloud environment to grant us access to their AWS environment.

Class: Falcon::D4cRegistrationApi

Operation: get_d4_caws_account_scripts_attachment
GET: /cloud-connect-aws/entities/user-scripts-download/v1
Description: Return a script for customer to run in their cloud environment to grant us access to their AWS environment as a downloadable attachment.

Class: Falcon::D4cRegistrationApi

Operation: get_d4_ccgp_account
GET: /cloud-connect-gcp/entities/account/v1
Description: Returns information about the current status of an GCP account.

Class: Falcon::D4cRegistrationApi

Operation: get_d4_cgcp_service_accounts_ext
GET: /cloud-connect-gcp/entities/service-accounts/v1
Description: Returns the service account id and client email for external clients.

Class: Falcon::D4cRegistrationApi

Operation: get_d4_cgcp_user_scripts
GET: /cloud-connect-gcp/entities/user-scripts/v1
Description: Return a script for customer to run in their cloud environment to grant us access to their GCP environment

Class: Falcon::D4cRegistrationApi

Operation: get_d4_cgcp_user_scripts_attachment
GET: /cloud-connect-gcp/entities/user-scripts-download/v1
Description: Return a script for customer to run in their cloud environment to grant us access to their GCP environment as a downloadable attachment

Class: Falcon::D4cRegistrationApi

Operation: get_discover_cloud_azure_account
GET: /cloud-connect-azure/entities/account/v1
Description: Return information about Azure account registration

Class: Falcon::D4cRegistrationApi

Operation: get_discover_cloud_azure_tenant_ids
GET: /cloud-connect-azure/entities/tenant-id/v1
Description: Return available tenant ids for discover for cloud

Class: Falcon::D4cRegistrationApi

Operation: get_discover_cloud_azure_user_scripts
GET: /cloud-connect-azure/entities/user-scripts/v1
Description: Return a script for customer to run in their cloud environment to grant us access to their Azure environment

Class: Falcon::D4cRegistrationApi

Operation: get_discover_cloud_azure_user_scripts_attachment
GET: /cloud-connect-azure/entities/user-scripts-download/v1
Description: Return a script for customer to run in their cloud environment to grant us access to their Azure environment as a downloadable attachment

Class: Falcon::D4cRegistrationApi

Operation: get_horizon_d4_c_scripts
GET: /settings-discover/entities/gen/scripts/v1
Description: Returns static install scripts for Horizon.

Class: Falcon::D4cRegistrationApi

Operation: update_discover_cloud_azure_account_client_id
PATCH: /cloud-connect-azure/entities/client-id/v1
Description: Update an Azure service account in our system by with the user-created client_id created with the public key we've provided

Class: Falcon::DetectsApi

Operation: get_aggregate_detects
POST: /detects/aggregates/detects/GET/v1
Description: Get detect aggregates as specified via json in request body.

Class: Falcon::DetectsApi

Operation: get_detect_summaries
POST: /detects/entities/summaries/GET/v1
Description: View information about detections

Class: Falcon::DetectsApi

Operation: query_detects
GET: /detects/queries/detects/v1
Description: Search for detection IDs that match a given query

Class: Falcon::DetectsApi

Operation: update_detects_by_ids_v2
PATCH: /detects/entities/detects/v2
Description: Modify the state, assignee, and visibility of detections

Class: Falcon::DeviceControlPoliciesApi

Operation: create_device_control_policies
POST: /policy/entities/device-control/v1
Description: Create Device Control Policies by specifying details about the policy to create

Class: Falcon::DeviceControlPoliciesApi

Operation: delete_device_control_policies
DELETE: /policy/entities/device-control/v1
Description: Delete a set of Device Control Policies by specifying their IDs

Class: Falcon::DeviceControlPoliciesApi

Operation: get_default_device_control_policies
GET: /policy/entities/default-device-control/v1
Description: Retrieve the configuration for a Default Device Control Policy

Class: Falcon::DeviceControlPoliciesApi

Operation: get_device_control_policies
GET: /policy/entities/device-control/v1
Description: Retrieve a set of Device Control Policies by specifying their IDs

Class: Falcon::DeviceControlPoliciesApi

Operation: perform_device_control_policies_action
POST: /policy/entities/device-control-actions/v1
Description: Perform the specified action on the Device Control Policies specified in the request

Class: Falcon::DeviceControlPoliciesApi

Operation: query_combined_device_control_policies
GET: /policy/combined/device-control/v1
Description: Search for Device Control Policies in your environment by providing an FQL filter and paging details. Returns a set of Device Control Policies which match the filter criteria

Class: Falcon::DeviceControlPoliciesApi

Operation: query_combined_device_control_policy_members
GET: /policy/combined/device-control-members/v1
Description: Search for members of a Device Control Policy in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria

Class: Falcon::DeviceControlPoliciesApi

Operation: query_device_control_policies
GET: /policy/queries/device-control/v1
Description: Search for Device Control Policies in your environment by providing an FQL filter and paging details. Returns a set of Device Control Policy IDs which match the filter criteria

Class: Falcon::DeviceControlPoliciesApi

Operation: query_device_control_policy_members
GET: /policy/queries/device-control-members/v1
Description: Search for members of a Device Control Policy in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria

Class: Falcon::DeviceControlPoliciesApi

Operation: set_device_control_policies_precedence
POST: /policy/entities/device-control-precedence/v1
Description: Sets the precedence of Device Control Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence

Class: Falcon::DeviceControlPoliciesApi

Operation: update_default_device_control_policies
PATCH: /policy/entities/default-device-control/v1
Description: Update the configuration for a Default Device Control Policy

Class: Falcon::DeviceControlPoliciesApi

Operation: update_device_control_policies
PATCH: /policy/entities/device-control/v1
Description: Update Device Control Policies by specifying the ID of the policy and details to update

Class: Falcon::DiscoverApi

Operation: get_accounts
GET: /discover/entities/accounts/v1
Description: Get details on accounts by providing one or more IDs.

Class: Falcon::DiscoverApi

Operation: get_applications
GET: /discover/entities/applications/v1
Description: Get details on applications by providing one or more IDs.

Class: Falcon::DiscoverApi

Operation: get_hosts
GET: /discover/entities/hosts/v1
Description: Get details on assets by providing one or more IDs.

Class: Falcon::DiscoverApi

Operation: get_logins
GET: /discover/entities/logins/v1
Description: Get details on logins by providing one or more IDs.

Class: Falcon::DiscoverApi

Operation: query_accounts
GET: /discover/queries/accounts/v1
Description: Search for accounts in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of account IDs which match the filter criteria.

Class: Falcon::DiscoverApi

Operation: query_applications
GET: /discover/queries/applications/v1
Description: Search for applications in your environment by providing an FQL filter and paging details. returns a set of application IDs which match the filter criteria.

Class: Falcon::DiscoverApi

Operation: query_hosts
GET: /discover/queries/hosts/v1
Description: Search for assets in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.

Class: Falcon::DiscoverApi

Operation: query_logins
GET: /discover/queries/logins/v1
Description: Search for logins in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of login IDs which match the filter criteria.

Class: Falcon::DiscoverIotApi

Operation: get_iot_hosts
GET: /discover/entities/iot-hosts/v1
Description: Get details on IoT assets by providing one or more IDs.

Class: Falcon::DiscoverIotApi

Operation: query_iot_hosts
GET: /discover/queries/iot-hosts/v1
Description: Search for IoT assets in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.

Class: Falcon::DriftIndicatorsApi

Operation: get_drift_indicators_values_by_date
GET: /container-security/aggregates/drift-indicators/count-by-date/v1
Description: Returns the count of Drift Indicators by the date. by default it's for 7 days.

Class: Falcon::DriftIndicatorsApi

Operation: read_drift_indicator_entities
GET: /container-security/entities/drift-indicators/v1
Description: Retrieve Drift Indicator entities identified by the provided IDs

Class: Falcon::DriftIndicatorsApi

Operation: read_drift_indicators_count
GET: /container-security/aggregates/drift-indicators/count/v1
Description: Returns the total count of Drift indicators over a time period

Class: Falcon::DriftIndicatorsApi

Operation: search_and_read_drift_indicator_entities
GET: /container-security/combined/drift-indicators/v1
Description: Retrieve Drift Indicators by the provided search criteria

Class: Falcon::DriftIndicatorsApi

Operation: search_drift_indicators
GET: /container-security/queries/drift-indicators/v1
Description: Retrieve all drift indicators that match the given query

Class: Falcon::EventSchemaApi

Operation: fdrschema_combined_event_get
GET: /fdr/combined/schema-members/v1
Description: Fetch combined schema

Class: Falcon::EventSchemaApi

Operation: fdrschema_entities_event_get
GET: /fdr/entities/schema-events/v1
Description: Fetch event schema by ID

Class: Falcon::EventSchemaApi

Operation: fdrschema_queries_event_get
GET: /fdr/queries/schema-events/v1
Description: Get list of event IDs given a particular query.

Class: Falcon::EventStreamsApi

Operation: list_available_streams_o_auth2
GET: /sensors/entities/datafeed/v2
Description: Discover all event streams in your environment

Class: Falcon::EventStreamsApi

Operation: refresh_active_stream_session
POST: /sensors/entities/datafeed-actions/v1/{partition}
Description: Refresh an active event stream. Use the URL shown in a GET /sensors/entities/datafeed/v2 response.

Class: Falcon::FalconCompleteDashboardApi

Operation: aggregate_alerts
POST: /falcon-complete-dashboards/aggregates/alerts/GET/v1
Description: Retrieve aggregate alerts values based on the matched filter

Class: Falcon::FalconCompleteDashboardApi

Operation: aggregate_allow_list
POST: /falcon-complete-dashboards/aggregates/allowlist/GET/v1
Description: Retrieve aggregate allowlist ticket values based on the matched filter

Class: Falcon::FalconCompleteDashboardApi

Operation: aggregate_block_list
POST: /falcon-complete-dashboards/aggregates/blocklist/GET/v1
Description: Retrieve aggregate blocklist ticket values based on the matched filter

Class: Falcon::FalconCompleteDashboardApi

Operation: aggregate_detections
POST: /falcon-complete-dashboards/aggregates/detects/GET/v1
Description: Retrieve aggregate detection values based on the matched filter

Class: Falcon::FalconCompleteDashboardApi

Operation: aggregate_device_count_collection
POST: /falcon-complete-dashboards/aggregates/devicecount-collections/GET/v1
Description: Retrieve aggregate host/devices count based on the matched filter

Class: Falcon::FalconCompleteDashboardApi

Operation: aggregate_escalations
POST: /falcon-complete-dashboards/aggregates/escalations/GET/v1
Description: Retrieve aggregate escalation ticket values based on the matched filter

Class: Falcon::FalconCompleteDashboardApi

Operation: aggregate_fc_incidents
POST: /falcon-complete-dashboards/aggregates/incidents/GET/v1
Description: Retrieve aggregate incident values based on the matched filter

Class: Falcon::FalconCompleteDashboardApi

Operation: aggregate_prevention_policy
POST: /falcon-complete-dashboards/aggregates/prevention-policies/v1
Description: Retrieve prevention policies aggregate values based on the matched filter

Class: Falcon::FalconCompleteDashboardApi

Operation: aggregate_remediations
POST: /falcon-complete-dashboards/aggregates/remediations/GET/v1
Description: Retrieve aggregate remediation ticket values based on the matched filter

Class: Falcon::FalconCompleteDashboardApi

Operation: aggregate_sensor_update_policy
POST: /falcon-complete-dashboards/aggregates/sensor-update-policies/v1
Description: Retrieve sensor update policies aggregate values

Class: Falcon::FalconCompleteDashboardApi

Operation: aggregate_total_device_counts
POST: /falcon-complete-dashboards/aggregates/total-device-counts/v1
Description: Retrieve aggregate total host/devices based on the matched filter

Class: Falcon::FalconCompleteDashboardApi

Operation: get_device_count_collection_queries_by_filter
GET: /falcon-complete-dashboards/queries/devicecount-collections/v1
Description: Retrieve device count collection Ids that match the provided FQL filter, criteria with scrolling enabled

Class: Falcon::FalconCompleteDashboardApi

Operation: query_alert_ids_by_filter
GET: /falcon-complete-dashboards/queries/alerts/v1
Description: Retrieve Alerts Ids that match the provided FQL filter criteria with scrolling enabled

Class: Falcon::FalconCompleteDashboardApi

Operation: query_allow_list_filter
GET: /falcon-complete-dashboards/queries/allowlist/v1
Description: Retrieve allowlist tickets that match the provided filter criteria with scrolling enabled

Class: Falcon::FalconCompleteDashboardApi

Operation: query_block_list_filter
GET: /falcon-complete-dashboards/queries/blocklist/v1
Description: Retrieve block listtickets that match the provided filter criteria with scrolling enabled

Class: Falcon::FalconCompleteDashboardApi

Operation: query_detection_ids_by_filter
GET: /falcon-complete-dashboards/queries/detects/v1
Description: Retrieve DetectionsIds that match the provided FQL filter, criteria with scrolling enabled

Class: Falcon::FalconCompleteDashboardApi

Operation: query_escalations_filter
GET: /falcon-complete-dashboards/queries/escalations/v1
Description: Retrieve escalation tickets that match the provided filter criteria with scrolling enabled

Class: Falcon::FalconCompleteDashboardApi

Operation: query_incident_ids_by_filter
GET: /falcon-complete-dashboards/queries/incidents/v1
Description: Retrieve incidents that match the provided filter criteria with scrolling enabled

Class: Falcon::FalconCompleteDashboardApi

Operation: query_remediations_filter
GET: /falcon-complete-dashboards/queries/remediations/v1
Description: Retrieve remediation tickets that match the provided filter criteria with scrolling enabled

Class: Falcon::FalconContainerApi

Operation: get_credentials
GET: /container-security/entities/image-registry-credentials/v1
Description: Gets the registry credentials

Class: Falcon::FalconContainerCliApi

Operation: read_image_vulnerabilities
POST: /image-assessment/combined/vulnerability-lookups/v1
Description: Retrieve known vulnerabilities for the provided image

Class: Falcon::FalconContainerImageApi

Operation: create_registry_entities
POST: /container-security/entities/registries/v1
Description: Create a registry entity using the provided details

Class: Falcon::FalconContainerImageApi

Operation: delete_registry_entities
DELETE: /container-security/entities/registries/v1
Description: Delete the registry entity identified by the entity UUID

Class: Falcon::FalconContainerImageApi

Operation: read_registry_entities
GET: /container-security/queries/registries/v1
Description: Retrieve registry entities identified by the customer id

Class: Falcon::FalconContainerImageApi

Operation: read_registry_entities_by_uuid
GET: /container-security/entities/registries/v1
Description: Retrieve the registry entity identified by the entity UUID

Class: Falcon::FalconContainerImageApi

Operation: update_registry_entities
PATCH: /container-security/entities/registries/v1
Description: Update the registry entity, as identified by the entity UUID, using the provided details

Class: Falcon::FalconxSandboxApi

Operation: delete_report
DELETE: /falconx/entities/reports/v1
Description: Delete report based on the report ID. Operation can be checked for success by polling for the report ID on the report-summaries endpoint.

Class: Falcon::FalconxSandboxApi

Operation: delete_sample_v2
DELETE: /samples/entities/samples/v2
Description: Removes a sample, including file, meta and submissions from the collection

Class: Falcon::FalconxSandboxApi

Operation: get_artifacts
GET: /falconx/entities/artifacts/v1
Description: Download IOC packs, PCAP files, memory dumps, and other analysis artifacts.

Class: Falcon::FalconxSandboxApi

Operation: get_memory_dump
GET: /falconx/entities/memory-dump/v1
Description: Get memory dump content, as binary

Class: Falcon::FalconxSandboxApi

Operation: get_memory_dump_extracted_strings
GET: /falconx/entities/memory-dump/extracted-strings/v1
Description: Get extracted strings from a memory dump

Class: Falcon::FalconxSandboxApi

Operation: get_memory_dump_hex_dump
GET: /falconx/entities/memory-dump/hex-dump/v1
Description: Get hex view of a memory dump

Class: Falcon::FalconxSandboxApi

Operation: get_reports
GET: /falconx/entities/reports/v1
Description: Get a full sandbox report.

Class: Falcon::FalconxSandboxApi

Operation: get_sample_v2
GET: /samples/entities/samples/v2
Description: Retrieves the file associated with the given ID (SHA256)

Class: Falcon::FalconxSandboxApi

Operation: get_submissions
GET: /falconx/entities/submissions/v1
Description: Check the status of a sandbox analysis. Time required for analysis varies but is usually less than 15 minutes.

Class: Falcon::FalconxSandboxApi

Operation: get_summary_reports
GET: /falconx/entities/report-summaries/v1
Description: Get a short summary version of a sandbox report.

Class: Falcon::FalconxSandboxApi

Operation: query_reports
GET: /falconx/queries/reports/v1
Description: Find sandbox reports by providing an FQL filter and paging details. Returns a set of report IDs that match your criteria.

Class: Falcon::FalconxSandboxApi

Operation: query_sample_v1
POST: /samples/queries/samples/GET/v1
Description: Retrieves a list with sha256 of samples that exist and customer has rights to access them, maximum number of accepted items is 200

Class: Falcon::FalconxSandboxApi

Operation: query_submissions
GET: /falconx/queries/submissions/v1
Description: Find submission IDs for uploaded files by providing an FQL filter and paging details. Returns a set of submission IDs that match your criteria.

Class: Falcon::FalconxSandboxApi

Operation: submit
POST: /falconx/entities/submissions/v1
Description: Submit an uploaded file or a URL for sandbox analysis. Time required for analysis varies but is usually less than 15 minutes.

Class: Falcon::FalconxSandboxApi

Operation: upload_sample_v2
POST: /samples/entities/samples/v2
Description: Upload a file for sandbox analysis. After uploading, use `/falconx/entities/submissions/v1` to start analyzing the file.

Class: Falcon::FieldSchemaApi

Operation: fdrschema_entities_field_get
GET: /fdr/entities/schema-fields/v1
Description: Fetch field schema by ID

Class: Falcon::FieldSchemaApi

Operation: fdrschema_queries_field_get
GET: /fdr/queries/schema-fields/v1
Description: Get list of field IDs given a particular query.

Class: Falcon::FilevantageApi

Operation: create_policies
POST: /filevantage/entities/policies/v1
Description: Creates a new policy of the specified type. New policies are always added at the end of the precedence list for the provided policy type.

Class: Falcon::FilevantageApi

Operation: create_rule_groups
POST: /filevantage/entities/rule-groups/v1
Description: Creates a new rule group of the specified type.

Class: Falcon::FilevantageApi

Operation: create_rules
POST: /filevantage/entities/rule-groups-rules/v1
Description: Creates a new rule configuration within the specified rule group.

Class: Falcon::FilevantageApi

Operation: create_scheduled_exclusions
POST: /filevantage/entities/policy-scheduled-exclusions/v1
Description: Creates a new scheduled exclusion configuration for the provided policy id.

Class: Falcon::FilevantageApi

Operation: delete_policies
DELETE: /filevantage/entities/policies/v1
Description: Deletes 1 or more policies.

Class: Falcon::FilevantageApi

Operation: delete_rule_groups
DELETE: /filevantage/entities/rule-groups/v1
Description: Deletes 1 or more rule groups

Class: Falcon::FilevantageApi

Operation: delete_rules
DELETE: /filevantage/entities/rule-groups-rules/v1
Description: Deletes 1 or more rules from the specified rule group.

Class: Falcon::FilevantageApi

Operation: delete_scheduled_exclusions
DELETE: /filevantage/entities/policy-scheduled-exclusions/v1
Description: Deletes 1 or more scheduled exclusions from the provided policy id.

Class: Falcon::FilevantageApi

Operation: get_changes
GET: /filevantage/entities/changes/v2
Description: Retrieve information on changes

Class: Falcon::FilevantageApi

Operation: get_policies
GET: /filevantage/entities/policies/v1
Description: Retrieves the configuration for 1 or more policies.

Class: Falcon::FilevantageApi

Operation: get_rule_groups
GET: /filevantage/entities/rule-groups/v1
Description: Retrieves the rule group details for 1 or more rule groups.

Class: Falcon::FilevantageApi

Operation: get_rules
GET: /filevantage/entities/rule-groups-rules/v1
Description: Retrieves the configuration for 1 or more rules.

Class: Falcon::FilevantageApi

Operation: get_scheduled_exclusions
GET: /filevantage/entities/policy-scheduled-exclusions/v1
Description: Retrieves the configuration of 1 or more scheduled exclusions from the provided policy id.

Class: Falcon::FilevantageApi

Operation: high_volume_query_changes
GET: /filevantage/queries/changes/v3
Description: Returns 1 or more change ids

Class: Falcon::FilevantageApi

Operation: query_changes
GET: /filevantage/queries/changes/v2
Description: Returns 1 or more change ids

Class: Falcon::FilevantageApi

Operation: query_policies
GET: /filevantage/queries/policies/v1
Description: Retrieve the ids of all policies that are assigned the provided policy type.

Class: Falcon::FilevantageApi

Operation: query_rule_groups
GET: /filevantage/queries/rule-groups/v1
Description: Retrieve the ids of all rule groups that are of the provided rule group type.

Class: Falcon::FilevantageApi

Operation: query_scheduled_exclusions
GET: /filevantage/queries/policy-scheduled-exclusions/v1
Description: Retrieve the ids of all scheduled exclusions contained within the provided policy id.

Class: Falcon::FilevantageApi

Operation: update_policies
PATCH: /filevantage/entities/policies/v1
Description: Updates the general information of the provided policy.

Class: Falcon::FilevantageApi

Operation: update_policy_host_groups
PATCH: /filevantage/entities/policies-host-groups/v1
Description: Manage host groups assigned to a policy.

Class: Falcon::FilevantageApi

Operation: update_policy_precedence
PATCH: /filevantage/entities/policies-precedence/v1
Description: Updates the policy precedence for all policies of a specific type.

Class: Falcon::FilevantageApi

Operation: update_policy_rule_groups
PATCH: /filevantage/entities/policies-rule-groups/v1
Description: Manage the rule groups assigned to the policy or set the rule group precedence for all rule groups within the policy.

Class: Falcon::FilevantageApi

Operation: update_rule_group_precedence
PATCH: /filevantage/entities/rule-groups-rule-precedence/v1
Description: Updates the rule precedence for all rules in the identified rule group.

Class: Falcon::FilevantageApi

Operation: update_rule_groups
PATCH: /filevantage/entities/rule-groups/v1
Description: Updates the provided rule group.

Class: Falcon::FilevantageApi

Operation: update_rules
PATCH: /filevantage/entities/rule-groups-rules/v1
Description: Updates the provided rule configuration within the specified rule group.

Class: Falcon::FilevantageApi

Operation: update_scheduled_exclusions
PATCH: /filevantage/entities/policy-scheduled-exclusions/v1
Description: Updates the provided scheduled exclusion configuration within the provided policy.

Class: Falcon::FirewallManagementApi

Operation: aggregate_events
POST: /fwmgr/aggregates/events/GET/v1
Description: Aggregate events for customer

Class: Falcon::FirewallManagementApi

Operation: aggregate_policy_rules
POST: /fwmgr/aggregates/policy-rules/GET/v1
Description: Aggregate rules within a policy for customer

Class: Falcon::FirewallManagementApi

Operation: aggregate_rule_groups
POST: /fwmgr/aggregates/rule-groups/GET/v1
Description: Aggregate rule groups for customer

Class: Falcon::FirewallManagementApi

Operation: aggregate_rules
POST: /fwmgr/aggregates/rules/GET/v1
Description: Aggregate rules for customer

Class: Falcon::FirewallManagementApi

Operation: create_network_locations
POST: /fwmgr/entities/network-locations/v1
Description: Create new network locations provided, and return the ID.

Class: Falcon::FirewallManagementApi

Operation: create_rule_group
POST: /fwmgr/entities/rule-groups/v1
Description: Create new rule group on a platform for a customer with a name and description, and return the ID

Class: Falcon::FirewallManagementApi

Operation: create_rule_group_validation
POST: /fwmgr/entities/rule-groups/validation/v1
Description: Validates the request of creating a new rule group on a platform for a customer with a name and description

Class: Falcon::FirewallManagementApi

Operation: delete_network_locations
DELETE: /fwmgr/entities/network-locations/v1
Description: Delete network location entities by ID.

Class: Falcon::FirewallManagementApi

Operation: delete_rule_groups
DELETE: /fwmgr/entities/rule-groups/v1
Description: Delete rule group entities by ID

Class: Falcon::FirewallManagementApi

Operation: get_events
GET: /fwmgr/entities/events/v1
Description: Get events entities by ID and optionally version

Class: Falcon::FirewallManagementApi

Operation: get_firewall_fields
GET: /fwmgr/entities/firewall-fields/v1
Description: Get the firewall field specifications by ID

Class: Falcon::FirewallManagementApi

Operation: get_network_locations
GET: /fwmgr/entities/network-locations/v1
Description: Get a summary of network locations entities by ID

Class: Falcon::FirewallManagementApi

Operation: get_network_locations_details
GET: /fwmgr/entities/network-locations-details/v1
Description: Get network locations entities by ID

Class: Falcon::FirewallManagementApi

Operation: get_platforms
GET: /fwmgr/entities/platforms/v1
Description: Get platforms by ID, e.g., windows or mac or droid

Class: Falcon::FirewallManagementApi

Operation: get_policy_containers
GET: /fwmgr/entities/policies/v1
Description: Get policy container entities by policy ID

Class: Falcon::FirewallManagementApi

Operation: get_rule_groups
GET: /fwmgr/entities/rule-groups/v1
Description: Get rule group entities by ID. These groups do not contain their rule entites, just the rule IDs in precedence order.

Class: Falcon::FirewallManagementApi

Operation: get_rules
GET: /fwmgr/entities/rules/v1
Description: Get rule entities by ID (64-bit unsigned int as decimal string) or Family ID (32-character hexadecimal string)

Class: Falcon::FirewallManagementApi

Operation: query_events
GET: /fwmgr/queries/events/v1
Description: Find all event IDs matching the query with filter

Class: Falcon::FirewallManagementApi

Operation: query_firewall_fields
GET: /fwmgr/queries/firewall-fields/v1
Description: Get the firewall field specification IDs for the provided platform

Class: Falcon::FirewallManagementApi

Operation: query_network_locations
GET: /fwmgr/queries/network-locations/v1
Description: Get a list of network location IDs

Class: Falcon::FirewallManagementApi

Operation: query_platforms
GET: /fwmgr/queries/platforms/v1
Description: Get the list of platform names

Class: Falcon::FirewallManagementApi

Operation: query_policy_rules
GET: /fwmgr/queries/policy-rules/v1
Description: Find all firewall rule IDs matching the query with filter, and return them in precedence order

Class: Falcon::FirewallManagementApi

Operation: query_rule_groups
GET: /fwmgr/queries/rule-groups/v1
Description: Find all rule group IDs matching the query with filter

Class: Falcon::FirewallManagementApi

Operation: query_rules
GET: /fwmgr/queries/rules/v1
Description: Find all rule IDs matching the query with filter

Class: Falcon::FirewallManagementApi

Operation: update_network_locations
PATCH: /fwmgr/entities/network-locations/v1
Description: Updates the network locations provided, and return the ID.

Class: Falcon::FirewallManagementApi

Operation: update_network_locations_metadata
POST: /fwmgr/entities/network-locations-metadata/v1
Description: Updates the network locations metadata such as polling_intervals for the cid

Class: Falcon::FirewallManagementApi

Operation: update_network_locations_precedence
POST: /fwmgr/entities/network-locations-precedence/v1
Description: Updates the network locations precedence according to the list of ids provided.

Class: Falcon::FirewallManagementApi

Operation: update_policy_container
PUT: /fwmgr/entities/policies/v2
Description: Update an identified policy container, including local logging functionality.

Class: Falcon::FirewallManagementApi

Operation: update_policy_container_v1
PUT: /fwmgr/entities/policies/v1
Description: Update an identified policy container. WARNING: This endpoint is deprecated in favor of v2, using this endpoint could disable your local logging setting.

Class: Falcon::FirewallManagementApi

Operation: update_rule_group
PATCH: /fwmgr/entities/rule-groups/v1
Description: Update name, description, or enabled status of a rule group, or create, edit, delete, or reorder rules

Class: Falcon::FirewallManagementApi

Operation: update_rule_group_validation
PATCH: /fwmgr/entities/rule-groups/validation/v1
Description: Validates the request of updating name, description, or enabled status of a rule group, or create, edit, delete, or reorder rules

Class: Falcon::FirewallManagementApi

Operation: upsert_network_locations
PUT: /fwmgr/entities/network-locations/v1
Description: Updates the network locations provided, and return the ID.

Class: Falcon::FirewallManagementApi

Operation: validate_filepath_pattern
POST: /fwmgr/entities/rules/validate-filepath/v1
Description: Validates that the test pattern matches the executable filepath glob pattern.

Class: Falcon::FirewallPoliciesApi

Operation: create_firewall_policies
POST: /policy/entities/firewall/v1
Description: Create Firewall Policies by specifying details about the policy to create

Class: Falcon::FirewallPoliciesApi

Operation: delete_firewall_policies
DELETE: /policy/entities/firewall/v1
Description: Delete a set of Firewall Policies by specifying their IDs

Class: Falcon::FirewallPoliciesApi

Operation: get_firewall_policies
GET: /policy/entities/firewall/v1
Description: Retrieve a set of Firewall Policies by specifying their IDs

Class: Falcon::FirewallPoliciesApi

Operation: perform_firewall_policies_action
POST: /policy/entities/firewall-actions/v1
Description: Perform the specified action on the Firewall Policies specified in the request

Class: Falcon::FirewallPoliciesApi

Operation: query_combined_firewall_policies
GET: /policy/combined/firewall/v1
Description: Search for Firewall Policies in your environment by providing an FQL filter and paging details. Returns a set of Firewall Policies which match the filter criteria

Class: Falcon::FirewallPoliciesApi

Operation: query_combined_firewall_policy_members
GET: /policy/combined/firewall-members/v1
Description: Search for members of a Firewall Policy in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria

Class: Falcon::FirewallPoliciesApi

Operation: query_firewall_policies
GET: /policy/queries/firewall/v1
Description: Search for Firewall Policies in your environment by providing an FQL filter and paging details. Returns a set of Firewall Policy IDs which match the filter criteria

Class: Falcon::FirewallPoliciesApi

Operation: query_firewall_policy_members
GET: /policy/queries/firewall-members/v1
Description: Search for members of a Firewall Policy in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria

Class: Falcon::FirewallPoliciesApi

Operation: set_firewall_policies_precedence
POST: /policy/entities/firewall-precedence/v1
Description: Sets the precedence of Firewall Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence

Class: Falcon::FirewallPoliciesApi

Operation: update_firewall_policies
PATCH: /policy/entities/firewall/v1
Description: Update Firewall Policies by specifying the ID of the policy and details to update

Class: Falcon::FoundryLogscaleApi

Operation: create_saved_searches_dynamic_execute_alt_v1
POST: /loggingapi/entities/saved-searches-dynamic-execute/v1
Description: Execute a dynamic saved search

Class: Falcon::FoundryLogscaleApi

Operation: create_saved_searches_dynamic_execute_v1
POST: /loggingapi/entities/saved-searches/execute-dynamic/v1
Description: Execute a dynamic saved search

Class: Falcon::FoundryLogscaleApi

Operation: create_saved_searches_execute_alt_v1
POST: /loggingapi/entities/saved-searches-execute/v1
Description: Execute a saved search

Class: Falcon::FoundryLogscaleApi

Operation: create_saved_searches_execute_v1
POST: /loggingapi/entities/saved-searches/execute/v1
Description: Execute a saved search

Class: Falcon::FoundryLogscaleApi

Operation: create_saved_searches_ingest_alt_v1
POST: /loggingapi/entities/saved-searches-ingest/v1
Description: Populate a saved search

Class: Falcon::FoundryLogscaleApi

Operation: create_saved_searches_ingest_v1
POST: /loggingapi/entities/saved-searches/ingest/v1
Description: Populate a saved search

Class: Falcon::FoundryLogscaleApi

Operation: get_saved_searches_execute_alt_v1
GET: /loggingapi/entities/saved-searches-execute/v1
Description: Get the results of a saved search

Class: Falcon::FoundryLogscaleApi

Operation: get_saved_searches_execute_v1
GET: /loggingapi/entities/saved-searches/execute/v1
Description: Get the results of a saved search

Class: Falcon::FoundryLogscaleApi

Operation: get_saved_searches_job_results_download_alt_v1
GET: /loggingapi/entities/saved-searches-job-results-download/v1
Description: Get the results of a saved search as a file

Class: Falcon::FoundryLogscaleApi

Operation: get_saved_searches_job_results_download_v1
GET: /loggingapi/entities/saved-searches/job-results-download/v1
Description: Get the results of a saved search as a file

Class: Falcon::FoundryLogscaleApi

Operation: ingest_data_v1
POST: /loggingapi/entities/data-ingestion/ingest/v1
Description: Ingest data into the application repository

Class: Falcon::FoundryLogscaleApi

Operation: list_repos_v1
GET: /loggingapi/combined/repos/v1
Description: Lists available repositories and views

Class: Falcon::FoundryLogscaleApi

Operation: list_view_v1
GET: /loggingapi/entities/views/v1
Description: List views

Class: Falcon::HostGroupApi

Operation: create_host_groups
POST: /devices/entities/host-groups/v1
Description: Create Host Groups by specifying details about the group to create

Class: Falcon::HostGroupApi

Operation: delete_host_groups
DELETE: /devices/entities/host-groups/v1
Description: Delete a set of Host Groups by specifying their IDs

Class: Falcon::HostGroupApi

Operation: get_host_groups
GET: /devices/entities/host-groups/v1
Description: Retrieve a set of Host Groups by specifying their IDs

Class: Falcon::HostGroupApi

Operation: perform_group_action
POST: /devices/entities/host-group-actions/v1
Description: Perform the specified action on the Host Groups specified in the request

Class: Falcon::HostGroupApi

Operation: query_combined_group_members
GET: /devices/combined/host-group-members/v1
Description: Search for members of a Host Group in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria

Class: Falcon::HostGroupApi

Operation: query_combined_host_groups
GET: /devices/combined/host-groups/v1
Description: Search for Host Groups in your environment by providing an FQL filter and paging details. Returns a set of Host Groups which match the filter criteria

Class: Falcon::HostGroupApi

Operation: query_group_members
GET: /devices/queries/host-group-members/v1
Description: Search for members of a Host Group in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria

Class: Falcon::HostGroupApi

Operation: query_host_groups
GET: /devices/queries/host-groups/v1
Description: Search for Host Groups in your environment by providing an FQL filter and paging details. Returns a set of Host Group IDs which match the filter criteria

Class: Falcon::HostGroupApi

Operation: update_host_groups
PATCH: /devices/entities/host-groups/v1
Description: Update Host Groups by specifying the ID of the group and details to update

Class: Falcon::HostsApi

Operation: entities_perform_action
POST: /devices/entities/group-actions/v1
Description: Performs the specified action on the provided group IDs.

Class: Falcon::HostsApi

Operation: get_device_details_v2
GET: /devices/entities/devices/v2
Description: Get details on one or more hosts by providing host IDs as a query parameter. Supports up to a maximum 100 IDs.

Class: Falcon::HostsApi

Operation: get_online_state_v1
GET: /devices/entities/online-state/v1
Description: Get the online status for one or more hosts by specifying each host’s unique ID. Successful requests return an HTTP 200 response and the status for each host identified by a `state` of `online`, `offline`, or `unknown` for each host, identified by host `id`. Make a `GET` request to `/devices/queries/devices/v1` to get a list of host IDs.

Class: Falcon::HostsApi

Operation: perform_action_v2
POST: /devices/entities/devices-actions/v2
Description: Take various actions on the hosts in your environment. Contain or lift containment on a host. Delete or restore a host.

Class: Falcon::HostsApi

Operation: post_device_details_v2
POST: /devices/entities/devices/v2
Description: Get details on one or more hosts by providing host IDs in a POST body. Supports up to a maximum 5000 IDs.

Class: Falcon::HostsApi

Operation: query_device_login_history
POST: /devices/combined/devices/login-history/v1
Description: Retrieve details about recent login sessions for a set of devices.

Class: Falcon::HostsApi

Operation: query_device_login_history_v2
POST: /devices/combined/devices/login-history/v2
Description: Retrieve details about recent interactive login sessions for a set of devices powered by the Host Timeline. A max of 10 device ids can be specified

Class: Falcon::HostsApi

Operation: query_devices_by_filter
GET: /devices/queries/devices/v1
Description: Search for hosts in your environment by platform, hostname, IP, and other criteria.

Class: Falcon::HostsApi

Operation: query_devices_by_filter_scroll
GET: /devices/queries/devices-scroll/v1
Description: Search for hosts in your environment by platform, hostname, IP, and other criteria with continuous pagination capability (based on offset pointer which expires after 2 minutes with no maximum limit)

Class: Falcon::HostsApi

Operation: query_get_network_address_history_v1
POST: /devices/combined/devices/network-address-history/v1
Description: Retrieve history of IP and MAC addresses of devices.

Class: Falcon::HostsApi

Operation: query_hidden_devices
GET: /devices/queries/devices-hidden/v1
Description: Retrieve hidden hosts that match the provided filter criteria.

Class: Falcon::HostsApi

Operation: update_device_tags
PATCH: /devices/entities/devices/tags/v1
Description: Append or remove one or more Falcon Grouping Tags on one or more hosts. Tags must be of the form FalconGroupingTags/

Class: Falcon::IdentityEntitiesApi

Operation: get_sensor_aggregates
POST: /identity-protection/aggregates/devices/GET/v1
Description: Get sensor aggregates as specified via json in request body.

Class: Falcon::IdentityEntitiesApi

Operation: get_sensor_details
POST: /identity-protection/entities/devices/GET/v1
Description: Get details on one or more sensors by providing device IDs in a POST body. Supports up to a maximum of 5000 IDs.

Class: Falcon::IdentityEntitiesApi

Operation: query_sensors_by_filter
GET: /identity-protection/queries/devices/v1
Description: Search for sensors in your environment by hostname, IP, and other criteria.

Class: Falcon::IdentityProtectionApi

Operation: api_preempt_proxy_post_graphql
POST: /identity-protection/combined/graphql/v1
Description: Identity Protection GraphQL API. Allows to retrieve entities, timeline activities, identity-based incidents and security assessment. Allows to perform actions on entities and identity-based incidents.

Class: Falcon::ImageAssessmentPoliciesApi

Operation: create_policies
POST: /container-security/entities/image-assessment-policies/v1
Description: Create Image Assessment policies

Class: Falcon::ImageAssessmentPoliciesApi

Operation: create_policy_groups
POST: /container-security/entities/image-assessment-policy-groups/v1
Description: Create Image Assessment Policy Group entities

Class: Falcon::ImageAssessmentPoliciesApi

Operation: delete_policy
DELETE: /container-security/entities/image-assessment-policies/v1
Description: Delete Image Assessment Policy by policy UUID

Class: Falcon::ImageAssessmentPoliciesApi

Operation: delete_policy_group
DELETE: /container-security/entities/image-assessment-policy-groups/v1
Description: Delete Image Assessment Policy Group entities

Class: Falcon::ImageAssessmentPoliciesApi

Operation: read_policies
GET: /container-security/entities/image-assessment-policies/v1
Description: Get all Image Assessment policies

Class: Falcon::ImageAssessmentPoliciesApi

Operation: read_policy_exclusions
GET: /container-security/entities/image-assessment-policy-exclusions/v1
Description: Retrieve Image Assessment Policy Exclusion entities

Class: Falcon::ImageAssessmentPoliciesApi

Operation: read_policy_groups
GET: /container-security/entities/image-assessment-policy-groups/v1
Description: Retrieve Image Assessment Policy Group entities

Class: Falcon::ImageAssessmentPoliciesApi

Operation: update_policies
PATCH: /container-security/entities/image-assessment-policies/v1
Description: Update Image Assessment Policy entities

Class: Falcon::ImageAssessmentPoliciesApi

Operation: update_policy_exclusions
POST: /container-security/entities/image-assessment-policy-exclusions/v1
Description: Update Image Assessment Policy Exclusion entities

Class: Falcon::ImageAssessmentPoliciesApi

Operation: update_policy_groups
PATCH: /container-security/entities/image-assessment-policy-groups/v1
Description: Update Image Assessment Policy Group entities

Class: Falcon::ImageAssessmentPoliciesApi

Operation: update_policy_precedence
POST: /container-security/entities/image-assessment-policy-precedence/v1
Description: Update Image Assessment Policy precedence

Class: Falcon::IncidentsApi

Operation: crowd_score
GET: /incidents/combined/crowdscores/v1
Description: Query environment wide CrowdScore and return the entity data

Class: Falcon::IncidentsApi

Operation: get_behaviors
POST: /incidents/entities/behaviors/GET/v1
Description: Get details on behaviors by providing behavior IDs

Class: Falcon::IncidentsApi

Operation: get_incidents
POST: /incidents/entities/incidents/GET/v1
Description: Get details on incidents by providing incident IDs

Class: Falcon::IncidentsApi

Operation: perform_incident_action
POST: /incidents/entities/incident-actions/v1
Description: Perform a set of actions on one or more incidents, such as adding tags or comments or updating the incident name or description

Class: Falcon::IncidentsApi

Operation: query_behaviors
GET: /incidents/queries/behaviors/v1
Description: Search for behaviors by providing an FQL filter, sorting, and paging details

Class: Falcon::IncidentsApi

Operation: query_incidents
GET: /incidents/queries/incidents/v1
Description: Search for incidents by providing an FQL filter, sorting, and paging details

Class: Falcon::InstallationTokensApi

Operation: audit_events_query
GET: /installation-tokens/queries/audit-events/v1
Description: Search for audit events by providing an FQL filter and paging details.

Class: Falcon::InstallationTokensApi

Operation: audit_events_read
GET: /installation-tokens/entities/audit-events/v1
Description: Gets the details of one or more audit events by id.

Class: Falcon::InstallationTokensApi

Operation: customer_settings_read
GET: /installation-tokens/entities/customer-settings/v1
Description: Check current installation token settings.

Class: Falcon::InstallationTokensApi

Operation: tokens_create
POST: /installation-tokens/entities/tokens/v1
Description: Creates a token.

Class: Falcon::InstallationTokensApi

Operation: tokens_delete
DELETE: /installation-tokens/entities/tokens/v1
Description: Deletes a token immediately. To revoke a token, use PATCH /installation-tokens/entities/tokens/v1 instead.

Class: Falcon::InstallationTokensApi

Operation: tokens_query
GET: /installation-tokens/queries/tokens/v1
Description: Search for tokens by providing an FQL filter and paging details.

Class: Falcon::InstallationTokensApi

Operation: tokens_read
GET: /installation-tokens/entities/tokens/v1
Description: Gets the details of one or more tokens by id.

Class: Falcon::InstallationTokensApi

Operation: tokens_update
PATCH: /installation-tokens/entities/tokens/v1
Description: Updates one or more tokens. Use this endpoint to edit labels, change expiration, revoke, or restore.

Class: Falcon::InstallationTokensSettingsApi

Operation: customer_settings_update
PATCH: /installation-tokens/entities/customer-settings/v1
Description: Update installation token settings.

Class: Falcon::IntelApi

Operation: get_intel_actor_entities
GET: /intel/entities/actors/v1
Description: Retrieve specific actors using their actor IDs.

Class: Falcon::IntelApi

Operation: get_intel_indicator_entities
POST: /intel/entities/indicators/GET/v1
Description: Retrieve specific indicators using their indicator IDs.

Class: Falcon::IntelApi

Operation: get_intel_report_entities
GET: /intel/entities/reports/v1
Description: Retrieve specific reports using their report IDs.

Class: Falcon::IntelApi

Operation: get_intel_report_pdf
GET: /intel/entities/report-files/v1
Description: Return a Report PDF attachment

Class: Falcon::IntelApi

Operation: get_intel_rule_entities
GET: /intel/entities/rules/v1
Description: Retrieve details for rule sets for the specified ids.

Class: Falcon::IntelApi

Operation: get_intel_rule_file
GET: /intel/entities/rules-files/v1
Description: Download earlier rule sets.

Class: Falcon::IntelApi

Operation: get_latest_intel_rule_file
GET: /intel/entities/rules-latest-files/v1
Description: Download the latest rule set.

Class: Falcon::IntelApi

Operation: get_mitre_report
GET: /intel/entities/mitre-reports/v1
Description: Export Mitre ATT&CK information for a given actor.

Class: Falcon::IntelApi

Operation: get_vulnerabilities
POST: /intel/entities/vulnerabilities/GET/v1
Description: Get vulnerabilities

Class: Falcon::IntelApi

Operation: post_mitre_attacks
POST: /intel/entities/mitre/v1
Description: Retrieves report and observable IDs associated with the given actor and attacks

Class: Falcon::IntelApi

Operation: query_intel_actor_entities
GET: /intel/combined/actors/v1
Description: Get info about actors that match provided FQL filters.

Class: Falcon::IntelApi

Operation: query_intel_actor_ids
GET: /intel/queries/actors/v1
Description: Get actor IDs that match provided FQL filters.

Class: Falcon::IntelApi

Operation: query_intel_indicator_entities
GET: /intel/combined/indicators/v1
Description: Get info about indicators that match provided FQL filters.

Class: Falcon::IntelApi

Operation: query_intel_indicator_ids
GET: /intel/queries/indicators/v1
Description: Get indicators IDs that match provided FQL filters.

Class: Falcon::IntelApi

Operation: query_intel_report_entities
GET: /intel/combined/reports/v1
Description: Get info about reports that match provided FQL filters.

Class: Falcon::IntelApi

Operation: query_intel_report_ids
GET: /intel/queries/reports/v1
Description: Get report IDs that match provided FQL filters.

Class: Falcon::IntelApi

Operation: query_intel_rule_ids
GET: /intel/queries/rules/v1
Description: Search for rule IDs that match provided filter criteria.

Class: Falcon::IntelApi

Operation: query_mitre_attacks
GET: /intel/queries/mitre/v1
Description: Gets MITRE tactics and techniques for the given actor, returning concatenation of id and tactic and technique ids, example: fancy-bear_TA0011_T1071

Class: Falcon::IntelApi

Operation: query_vulnerabilities
GET: /intel/queries/vulnerabilities/v1
Description: Get vulnerabilities IDs

Class: Falcon::IoaExclusionsApi

Operation: create_ioa_exclusions_v1
POST: /policy/entities/ioa-exclusions/v1
Description: Create the IOA exclusions

Class: Falcon::IoaExclusionsApi

Operation: delete_ioa_exclusions_v1
DELETE: /policy/entities/ioa-exclusions/v1
Description: Delete the IOA exclusions by id

Class: Falcon::IoaExclusionsApi

Operation: get_ioa_exclusions_v1
GET: /policy/entities/ioa-exclusions/v1
Description: Get a set of IOA Exclusions by specifying their IDs

Class: Falcon::IoaExclusionsApi

Operation: query_ioa_exclusions_v1
GET: /policy/queries/ioa-exclusions/v1
Description: Search for IOA exclusions.

Class: Falcon::IoaExclusionsApi

Operation: update_ioa_exclusions_v1
PATCH: /policy/entities/ioa-exclusions/v1
Description: Update the IOA exclusions

Class: Falcon::IocApi

Operation: action_get_v1
GET: /iocs/entities/actions/v1
Description: Get Actions by ids.

Class: Falcon::IocApi

Operation: action_query_v1
GET: /iocs/queries/actions/v1
Description: Query Actions.

Class: Falcon::IocApi

Operation: get_indicators_report
POST: /iocs/entities/indicators-reports/v1
Description: Launch an indicators report creation job

Class: Falcon::IocApi

Operation: indicator_aggregate_v1
POST: /iocs/aggregates/indicators/v1
Description: Get Indicators aggregates as specified via json in the request body.

Class: Falcon::IocApi

Operation: indicator_combined_v1
GET: /iocs/combined/indicator/v1
Description: Get Combined for Indicators.

Class: Falcon::IocApi

Operation: indicator_create_v1
POST: /iocs/entities/indicators/v1
Description: Create Indicators.

Class: Falcon::IocApi

Operation: indicator_delete_v1
DELETE: /iocs/entities/indicators/v1
Description: Delete Indicators by ids.

Class: Falcon::IocApi

Operation: indicator_get_device_count_v1
GET: /iocs/aggregates/indicators/device-count/v1
Description: Get the number of devices the indicator has run on

Class: Falcon::IocApi

Operation: indicator_get_devices_ran_on_v1
GET: /iocs/queries/indicators/devices/v1
Description: Get the IDs of devices the indicator has run on

Class: Falcon::IocApi

Operation: indicator_get_processes_ran_on_v1
GET: /iocs/queries/indicators/processes/v1
Description: Get the number of processes the indicator has run on

Class: Falcon::IocApi

Operation: indicator_get_v1
GET: /iocs/entities/indicators/v1
Description: Get Indicators by ids.

Class: Falcon::IocApi

Operation: indicator_search_v1
GET: /iocs/queries/indicators/v1
Description: Search for Indicators.

Class: Falcon::IocApi

Operation: indicator_update_v1
PATCH: /iocs/entities/indicators/v1
Description: Update Indicators.

Class: Falcon::IocApi

Operation: ioc_type_query_v1
GET: /iocs/queries/ioc-types/v1
Description: Query IOC Types.

Class: Falcon::IocApi

Operation: platform_query_v1
GET: /iocs/queries/platforms/v1
Description: Query Platforms.

Class: Falcon::IocApi

Operation: severity_query_v1
GET: /iocs/queries/severities/v1
Description: Query Severities.

Class: Falcon::IocsApi

Operation: devices_count
GET: /indicators/aggregates/devices-count/v1
Description: Number of hosts in your customer account that have observed a given custom IOC

Class: Falcon::IocsApi

Operation: devices_ran_on
GET: /indicators/queries/devices/v1
Description: Find hosts that have observed a given custom IOC. For details about those hosts, use GET /devices/entities/devices/v1

Class: Falcon::IocsApi

Operation: entities_processes
GET: /processes/entities/processes/v1
Description: For the provided ProcessID retrieve the process details

Class: Falcon::IocsApi

Operation: processes_ran_on
GET: /indicators/queries/processes/v1
Description: Search for processes associated with a custom IOC