Real Time Response Admin

Using the Real Time Response Admin service collection

Table of Contents

Operation ID	Description
BatchAdminCmd PEP 8 batch_admin_command	Batch executes a RTR administrator command across the hosts mapped to the given batch ID.
RTR_CheckAdminCommandStatus PEP 8 check_admin_command_status	Get status of an executed RTR administrator command on a single host.
RTR_ExecuteAdminCommand PEP 8 execute_admin_command	Execute a RTR administrator command on a single host.
RTR_GetPut_Files PEP 8 get_put_files	Get put-files based on the ID's given. These are used for the RTR put command.
RTR_CreatePut_Files PEP 8 create_put_files	Upload a new put-file to use for the RTR put command.
RTR_DeletePut_Files PEP 8 delete_put_files	Delete a put-file based on the ID given. Can only delete one file at a time.
RTR_GetScripts PEP 8 get_scripts	Get custom-scripts based on the ID's given. These are used for the RTR runscript command.
RTR_CreateScripts PEP 8 create_scripts	Upload a new custom-script to use for the RTR runscript command.
RTR_DeleteScripts PEP 8 delete_scripts	Delete a custom-script based on the ID given. Can only delete one script at a time.
RTR_UpdateScripts PEP 8 update_scripts	Upload a new scripts to replace an existing one.
RTR_ListPut_Files PEP 8 list_put_files	Get a list of put-file ID's that are available to the user for the put command.
RTR_ListScripts PEP 8 list_scripts	Get a list of custom-script ID's that are available to the user for the runscript command.

BatchAdminCmd

Batch executes a RTR administrator command across the hosts mapped to the given batch ID.

PEP8 method name

batch_admin_command

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Datatype	Description
body			body	string	Full body payload in JSON format.
base_command			body	string	Active Responder base command to perform. For example: get or cp. Refer to this list for a complete listing of available commands.
batch_id			body	string	RTR Batch ID to execute the command against. Received from batch_init_session.
command_string			body	string	Full command line of the command to execute. Example: get some_file.txt.
optional_hosts			body	string or list of strings	List of the subset of hosts we want to impact by this command. Allows for filtering of hosts from execution within the same batch.
persist_all			body	boolean	Flag indicating if this command should be executed when the host returns to service.
timeout			query	integer	Timeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 10 minutes.
timeout_duration			query	string	Timeout duration for for how long to wait for the request in duration syntax. Example, 10s. Valid units: ns, us, ms, s, m, h. Maximum is 10 minutes.
parameters			query	string	Full query string parameters payload in JSON format.

Available base commands

Command	Description	Operating System
cat	View file contents
cd	Change directory
clear	Clear the screen
cp	Copy a file
csrutil	Get system integrity protection status
encrypt	Encrypt a file
env	Display environment variables
eventlog	Inspect the event log. Subcommands: list view export backup eventlog backup is the recommended solution as opposed to eventlog export, as this method is faster and follows industry-standard file format.
filehash	Calculate a file hash (MD5 or SHA256)
get	Retrieve a file
getsid	Retrieve the current SID
help	Access help for a specific command or sub-command
history	Review command history for the current user
ifconfig	Review TCP configuration
ipconfig	Review TCP configuration
kill	Kill a running process
ls	List the contents of a directory
map	Map a UNC (SMB) path to a drive letter
memdump	Dump memory of a running process
mkdir	Create a directory
mount	Mount a file system (MacOS, Linux) or list available drives (Windows)
mv	Move a file
netstat	Retrieve network connection detail
ps	List running processes
put	Put a file onto a remote host
reg	Registry operations. Subcommands: query - Query the registry set - Set a registry key or value delete - Delete a registry key or value load - Load a registry hive unload - Unload a registry hive
restart	Restart the system
rm	Remove a file
run	Run an executable
runscript	Run a script
shutdown	Shutdown the system
tar	Compress a file or directory into a tar file
unmap	Unmap a UNC (SMB) path from a drive letter
unmount	Unmount a file system
update	Install patches through Windows Update. Subcommands: history - Check update history for this host install - Installs a patch by specifying the KB ID. 'Optional' KBs are not available. list - show all available updates for this host query - Show metadata about a specific KB
users	Get details about local users
xmemdump	Dump complete memory (kernel) for the system
zip	Create a zip archive

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

target_hosts = ["ID1", "ID2", "ID3"]

response = falcon.batch_admin_command(base_command="string",
                                      batch_id="string",
                                      command_string="string",
                                      optional_hosts=target_hosts,
                                      persist_all=boolean,
                                      timeout=integer,
                                      timeout_duration="string"
                                      )
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

target_hosts = ["ID1", "ID2", "ID3"]

response = falcon.BatchAdminCmd(base_command="string",
                                batch_id="string",
                                command_string="string",
                                optional_hosts=target_hosts,
                                persist_all=boolean,
                                timeout=integer,
                                timeout_duration="string"
                                )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

target_hosts = ["ID1", "ID2", "ID3"]

BODY = {
  "base_command": "string",
  "batch_id": "string",
  "command_string": "string",
  "optional_hosts": target_hosts,
  "persist_all": true
}

response = falcon.command("BatchAdminCmd",
                          timeout=integer,
                          timeout_duration="string",
                          body=BODY
                          )
print(response)

RTR_CheckAdminCommandStatus

Get status of an executed RTR administrator command on a single host.

PEP8 method name

check_admin_command_status

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Datatype	Description
cloud_request_id			query	string	Cloud Request ID of the executed command to query.
parameters			query	string	Full query string parameters payload in JSON format.
sequence_id			query	integer	Sequence ID that we want to retrieve. Command responses are chunked across sequences.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

response = falcon.check_admin_command_status(cloud_request_id="string", sequence_id=integer)
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

response = falcon.RTR_CheckAdminCommandStatus(cloud_request_id="string", sequence_id=integer)
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

response = falcon.command("RTR_CheckAdminCommandStatus",
                          cloud_request_id="string",
                          sequence_id=integer
                          )
print(response)

RTR_ExecuteAdminCommand

Execute a RTR administrator command on a single host.

PEP8 method name

execute_admin_command

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Datatype	Description
body			body	string	Full body payload in JSON format.
base_command			body	string	Active Responder base command to perform. For example: get or cp. Refer to this list for a complete listing of available commands.
session_id			body	string	RTR Session ID to execute the command against. Received from init_session.
command_string			body	string	Full command line of the command to execute. Example: get some_file.txt.
persist			body	boolean	Flag indicating if this command should be executed when the host returns to service.

Available base commands

Command	Description	Operating System
cat	View file contents
cd	Change directory
clear	Clear the screen
cp	Copy a file
csrutil	Get system integrity protection status
encrypt	Encrypt a file
env	Display environment variables
eventlog	Inspect the event log. Subcommands: list view export backup eventlog backup is the recommended solution as opposed to eventlog export, as this method is faster and follows industry-standard file format.
filehash	Calculate a file hash (MD5 or SHA256)
get	Retrieve a file
getsid	Retrieve the current SID
help	Access help for a specific command or sub-command
history	Review command history for the current user
ifconfig	Review TCP configuration
ipconfig	Review TCP configuration
kill	Kill a running process
ls	List the contents of a directory
map	Map a UNC (SMB) path to a drive letter
memdump	Dump memory of a running process
mkdir	Create a directory
mount	Mount a file system (MacOS, Linux) or list available drives (Windows)
mv	Move a file
netstat	Retrieve network connection detail
ps	List running processes
put	Put a file onto a remote host
reg	Registry operations. Subcommands: query - Query the registry set - Set a registry key or value delete - Delete a registry key or value load - Load a registry hive unload - Unload a registry hive
restart	Restart the system
rm	Remove a file
run	Run an executable
runscript	Run a script
shutdown	Shutdown the system
tar	Compress a file or directory into a tar file
unmap	Unmap a UNC (SMB) path from a drive letter
unmount	Unmount a file system
update	Install patches through Windows Update. Subcommands: history - Check update history for this host install - Installs a patch by specifying the KB ID. 'Optional' KBs are not available. list - show all available updates for this host query - Show metadata about a specific KB
users	Get details about local users
xmemdump	Dump complete memory (kernel) for the system
zip	Create a zip archive

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

response = falcon.execute_admin_command(base_command="string",
                                        session_id="string",
                                        command_string="string",
                                        persist=boolean
                                        )
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

response = falcon.RTR_ExecuteAdminCommand(base_command="string",
                                          session_id="string",
                                          command_string="string",
                                          persist=boolean
                                          )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

target_hosts = ["ID1", "ID2", "ID3"]

BODY = {
  "base_command": "string",
  "command_string": "string",
  "persist": true,
  "session_id": "string"
}

response = falcon.command("RTR_ExecuteAdminCommand", body=BODY)
print(response)

RTR_GetPut_Files

Get put-files based on the ID's given. These are used for the RTR put command.

PEP8 method name

get_put_files

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Datatype	Description
ids			query	string or list of strings	File IDs.
parameters			query	string	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_put_files(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RTR_GetPut_Files(ids=id_list)
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("RTR_GetPut_Files", ids=id_list)
print(response)

RTR_CreatePut_Files

Upload a new put-file to use for the RTR put command.

PEP8 method name

create_put_files

Content-Type

• Consumes: multipart/form-data
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Datatype	Description
comments_for_audit_log			formData	string	A descriptive comment for the audit log.
data			formData	file	Full formData payload in JSON format.
description			formData	string	File description.
name			formData	string	File name (if different than actual file name).
files			query	list of tuples	File(s) to be uploaded.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

file_upload = [('file', ('file.ext', open('file.ext','rb').read(), 'application/script'))]

response = falcon.create_put_files(comments_for_audit_log="string",
                                   description="string",
                                   name="string",
                                   files=file_upload
                                   )
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

file_upload = [('file', ('file.ext', open('file.ext','rb').read(), 'application/script'))]

response = falcon.RTR_CreatePut_Files(comments_for_audit_log="string",
                                      description="string",
                                      name="string",
                                      files=file_upload
                                      )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PAYLOAD = {
    "description": "string",
    "name": "string",
    "comments_for_audit_log": "string"
}

file_upload = [('file', ('file.ext', open('file.ext','rb').read(), 'application/script'))]

response = falcon.command("RTR_CreatePut_Files", data=PAYLOAD, files=file_upload)
print(response)

RTR_DeletePut_Files

Delete a put-file based on the ID given. Can only delete one file at a time.

PEP8 method name

delete_put_files

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Datatype	Description
ids			query	string or list of strings	File IDs.
parameters			query	string	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_put_files(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RTR_DeletePut_Files(ids=id_list)
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("RTR_DeletePut_Files", ids=id_list)
print(response)

RTR_GetScripts

Get custom-scripts based on the ID's given. These are used for the RTR runscript command.

PEP8 method name

get_scripts

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Datatype	Description
ids			query	string or list of strings	File IDs.
parameters			query	string	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_scripts(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RTR_GetScripts(ids=id_list)
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("RTR_GetScripts", ids=id_list)
print(response)

RTR_CreateScripts

Upload a new custom-script to use for the RTR runscript command.

PEP8 method name

create_scripts

Content-Type

• Consumes: multipart/form-data
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Datatype	Description
comments_for_audit_log			formData	string	A descriptive comment for the audit log.
content			formData	string	The text contents you want to use for the script. Takes place of a file upload.
data			formData	file	Full formData payload in JSON format.
description			formData	string	File description.
name			formData	string	File name (if different than actual file name).
permission_type			formData	string	Permissions for the custom-script. Valid permission values include: private - usable only by the user who upload it group - usable by all RTR admins public - usable by all active-responders and RTR admins
platform			formData	list of strings	Platform for the script. Currently supports windows, mac, and linux. If no platform is provided, windows is assumed.
files			query	list of tuples	File(s) to be uploaded.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

file_upload = [('file', ('file.ext', open('file.ext','rb').read(), 'application/script'))]

response = falcon.create_scripts(comments_for_audit_log="string",
                                 description="string",
                                 name="string",
                                 files=file_upload,
                                 platform=["string"],
                                 permission_type="string",
                                 content="string"
                                 )
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

file_upload = [('file', ('file.ext', open('file.ext','rb').read(), 'application/script'))]

response = falcon.RTR_CreateScripts(comments_for_audit_log="string",
                                    description="string",
                                    name="string",
                                    files=file_upload,
                                    platform=["string"],
                                    permission_type="string",
                                    content="string"
                                    )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PAYLOAD = {
    "description": "string",
    "name": "string",
    "comments_for_audit_log": "string",
    "permission_type": "string",
    "content": "string",
    "platform": [
       "string",
       "string"
    ]
}

file_upload = [('file', ('file.ext', open('file.ext','rb').read(), 'application/script'))]

response = falcon.command("RTR_CreateScripts", data=PAYLOAD, files=file_upload)
print(response)

RTR_DeleteScripts

Delete a custom-script based on the ID given. Can only delete one script at a time.

PEP8 method name

delete_scripts

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Datatype	Description
ids			query	string or list of strings	File IDs.
parameters			query	string	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_scripts(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RTR_DeleteScripts(ids=id_list)
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("RTR_DeleteScripts", ids=id_list)
print(response)

RTR_UpdateScripts

Upload a new scripts to replace an existing one.

PEP8 method name

update_scripts

Content-Type

• Consumes: multipart/form-data
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Datatype	Description
comments_for_audit_log			formData	string	A descriptive comment for the audit log.
content			formData	string	The text contents you want to use for the script. Takes place of a file upload.
data			formData	file	Full formData payload in JSON format.
description			formData	string	File description.
id			formData	string	The ID of the script to be updated.
name			formData	string	File name (if different than actual file name).
permission_type			formData	string	Permissions for the custom-script. Valid permission values include: private - usable only by the user who upload it group - usable by all RTR admins public - usable by all active-responders and RTR admins
platform			formData	list of strings	Platform for the script. Currently supports windows, mac, and linux. If no platform is provided, windows is assumed.
files			query	list of tuples	File(s) to be uploaded.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

file_upload = [('file', ('file.ext', open('file.ext','rb').read(), 'application/script'))]

response = falcon.update_scripts(comments_for_audit_log="string",
                                 description="string",
                                 id="string",
                                 name="string",
                                 files=file_upload,
                                 platform=["string"],
                                 permission_type="string",
                                 content="string"
                                 )
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

file_upload = [('file', ('file.ext', open('file.ext','rb').read(), 'application/script'))]

response = falcon.RTR_UpdateScripts(comments_for_audit_log="string",
                                    description="string",
                                    id="string",
                                    name="string",
                                    files=file_upload,
                                    platform=["string"],
                                    permission_type="string",
                                    content="string"
                                    )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PAYLOAD = {
    "id": "string",
    "description": "string",
    "name": "string",
    "comments_for_audit_log": "string",
    "permission_type": "string",
    "content": "string",
    "platform": [
       "string",
       "string"
    ]
}

file_upload = [('file', ('file.ext', open('file.ext','rb').read(), 'application/script'))]

response = falcon.command("RTR_UpdateScripts", data=PAYLOAD, files=file_upload)
print(response)

RTR_ListPut_Files

Get a list of put-file ID's that are available to the user for the put command.

PEP8 method name

list_put_files

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Datatype	Description
filter			query	string	FQL query expression that should be used to limit the results. user_id can accept a special value ‘@me’ which will restrict results to records with current user’s ID.
limit			query	integer	Maximum number of records to return.
offset			query	string	Starting index of overall result set from which to return ids.
sort			query	string	The property to sort by.
parameters			query	string	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

response = falcon.list_put_files(filter="string",
                                 offset="string",
                                 limit=integer,
                                 sort="string"
                                 )
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

response = falcon.RTR_ListPut_Files(filter="string",
                                    offset="string",
                                    limit=integer,
                                    sort="string"
                                    )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

response = falcon.command("RTR_ListPut_Files",
                          filter="string",
                          offset="string",
                          limit=integer,
                          sort="string"
                          )
print(response)

RTR_ListScripts

Get a list of custom-script ID's that are available to the user for the runscript command.

PEP8 method name

list_scripts

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Datatype	Description
filter			query	string	FQL query expression that should be used to limit the results. user_id can accept a special value ‘@me’ which will restrict results to records with current user’s ID.
limit			query	integer	Maximum number of records to return.
offset			query	string	Starting index of overall result set from which to return ids.
sort			query	string	The property to sort by.
parameters			query	string	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

response = falcon.list_scripts(filter="string",
                               offset="string",
                               limit=integer,
                               sort="string"
                               )
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

response = falcon.RTR_ListScripts(filter="string",
                                  offset="string",
                                  limit=integer,
                                  sort="string"
                                  )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

response = falcon.command("RTR_ListScripts",
                          filter="string",
                          offset="string",
                          limit=integer,
                          sort="string"
                          )
print(response)