Skip to content

Ml Exclusions

jshcodes edited this page Apr 11, 2021 · 27 revisions

CrowdStrike Falcon Twitter URL

Using the ML Exclusions service collection

Uber class support Uber class support

Table of Contents

API Function Description
getMLExclusionsV1 Get a set of ML Exclusions by specifying their IDs
createMLExclusionsV1 Create the ML exclusions
deleteMLExclusionsV1 Delete the ML exclusions by id
updateMLExclusionsV1 Update the ML exclusions
queryMLExclusionsV1 Search for ML exclusions.

getMLExclusionsV1

Get a set of ML Exclusions by specifying their IDs

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
ids query array (string) The ids of the exclusions to retrieve

Usage

Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

IDS = 'ID1,ID2,ID3'

response = falcon.command('getMLExclusionsV1', ids=IDS)
print(response)
falcon.deauthenticate()

createMLExclusionsV1

Create the ML exclusions

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
body body string

Usage

Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

BODY = {
    'Body Payload': 'See body description above'
}

response = falcon.command('createMLExclusionsV1', body=BODY)
print(response)
falcon.deauthenticate()

deleteMLExclusionsV1

Delete the ML exclusions by id

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
ids query array (string) The ids of the exclusions to delete
comment query string Explains why this exclusions was deleted

Usage

Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

PARAMS = {
    'comment': 'string'
}

IDS = 'ID1,ID2,ID3'

response = falcon.command('deleteMLExclusionsV1', parameters=PARAMS, ids=IDS)
print(response)
falcon.deauthenticate()

updateMLExclusionsV1

Update the ML exclusions

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
body body string

Usage

Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

BODY = {
    'Body Payload': 'See body description above'
}

response = falcon.command('updateMLExclusionsV1', body=BODY)
print(response)
falcon.deauthenticate()

queryMLExclusionsV1

Search for ML exclusions.

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
filter query string The filter expression that should be used to limit the results.
offset query integer The offset to start retrieving records from
limit query integer The maximum records to return. [1-500]
sort query string The sort expression that should be used to sort the results.

Usage

Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

PARAMS = {
    'filter': 'string',
    'offset': integer,
    'limit': integer,
    'sort': 'string'
}

response = falcon.command('queryMLExclusionsV1', parameters=PARAMS)
print(response)
falcon.deauthenticate()

CrowdStrike Falcon

Clone this wiki locally