Skip to content

Intel

Jump to bottom
jshcodes edited this page Aug 30, 2021 · 36 revisions

CrowdStrike Falcon Twitter URL

Using the Intel service collection

Uber class support Service class support

Table of Contents

Operation ID Description
QueryIntelActorEntities
PEP8 query_actor_entities
Get info about actors that match provided FQL filters.
QueryIntelIndicatorEntities
PEP8 query_indicator_entities
Get info about indicators that match provided FQL filters.
QueryIntelReportEntities
PEP8 query_report_entities
Get info about reports that match provided FQL filters.
GetIntelActorEntities
PEP8 get_actor_entities
Retrieve specific actors using their actor IDs.
GetIntelIndicatorEntities
PEP8 get_indicator_entities
Retrieve specific indicators using their indicator IDs.
GetIntelReportPDF
PEP8 get_report_pdf
Return a Report PDF attachment
GetIntelReportEntities
PEP8 get_report_entities
Retrieve specific reports using their report IDs.
GetIntelRuleFile
PEP8 get_rule_file
Download earlier rule sets.
GetLatestIntelRuleFile
PEP8 get_latest_rule_file
Download the latest rule set.
GetIntelRuleEntities
PEP8 get_rule_entities
Retrieve details for rule sets for the specified ids.
QueryIntelActorIds
PEP8 query_actor_ids
Get actor IDs that match provided FQL filters.
QueryIntelIndicatorIds
PEP8 query_indicator_ids
Get indicators IDs that match provided FQL filters.
QueryIntelReportIds
PEP8 query_report_ids
Get report IDs that match provided FQL filters.
QueryIntelRuleIds
PEP8 query_rule_ids
Search for rule IDs that match provided filter criteria.

QueryIntelActorEntities

Get info about actors that match provided FQL filters.

PEP8 method name

query_actor_entities

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
offset query integer Set the starting row number to return actors from. Defaults to 0.
limit query integer Set the number of actors to return. The value must be between 1 and 5000.
sort query string Order fields in ascending or descending order. Ex: created_date
filter query string Filter your query by specifying FQL filter parameters. Filter parameters include: actors, actors.id, actors.name, actors.slug, actors.url, created_date, description, id, last_modified_date, motivations, motivations.id, motivations.slug, motivations.value, name, name.raw, short_description, slug, sub_type, sub_type.id, sub_type.name, sub_type.slug, tags, tags.id, tags.slug, tags.value, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, type, type.id, type.name, type.slug, url.
q query string Perform a generic substring search across all fields.
fields query array (string) The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like: . Ex: slug full. Defaults to basic.

Usage

Service class example (PEP8 syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.query_actor_entities(offset=integer,
                                       limit=integer,
                                       sort="string",
                                       filter="string",
                                       q="string",
                                       fields=["string", "string"]
                                       )
print(response)
Service class example (Operation ID syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.QueryIntelActorEntities(offset=integer,
                                          limit=integer,
                                          sort="string",
                                          filter="string",
                                          q="string",
                                          fields=["string", "string"]
                                          )
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "offset": integer,
    "limit": integer,
    "sort": "string",
    "filter": "string",
    "q": "string",
    "fields": [
       "string",
       "string"
    ]
}

response = falcon.command("QueryIntelActorEntities", parameters=PARAMS)
print(response)

QueryIntelIndicatorEntities

Get info about indicators that match provided FQL filters.

PEP8 method name

query_indicator_entities

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
offset query integer Set the starting row number to return indicators from. Defaults to 0.
limit query integer Set the number of indicators to return. The number must be between 1 and 50000
sort query string Order fields in ascending or descending order. Ex: published_date
filter query string Filter your query by specifying FQL filter parameters. Filter parameters include: _marker, actors, deleted, domain_types, id, indicator, ip_address_types, kill_chains, labels, labels.created_on, labels.last_valid_on, labels.name, last_updated, malicious_confidence, malware_families, published_date, reports, targets, threat_types, type, vulnerabilities.
q query string Perform a generic substring search across all fields.
include_deleted query boolean If true, include both published and deleted indicators in the response. Defaults to false.

Usage

Service class example (PEP8 syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.query_indicator_entities(offset=integer,
                                           limit=integer,
                                           sort="string",
                                           filter="string",
                                           q="string",
                                           include_deleted=boolean
                                           )
print(response)
Service class example (Operation ID syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.QueryIntelIndicatorEntities(offset=integer,
                                              limit=integer,
                                              sort="string",
                                              filter="string",
                                              q="string",
                                              include_deleted=boolean
                                              )
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "offset": integer,
    "limit": integer,
    "sort": "string",
    "filter": "string",
    "q": "string",
    "include_deleted": boolean
}

response = falcon.command("QueryIntelIndicatorEntities", parameters=PARAMS)
print(response)

QueryIntelReportEntities

Get info about reports that match provided FQL filters.

PEP8 method name

query_report_entities

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
offset query integer Set the starting row number to return reports from. Defaults to 0.
limit query integer Set the number of reports to return. The value must be between 1 and 5000.
sort query string Order fields in ascending or descending order. Ex: created_date
filter query string Filter your query by specifying FQL filter parameters. Filter parameters include: actors, actors.id, actors.name, actors.slug, actors.url, created_date, description, id, last_modified_date, motivations, motivations.id, motivations.slug, motivations.value, name, name.raw, short_description, slug, sub_type, sub_type.id, sub_type.name, sub_type.slug, tags, tags.id, tags.slug, tags.value, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, type, type.id, type.name, type.slug, url.
q query string Perform a generic substring search across all fields.
fields query array (string) The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like: . Ex: slug full. Defaults to basic.

Usage

Service class example (PEP8 syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.query_report_entities(offset=integer,
                                        limit=integer,
                                        sort="string",
                                        filter="string",
                                        q="string",
                                        fields=["string", "string"]
                                        )
print(response)
Service class example (Operation ID syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.QueryIntelReportEntities(offset=integer,
                                           limit=integer,
                                           sort="string",
                                           filter="string",
                                           q="string",
                                           fields=["string", "string"]
                                           )
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "offset": integer,
    "limit": integer,
    "sort": "string",
    "filter": "string",
    "q": "string",
    "fields": [
       "string",
       "string"
    ]
}

response = falcon.command("QueryIntelReportEntities", parameters=PARAMS)
print(response)

GetIntelActorEntities

Retrieve specific actors using their actor IDs.

PEP8 method name

get_actor_entities

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
✅ ids query array (string) The IDs of the actors you want to retrieve.
fields query array (string) The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like: . Ex: slug full. Defaults to basic.

Usage

Service class example (PEP8 syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_actor_entities(fields=["string", "string"], ids=id_list)
print(response)
Service class example (Operation ID syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetIntelActorEntities(fields=["string", "string"], ids=id_list)
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "fields": [
       "string",
       "string"
    ]
}

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetIntelActorEntities", parameters=PARAMS, ids=id_list)
print(response)

GetIntelIndicatorEntities

Retrieve specific indicators using their indicator IDs.

PEP8 method name

get_indicator_entities

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
✅ body body string

Usage

Service class example (PEP8 syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.get_indicator_entities(body=BODY)
print(response)
Service class example (Operation ID syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.GetIntelIndicatorEntities(body=BODY)
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.command("GetIntelIndicatorEntities", body=BODY)
print(response)

GetIntelReportPDF

Return a Report PDF attachment

PEP8 method name

get_report_pdf

Content-Type

  • Produces: application/octet-stream

Parameters

Required Name Type Datatype Description
✅ id query string The ID of the report you want to download as a PDF.

Usage

Service class example (PEP8 syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

save_file = "some_file.ext"

response = falcon.get_report_pdf(id="string")
open(save_file, 'wb').write(response)
Service class example (Operation ID syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

save_file = "some_file.ext"

response = falcon.GetIntelReportPDF(id="string")
open(save_file, 'wb').write(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "id": "string"
}

save_file = "some_file.ext"

response = falcon.command("GetIntelReportPDF", parameters=PARAMS)
open(save_file, 'wb').write(response)

GetIntelReportEntities

Retrieve specific reports using their report IDs.

PEP8 method name

get_report_entities

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
✅ ids query array (string) The IDs of the reports you want to retrieve.
fields query array (string) The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like: . Ex: slug full. Defaults to basic.

Usage

Service class example (PEP8 syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_report_entities(fields=["string", "string"], ids=id_list)
print(response)
Service class example (Operation ID syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetIntelReportEntities(fields=["string", "string"], ids=id_list)
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "fields": [
       "string",
       "string"
    ]
}

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetIntelReportEntities", parameters=PARAMS, ids=id_list)
print(response)

GetIntelRuleFile

Download earlier rule sets.

PEP8 method name

get_rule_file

Content-Type

  • Produces: application/zip

Parameters

Required Name Type Datatype Description
Accept header string Choose the format you want the rule set in.
✅ id query integer The ID of the rule set.
format query string Choose the format you want the rule set in. Valid formats are zip and gzip. Defaults to zip.

Usage

Service class example (PEP8 syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

HEADERS = {
    "Accept": "string"
}

save_file = "some_file.zip"

response = falcon.get_rule_file(id=integer, format="string", headers=HEADERS)
open(save_file, 'wb').write(response)
Service class example (Operation ID syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

HEADERS = {
    "Accept": "string"
}

save_file = "some_file.zip"

response = falcon.GetIntelRuleFile(id=integer, format="string", headers=HEADERS)
open(save_file, 'wb').write(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "id": integer,
    "format": "string"
}

HEADERS = {
    "Accept": "string"
}

save_file = "some_file.zip"

response = falcon.command("GetIntelRuleFile", parameters=PARAMS, headers=HEADERS)
open(save_file, 'wb').write(response)

GetLatestIntelRuleFile

Download the latest rule set.

PEP8 method name

get_latest_rule_file

Content-Type

  • Produces: application/zip

Parameters

Required Name Type Datatype Description
Accept header string Choose the format you want the rule set in.
✅ type query string The rule news report type. Accepted values: snort-suricata-master snort-suricata-update snort-suricata-changelog yara-master yara-update yara-changelog common-event-format netwitness
format query string Choose the format you want the rule set in. Valid formats are zip and gzip. Defaults to zip.

Usage

Service class example (PEP8 syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

HEADERS = {
    "Accept": "string"
}

save_file = "some_file.zip"

response = falcon.get_latest_rule_file(type="string", format="string", headers=HEADERS)
open(save_file, 'wb').write(response)
Service class example (Operation ID syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

HEADERS = {
    "Accept": "string"
}

save_file = "some_file.zip"

response = falcon.GetLatestIntelRuleFile(type="string", format="string", headers=HEADERS)
open(save_file, 'wb').write(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "type": "string",
    "format": "string"
}

HEADERS = {
    "Accept": "string"
}

save_file = "some_file.zip"

response = falcon.command("GetLatestIntelRuleFile", parameters=PARAMS, headers=HEADERS)
open(save_file, 'wb').write(response)

GetIntelRuleEntities

Retrieve details for rule sets for the specified ids.

PEP8 method name

get_rule_entities

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
✅ ids query array (string) The ids of rules to return.

Usage

Service class example (PEP8 syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rule_entities(ids=id_list)
print(response)
Service class example (Operation ID syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetIntelRuleEntities(ids=id_list)
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetIntelRuleEntities", ids=id_list)
print(response)

QueryIntelActorIds

Get actor IDs that match provided FQL filters.

PEP8 method name

query_actor_ids

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
offset query integer Set the starting row number to return actors IDs from. Defaults to 0.
limit query integer Set the number of actor IDs to return. The value must be between 1 and 5000.
sort query string Order fields in ascending or descending order. Ex: created_date
filter query string Filter your query by specifying FQL filter parameters. Filter parameters include: actors, actors.id, actors.name, actors.slug, actors.url, created_date, description, id, last_modified_date, motivations, motivations.id, motivations.slug, motivations.value, name, name.raw, short_description, slug, sub_type, sub_type.id, sub_type.name, sub_type.slug, tags, tags.id, tags.slug, tags.value, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, type, type.id, type.name, type.slug, url.
q query string Perform a generic substring search across all fields.

Usage

Service class example (PEP8 syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.query_actor_ids(offset=integer,
                                  limit=integer,
                                  sort="string",
                                  filter="string",
                                  q="string"
                                  )
print(response)
Service class example (Operation ID syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.QueryIntelActorIds(offset=integer,
                                     limit=integer,
                                     sort="string",
                                     filter="string",
                                     q="string"
                                     )
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "offset": integer,
    "limit": integer,
    "sort": "string",
    "filter": "string",
    "q": "string"
}

response = falcon.command("QueryIntelActorIds", parameters=PARAMS)
print(response)

QueryIntelIndicatorIds

Get indicators IDs that match provided FQL filters.

PEP8 method name

query_indicator_ids

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
offset query integer Set the starting row number to return indicator IDs from. Defaults to 0.
limit query integer Set the number of indicator IDs to return. The number must be between 1 and 50000
sort query string Order fields in ascending or descending order. Ex: published_date
filter query string Filter your query by specifying FQL filter parameters. Filter parameters include: _marker, actors, deleted, domain_types, id, indicator, ip_address_types, kill_chains, labels, labels.created_on, labels.last_valid_on, labels.name, last_updated, malicious_confidence, malware_families, published_date, reports, targets, threat_types, type, vulnerabilities.
q query string Perform a generic substring search across all fields.
include_deleted query boolean If true, include both published and deleted indicators in the response. Defaults to false.

Usage

Service class example (PEP8 syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.query_indicator_ids(offset=integer,
                                      limit=integer,
                                      sort="string",
                                      filter="string",
                                      q="string",
                                      include_deleted=boolean
                                      )
print(response)
Service class example (Operation ID syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.QueryIntelIndicatorIds(offset=integer,
                                         limit=integer,
                                         sort="string",
                                         filter="string",
                                         q="string",
                                         include_deleted=boolean
                                         )
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "offset": integer,
    "limit": integer,
    "sort": "string",
    "filter": "string",
    "q": "string",
    "include_deleted": boolean
}

response = falcon.command("QueryIntelIndicatorIds", parameters=PARAMS)
print(response)

QueryIntelReportIds

Get report IDs that match provided FQL filters.

PEP8 method name

query_report_ids

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
offset query integer Set the starting row number to return report IDs from. Defaults to 0.
limit query integer Set the number of report IDs to return. The value must be between 1 and 5000.
sort query string Order fields in ascending or descending order. Ex: created_date
filter query string Filter your query by specifying FQL filter parameters. Filter parameters include: actors, actors.id, actors.name, actors.slug, actors.url, created_date, description, id, last_modified_date, motivations, motivations.id, motivations.slug, motivations.value, name, name.raw, short_description, slug, sub_type, sub_type.id, sub_type.name, sub_type.slug, tags, tags.id, tags.slug, tags.value, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, type, type.id, type.name, type.slug, url.
q query string Perform a generic substring search across all fields.

Usage

Service class example (PEP8 syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.query_report_ids(offset=integer,
                                   limit=integer,
                                   sort="string",
                                   filter="string",
                                   q="string"
                                   )
print(response)
Service class example (Operation ID syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.QueryIntelReportIds(offset=integer,
                                      limit=integer,
                                      sort="string",
                                      filter="string",
                                      q="string"
                                      )
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "offset": integer,
    "limit": integer,
    "sort": "string",
    "filter": "string",
    "q": "string"
}

response = falcon.command("QueryIntelReportIds", parameters=PARAMS)
print(response)

QueryIntelRuleIds

Search for rule IDs that match provided filter criteria.

PEP8 method name

query_rule_ids

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
offset query integer Set the starting row number to return reports from. Defaults to 0.
limit query integer The number of rule IDs to return. Defaults to 10.
sort query string Order fields in ascending or descending order. Ex: created_date
name query array (string) Search by rule title.
✅ type query string The rule news report type. Accepted values: snort-suricata-master snort-suricata-update snort-suricata-changelog yara-master yara-update yara-changelog common-event-format netwitness
description query array (string) Substring match on description field.
tags query array (string) Search for rule tags.
min_created_date query integer Filter results to those created on or after a certain date.
max_created_date query string Filter results to those created on or before a certain date.
q query string Perform a generic substring search across all fields.

Usage

Service class example (PEP8 syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.query_rule_ids(offset=integer,
                                 limit=integer,
                                 sort="string",
                                 name=["string", "string"],
                                 type="string",
                                 description=["string", "string"],
                                 tags=["string", "string"],
                                 min_created_date=integer,
                                 max_created_date="string",
                                 q="string"
                                 )
print(response)
Service class example (Operation ID syntax)
from falconpy.intel import Intel

falcon = Intel(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.QueryIntelRuleIds(offset=integer,
                                    limit=integer,
                                    sort="string",
                                    name=["string", "string"],
                                    type="string",
                                    description=["string", "string"],
                                    tags=["string", "string"],
                                    min_created_date=integer,
                                    max_created_date="string",
                                    q="string"
                                    )
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "offset": integer,
    "limit": integer,
    "sort": "string",
    "name": [
       "string",
       "string"
    ],
    "type": "string",
    "description": [
       "string",
       "string"
    ],
    "tags": [
       "string",
       "string"
    ],
    "min_created_date": integer,
    "max_created_date": "string",
    "q": "string"
}

response = falcon.command("QueryIntelRuleIds", parameters=PARAMS)
print(response)

CrowdStrike Falcon

Clone this wiki locally