forked from CrowdStrike/falconpy
-
Notifications
You must be signed in to change notification settings - Fork 0
Report Executions
jshcodes edited this page Aug 29, 2021
·
30 revisions
Method | Operation ID | Description |
---|---|---|
get_download | report_executions_download_get | Get report entity download |
get_reports | report_executions_get | Retrieve report details for the provided report IDs. |
query_reports | report_executions_query | Find all report execution IDs matching the query with filter |
Get report entity download
- Consumes: application/json
- Produces: application/octet-stream
Required | Name | Type | Datatype | Description |
---|---|---|---|---|
✅ | ids | query | string | The report_execution id to download |
from falconpy.report_executions import ReportExecutions
falcon = ReportExecutions(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_download(ids=id_list)
print(response)
from falconpy.report_executions import ReportExecutions
falcon = ReportExecutions(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.report_executions_download_get(ids=id_list)
print(response)
from falconpy.api_complete import APIHarness
falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("report-executions-download_get", ids=id_list)
print(response)
Retrieve report details for the provided report IDs.
- Consumes: application/json
- Produces: application/json
Required | Name | Type | Datatype | Description |
---|---|---|---|---|
✅ | ids | query | array (string) | The report_execution id to get details about. |
from falconpy.report_executions import ReportExecutions
falcon = ReportExecutions(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_reports(ids=id_list)
print(response)
from falconpy.report_executions import ReportExecutions
falcon = ReportExecutions(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.report_executions_get(ids=id_list)
print(response)
from falconpy.api_complete import APIHarness
falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("report-executions_get", ids=id_list)
print(response)
Find all report execution IDs matching the query with filter
- Consumes: application/json
- Produces: application/json
Required | Name | Type | Datatype | Description |
---|---|---|---|---|
sort | query | string | Possible order by fields: created_on, last_updated_on | |
filter | query | string | FQL query specifying the filter parameters. Filter term criteria: type, scheduled_report_id, status. Filter range criteria: created_on, last_updated_on, expiration_on; use any common date format, such as '2010-05-15T14:55:21.892315096Z'. | |
q | query | string | Match query criteria, which includes all the filter string fields | |
offset | query | string | Starting index of overall result set from which to return ids. | |
limit | query | integer | Number of ids to return. |
from falconpy.report_executions import ReportExecutions
falcon = ReportExecutions(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
response = falcon.query_reports(sort="string",
filter="string",
q="string",
offset="string",
limit=integer
)
print(response)
from falconpy.report_executions import ReportExecutions
falcon = ReportExecutions(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
response = falcon.report_executions_query(sort="string",
filter="string",
q="string",
offset="string",
limit=integer
)
print(response)
from falconpy.api_complete import APIHarness
falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
client_secret="API_CLIENT_SECRET_HERE"
)
PARAMS = {
"sort": "string",
"filter": "string",
"q": "string",
"offset": "string",
"limit": integer
}
response = falcon.command("report-executions_query", parameters=PARAMS)
print(response)
- Home
- Discussions Board
- Glossary of Terms
- Installation, Upgrades and Removal
- Samples Collection
- Using FalconPy
- API Operations
-
Service Collections
- Alerts
- API Integrations
- ASPM
- Certificate Based Exclusions
- Cloud Connect AWS (deprecated)
- Cloud Snapshots
- Compliance Assessments
- Configuration Assessment
- Configuration Assessment Evaluation Logic
- Container Alerts
- Container Detections
- Container Images
- Container Packages
- Container Vulnerabilities
- CSPM Registration
- Custom IOAs
- Custom Storage
- D4C Registration (deprecated)
- DataScanner
- Delivery Settings
- Detects
- Device Control Policies
- Discover
- Downloads
- Drift Indicators
- Event Streams
- Exposure Management
- Falcon Complete Dashboard
- Falcon Container
- Falcon Intelligence Sandbox
- FDR
- FileVantage
- Firewall Management
- Firewall Policies
- Foundry LogScale
- Host Group
- Host Migration
- Hosts
- Identity Protection
- Image Assessment Policies
- Incidents
- Installation Tokens
- Intel
- IOA Exclusions
- IOC
- IOCs (deprecated)
- Kubernetes Protection
- MalQuery
- Message Center
- ML Exclusions
- Mobile Enrollment
- MSSP (Flight Control)
- OAuth2
- ODS (On Demand Scan)
- Overwatch Dashboard
- Prevention Policy
- Quarantine
- Quick Scan
- Quick Scan Pro
- Real Time Response
- Real Time Response Admin
- Real Time Response Audit
- Recon
- Report Executions
- Response Policies
- Sample Uploads
- Scheduled Reports
- Sensor Download
- Sensor Update Policy
- Sensor Usage
- Sensor Visibility Exclusions
- Spotlight Evaluation Logic
- Spotlight Vulnerabilities
- Tailored Intelligence
- ThreatGraph
- Unidentified Containers
- User Management
- Workflows
- Zero Trust Assessment
- Documentation Support
-
CrowdStrike SDKs
- Crimson Falcon - Ruby
- FalconPy - Python 3
- FalconJS - Javascript
- goFalcon - Go
- PSFalcon - Powershell
- Rusty Falcon - Rust