How to get FalconHostLink (detection URL)

[chothazintk]

I'm using falconpy for the detection reports. And we need FalconHostLink (detection URL) whenever there is a new detection.
I've tried GetDetectSummaries but there was no URL link.
Is there any script I can try to get the above information?
And the following is the script I tried.
.............................................
from falconpy import OAuth2
from falconpy import Detects

auth = OAuth2(client_id="CLIENT ID HERE",
client_secret="CLIENT SECRET HERE"
)

detects=Detects(auth_object=auth)

answer = detects.QueryDetects(
offset=0,
limit=1
)["body"]["resources"][0]

#print(answer)

response = detects.GetDetectSummaries(ids=answer,format=json)
print(response)

[jshcodes]

Hi @chothazintk!

The FalconHostLink field is provided as part of the event stream from the Event Streams service collection and is not included within a Detects summary result.

As a workaround, you should have the necessary detail to craft this URL based upon the information you already have.

US-1
Detection ID: ldt:1234567890abcdef123456789:abcdef12
FalconHostLink: https://falcon.crowdstrike.com/activity/detections/detail/1234567890abcdef123456789/abcdef12

US-2
Detection ID: ldt:1234567890abcdef123456789:abcdef12
FalconHostLink: https://falcon.us-2.crowdstrike.com/activity/detections/detail/1234567890abcdef123456789/abcdef12

EU-1
Detection ID: ldt:1234567890abcdef123456789:abcdef12
FalconHostLink: https://falcon.eu-1.crowdstrike.com/activity/detections/detail/1234567890abcdef123456789/abcdef12

US-GOV-1
Detection ID: ldt:1234567890abcdef123456789:abcdef12
FalconHostLink: https://falcon.laggar.gcw.crowdstrike.com/activity/detections/detail/1234567890abcdef123456789/abcdef12

Please note: API credentials were present in your original post. Consider rotating your API credential secret to a new value.

[chothazintk]

Thank you for your information.

I was also trying event stream API, and was able to get the datafeed URL and session token with 'listAvailableStreamsOAuth2'.
But couldn't find any way to connect to the stream and collect the summary result with falconpy.
Do you have any examples for it?

And I changed my API credential too. Thank you for reminding.

[jshcodes]

We sure do! 😄

There is the AWS Security Hub integration example here. (Stream handling begins here.)

There is also our Falcon Integration Gateway example, which can ship data to:

• AWS Security Hub
• Google Security Command Center
• Google Chronicle
• Azure Security Center
• vmWare Workspace One

This solution is container-based, and can be found here. (Stream handling starts here.)

[chothazintk]

Thank you. It really helped a lot.

And although it is not much related to the topic, I just would like to ask one more thing about subscription requirments.
If only Falcon Prevent is subscribed, can we still use API for detection logs?
If we can, how much information can we get, comparing to Falcon prevent with Falcon insight?

[jshcodes]

You can use the API and the Event Streams service collection to access detections that are provided by Prevent (NextGenAV).

Insight would provide you more detections within the Event Stream for things like IOAs, etc.

[chothazintk]

Noted. Thank you so much.