forked from CrowdStrike/falconpy
-
Notifications
You must be signed in to change notification settings - Fork 0
Ml Exclusions
jshcodes edited this page Nov 2, 2021
·
27 revisions
Operation ID | Description | ||||
---|---|---|---|---|---|
|
Get a set of ML Exclusions by specifying their IDs. | ||||
|
Create the ML exclusions. | ||||
|
Delete the ML exclusions by ID. | ||||
|
Update the ML exclusions. | ||||
|
Search for ML exclusions. |
Get a set of ML Exclusions by specifying their IDs
get_exclusions
- Produces: application/json
Name | Service | Uber | Type | Datatype | Description |
---|---|---|---|---|---|
ids |
|
|
query | string or list of strings | The IDs of the exclusions to retrieve. |
parameters |
|
|
query | string | Full query string parameters payload in JSON format. |
from falconpy import MLExclusions
falcon = MLExclusions(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_exclusions(ids=id_list)
print(response)
from falconpy import MLExclusions
falcon = MLExclusions(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.getMLExclusionsV1(ids=id_list)
print(response)
from falconpy import APIHarness
falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("getMLExclusionsV1", ids=id_list)
print(response)
Create the ML exclusions
create_exclusions
- Produces: application/json
Name | Service | Uber | Type | Datatype | Description |
---|---|---|---|---|---|
body |
|
|
body | string | Full body payload in JSON format. |
comment |
|
|
body | string | String comment describing why the exclusions was created. |
excluded_from |
|
|
body | list of strings | Group ID(s) explicitly excluded from the exclusion. |
groups |
|
|
body | list of strings | Group ID(s) impacted by the exclusion. |
value |
|
|
body | string | Value to match for the exclusion. |
from falconpy import MLExclusions
falcon = MLExclusions(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
group_list = ['ID1', 'ID2', 'ID3']
exclude_list = ['EX1', 'EX2', 'EX3']
response = falcon.create_exclusions(comment="string",
groups=group_list,
excluded_from=exclude_list,
value="string"
)
print(response)
from falconpy import MLExclusions
falcon = MLExclusions(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
group_list = ['ID1', 'ID2', 'ID3']
exclude_list = ['EX1', 'EX2', 'EX3']
response = falcon.createMLExclusionsV1(comment="string",
groups=group_list,
excluded_from=exclude_list,
value="string"
)
print(response)
from falconpy import APIHarness
falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
group_list = ['ID1', 'ID2', 'ID3']
exclude_list = ['EX1', 'EX2', 'EX3']
BODY = {
"comment": "string",
"excluded_from": exclude_list,
"groups": group_list,
"value": "string"
}
response = falcon.command("createMLExclusionsV1", body=BODY)
print(response)
Delete the ML exclusions by id
delete_exclusions
- Produces: application/json
Name | Service | Uber | Type | Datatype | Description |
---|---|---|---|---|---|
comment |
|
|
query | string | Explains why this exclusion was deleted. |
ids |
|
|
query | string or list of strings | The IDs of the exclusions to retrieve. |
parameters |
|
|
query | string | Full query string parameters payload in JSON format. |
from falconpy import MLExclusions
falcon = MLExclusions(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.delete_exclusions(comment="string", ids=id_list)
print(response)
from falconpy import MLExclusions
falcon = MLExclusions(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.deleteMLExclusionsV1(comment="string", ids=id_list)
print(response)
from falconpy import APIHarness
falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("deleteMLExclusionsV1", comment="string", ids=id_list)
print(response)
Update the ML exclusions
update_exclusions
- Produces: application/json
Name | Service | Uber | Type | Datatype | Description |
---|---|---|---|---|---|
body |
|
|
body | string | Full body payload in JSON format. |
comment |
|
|
body | string | String comment describing why the exclusions was created. |
groups |
|
|
body | list of strings | Group ID(s) impacted by the exclusion. |
id |
|
|
body | string | The ID of the exclusion to update. |
value |
|
|
body | string | Value to match for the exclusion. |
from falconpy import MLExclusions
falcon = MLExclusions(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
group_list = ['ID1', 'ID2', 'ID3']
response = falcon.update_exclusions(comment="string",
groups=group_list,
value="string",
id="string"
)
print(response)
from falconpy import MLExclusions
falcon = MLExclusions(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
group_list = ['ID1', 'ID2', 'ID3']
response = falcon.updateMLExclusionsV1(comment="string",
groups=group_list,
value="string",
id="string"
)
print(response)
from falconpy import APIHarness
falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
group_list = ['ID1', 'ID2', 'ID3']
BODY = {
"comment": "string",
"groups": group_list,
"id": "string",
"value": "string"
}
response = falcon.command("updateMLExclusionsV1", body=BODY)
print(response)
Search for ML exclusions.
query_exclusions
- Produces: application/json
Name | Service | Uber | Type | Datatype | Description |
---|---|---|---|---|---|
filter |
|
|
query | string | The filter expression that should be used to limit the results. FQL syntax. Available filters:
|
limit |
|
|
query | integer | The maximum number of records to return. [1-500] |
offset |
|
|
query | integer | The offset to start retrieving records from. |
parameters |
|
|
query | string | Full query string parameters payload in JSON format. |
sort |
|
|
query | string | The property to sort by. FQL syntax. (e.g. last_behavior|asc) Available sort fields:
|
from falconpy import MLExclusions
falcon = MLExclusions(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
response = falcon.query_exclusions(filter="string",
offset=integer,
limit=integer,
sort="string"
)
print(response)
from falconpy import MLExclusions
falcon = MLExclusions(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
response = falcon.queryMLExclusionsV1(filter="string",
offset=integer,
limit=integer,
sort="string"
)
print(response)
from falconpy import APIHarness
falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
PARAMS = {
"filter": "string",
"offset": integer,
"limit": integer,
"sort": "string"
}
response = falcon.command("queryMLExclusionsV1",
filter="string",
offset=integer,
limit=integer,
sort="string"
)
print(response)
- Home
- Discussions Board
- Glossary of Terms
- Installation, Upgrades and Removal
- Samples Collection
- Using FalconPy
- API Operations
-
Service Collections
- Alerts
- API Integrations
- ASPM
- Certificate Based Exclusions
- Cloud Connect AWS (deprecated)
- Cloud Snapshots
- Compliance Assessments
- Configuration Assessment
- Configuration Assessment Evaluation Logic
- Container Alerts
- Container Detections
- Container Images
- Container Packages
- Container Vulnerabilities
- CSPM Registration
- Custom IOAs
- Custom Storage
- D4C Registration (deprecated)
- DataScanner
- Delivery Settings
- Detects
- Device Control Policies
- Discover
- Downloads
- Drift Indicators
- Event Streams
- Exposure Management
- Falcon Complete Dashboard
- Falcon Container
- Falcon Intelligence Sandbox
- FDR
- FileVantage
- Firewall Management
- Firewall Policies
- Foundry LogScale
- Host Group
- Host Migration
- Hosts
- Identity Protection
- Image Assessment Policies
- Incidents
- Installation Tokens
- Intel
- IOA Exclusions
- IOC
- IOCs (deprecated)
- Kubernetes Protection
- MalQuery
- Message Center
- ML Exclusions
- Mobile Enrollment
- MSSP (Flight Control)
- OAuth2
- ODS (On Demand Scan)
- Overwatch Dashboard
- Prevention Policy
- Quarantine
- Quick Scan
- Quick Scan Pro
- Real Time Response
- Real Time Response Admin
- Real Time Response Audit
- Recon
- Report Executions
- Response Policies
- Sample Uploads
- Scheduled Reports
- Sensor Download
- Sensor Update Policy
- Sensor Usage
- Sensor Visibility Exclusions
- Spotlight Evaluation Logic
- Spotlight Vulnerabilities
- Tailored Intelligence
- ThreatGraph
- Unidentified Containers
- User Management
- Workflows
- Zero Trust Assessment
- Documentation Support
-
CrowdStrike SDKs
- Crimson Falcon - Ruby
- FalconPy - Python 3
- FalconJS - Javascript
- goFalcon - Go
- PSFalcon - Powershell
- Rusty Falcon - Rust