CSPM Registration

Using the CSPM Registration service collection

Uber class support Service class support Documentation Version Page Updated

This service collection has code examples posted to the repository.

WARNING

client_id and client_secret are input variables that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

GetCSPMAwsAccount

Returns information about the current status of an AWS account.

PEP8 method name

get_aws_account

Endpoint

Method	Route
	`/cloud-connect-cspm-aws/entities/account/v1`

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
group_by	query	string	The field to group by.
ids	query	string or list of strings	AWS Account ID(s).
limit	query	integer	Maximum number of results to return. (Default: 100)
offset	query	integer	Starting record position.
organization_ids	query	string or list of strings	AWS Organization ID(s).
parameters	query	dictionary	Full query string parameters payload in JSON format.
scan_type	query	string	Type of scan to perform, `dry` or `full`.
status	query	string	Account status to filter results by.

Usage

Service class example (PEP8 syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

orgs = 'ORG1,ORG2,ORG3'  # Can also pass a list here: ['ORG1', 'ORG2', 'ORG3']

response = falcon.get_aws_account(scan_type="string",
                                  organization_ids=orgs,
                                  status="string",
                                  limit=integer,
                                  offset=integer,
                                  group_by="string",
                                  ids=id_list
                                  )
print(response)

Service class example (Operation ID syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

orgs = 'ORG1,ORG2,ORG3'  # Can also pass a list here: ['ORG1', 'ORG2', 'ORG3']

response = falcon.GetCSPMAwsAccount(scan_type="string",
                                    organization_ids=orgs,
                                    status="string",
                                    limit=integer,
                                    offset=integer,
                                    group_by="string",
                                    ids=id_list
                                    )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

orgs = 'ORG1,ORG2,ORG3'  # Can also pass a list here: ['ORG1', 'ORG2', 'ORG3']

response = falcon.command("GetCSPMAwsAccount",
                          scan_type="string",
                          organization_ids=orgs,
                          status="string",
                          limit=integer,
                          offset=integer,
                          group_by="string",
                          ids=id_list
                          )
print(response)

CreateCSPMAwsAccount

Creates a new account in our system for a customer and generates a script for them to run in their AWS cloud environment to grant us access.

PEP8 method name

create_aws_account

Endpoint

Method	Route
	`/cloud-connect-cspm-aws/entities/account/v1`

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
account_id	body	string	AWS Account ID.
body	body	dictionary	Full body payload in JSON format.
cloudtrail_region	body	string	AWS Cloudtrail Region.
organization_id	body	string	AWS Organization ID.

Usage

Service class example (PEP8 syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.create_aws_account(account_id="string",
                                     cloudtrail_region="string",
                                     organization_id="string"
                                     )
print(response)

Service class example (Operation ID syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.CreateCSPMAwsAccount(account_id="string",
                                       cloudtrail_region="string",
                                       organization_id="string"
                                       )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

BODY = {
    "resources": [
        {
            "account_id": "string",
            "cloudtrail_region": "string",
            "organization_id": "string"
        }
    ]
}

response = falcon.command("CreateCSPMAwsAccount", body=BODY)
print(response)

DeleteCSPMAwsAccount

Deletes an existing AWS account or organization in our system.

PEP8 method name

delete_aws_account

Endpoint

Method	Route
	`/cloud-connect-cspm-aws/entities/account/v1`

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
ids	query	string or list of strings	The AWS account IDs to remove.
organization_ids	query	string or list of strings	The AWS organization ID(s) to delete.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

orgs = 'ORG1,ORG2,ORG3'  # Can also pass a list here: ['ORG1', 'ORG2', 'ORG3']

response = falcon.delete_aws_account(organization_ids=orgs, ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

orgs = 'ORG1,ORG2,ORG3'  # Can also pass a list here: ['ORG1', 'ORG2', 'ORG3']

response = falcon.DeleteCSPMAwsAccount(organization_ids=orgs, ids=id_list)
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

PARAMS = {
    "organization-ids": [
       "string",
       "string"
    ]
}

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

orgs = 'ORG1,ORG2,ORG3'  # Can also pass a list here: ['ORG1', 'ORG2', 'ORG3']

response = falcon.command("DeleteCSPMAwsAccount", organization_ids=orgs, ids=id_list)
print(response)

PatchCSPMAwsAccount

Patches a existing account in our system for a customer.

PEP8 method name

update_aws_account

Endpoint

Method	Route
	`/cloud-connect-cspm-aws/entities/account/v1`

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
account_id	body	string	AWS Account ID.
body	body	dictionary	Full body payload in JSON format.
cloudtrail_region	body	string	AWS Cloudtrail Region.

Usage

Service class example (PEP8 syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.update_aws_account(account_id="string", cloudtrail_region="string")
print(response)

Service class example (Operation ID syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.PatchCSPMAwsAccount(account_id="string", cloudtrail_region="string")
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

BODY = {
    "resources": [
        {
            "account_id": "string",
            "cloudtrail_region": "string"
        }
    ]
}

response = falcon.command("PatchCSPMAwsAccount", body=BODY)
print(response)

GetCSPMAwsConsoleSetupURLs

Return a URL for customer to visit in their cloud environment to grant us access to their AWS environment.

PEP8 method name

get_aws_console_setup_urls

Endpoint

Method	Route
	`/cloud-connect-cspm-aws/entities/console-setup-urls/v1`

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

No keywords or arguments are accepted.

Usage

Service class example (PEP8 syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.get_aws_console_setup_urls()
print(response)

Service class example (Operation ID syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.GetCSPMAwsConsoleSetupURLs()
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("GetCSPMAwsConsoleSetupURLs")
print(response)

GetCSPMAwsAccountScriptsAttachment

Return a script for customer to run in their cloud environment to grant us access to their AWS environment as a downloadable attachment.

PEP8 method name

get_aws_account_scripts_attachment

Endpoint

Method	Route
	`/cloud-connect-cspm-aws/entities/user-scripts-download/v1`

Content-Type

Produces: application/json

Keyword Arguments

No keywords or arguments are accepted.

Usage

Service class example (PEP8 syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.get_aws_account_scripts_attachment()
print(response)

Service class example (Operation ID syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.GetCSPMAwsAccountScriptsAttachment()
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("GetCSPMAwsAccountScriptsAttachment")
print(response)

GetCSPMAzureAccount

Return information about Azure account registration

PEP8 method name

get_azure_account

Endpoint

Method	Route
	`/cloud-connect-azure/entities/account/v1`

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
ids	query	string or list of strings	Subscription ID(s). When empty, all accounts are returned.
limit	query	integer	Maximum number of results to return. (Default: 100)
offset	query	integer	Starting record position.
parameters	query	dictionary	Full query string parameters payload in JSON format.
scan_type	query	string	Type of scan to perform, `dry` or `full`.
status	query	string	Account status to filter results by.

Usage

Service class example (PEP8 syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_azure_account(scan_type="string",
                                    status="string",
                                    limit=integer,
                                    offset=integer,
                                    ids=id_list
                                    )
print(response)

Service class example (Operation ID syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetCSPMAzureAccount(scan_type="string",
                                      status="string",
                                      limit=integer,
                                      offset=integer,
                                      ids=id_list
                                      )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetCSPMAzureAccount",
                          scan_type="string",
                          status="string",
                          limit=integer,
                          offset=integer,
                          ids=id_list
                          )
print(response)

CreateCSPMAzureAccount

Creates a new account in our system for a customer and generates a script for them to run in their cloud environment to grant us access.

PEP8 method name

create_azure_account

Endpoint

Method	Route
	`/cloud-connect-azure/entities/account/v1`

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
subscription_id	body	string	Azure Subscription ID.
tenant_id	body	string	Azure tenant ID.

Usage

Service class example (PEP8 syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.create_azure_account(subscription_id="string", tenant_id="string")
print(response)

Service class example (Operation ID syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.CreateCSPMAzureAccount(subscription_id="string", tenant_id="string")
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

BODY = {
    "resources": [
        {
            "tenant_id": "string",
            "subscription_id": "string"
        }
    ]
}

response = falcon.command("CreateCSPMAzureAccount", body=BODY)
print(response)

DeleteCSPMAzureAccount

Deletes an Azure subscription from the system.

PEP8 method name

delete_azure_account

Endpoint

Method	Route
	`/cloud-connect-cspm-azure/entities/account/v1`

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
ids			query	string or list of strings	Azure subscription IDs to remove.
parameters			query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_azure_account(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteCSPMAzureAccount(ids=id_list)
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteCSPMAzureAccount", ids=id_list)
print(response)

UpdateCSPMAzureAccountClientID

Update an Azure service account in our system by with the user-created client_id created with the public key we've provided

PEP8 method name

update_azure_account_client_id

Endpoint

Method	Route
	`/cloud-connect-azure/entities/client-id/v1`

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
body	body	string	This field is not used. Ignore.
id	query	string or list of strings	The Azure Client ID to use for the Service Principal associated with the Azure account.
tenant_id	query	string or list of strings	The Azure tenant ID to update the Client ID for. Required if multiple tenants are registered.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.update_azure_account_client_id(id="string", tenant_id="string")
print(response)

Service class example (Operation ID syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.UpdateCSPMAzureAccountClientID(id="string", tenant_id="string")
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("UpdateCSPMAzureAccountClientID", id="string", tenant_id="string")
print(response)

UpdateCSPMAzureTenantDefaultSubscriptionID

Update an Azure default subscription_id in our system for given tenant_id

PEP8 method name

update_azure_tenant_default_subscription_id

Endpoint

Method	Route
	`/cloud-connect-cspm-azure/entities/default-subscription-id/v1`

Content-Type

Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
body	body	string	This field is not used. Ignore.
subscription_id	query	string or list of strings	The Azure subscription ID to use as a default for all subscriptions within the tenant.
tenant_id	query	string or list of strings	The Azure tenant ID to update the Client ID for. Required if multiple tenants are registered.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.update_azure_tenant_default_subscription_id(tenant_id="string",
                                                              subscription_id="string"
                                                              )
print(response)

Service class example (Operation ID syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.UpdateCSPMAzureTenantDefaultSubscriptionID(tenant_id="string",
                                                             subscription_id="string"
                                                             )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("UpdateCSPMAzureTenantDefaultSubscriptionID",
                          tenant_id="string",
                          subscription_id="string"
                          )
print(response)

AzureDownloadCertificate

Returns JSON object(s) that contain the base64 encoded certificate for a service principal.

PEP8 method name

azure_download_certificate

Endpoint

Method	Route
	`/cloud-connect-cspm-azure/entities/download-certificate/v1`

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
parameters	query	dictionary	Full query string parameters payload in JSON format.
refresh	query	boolean	Force a refresh of the certificate. Defaults to `False`.
tenant_id	query	string or list of strings	The Azure Client ID to generate script for. Defaults to the most recently registered tenant.

Usage

Service class example (PEP8 syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.azure_download_certificate(refresh=boolean, tenant_id="string")
print(response)

Service class example (Operation ID syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.AzureDownloadCertificate(refresh=boolean, tenant_id="string")
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("AzureDownloadCertificate", refresh=boolean, tenant_id="string")
print(response)

GetCSPMAzureUserScriptsAttachment

Return a script for customer to run in their cloud environment to grant us access to their Azure environment as a downloadable attachment

PEP8 method name

get_azure_user_scripts_attachment

Endpoint

Method	Route
	`/cloud-connect-azure/entities/user-scripts-download/v1`

Content-Type

Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
tenant_id			query	string or list of strings	The Azure tenant ID.
parameters			query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.get_azure_user_scripts_attachment(tenant_id="string")
print(response)

Service class example (Operation ID syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.GetCSPMAzureUserScriptsAttachment(tenant_id="string")
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("GetCSPMAzureUserScriptsAttachment", tenant_id="string")
print(response)

GetBehaviorDetections

Retrieve list of detected behaviors.

PEP8 method name

get_behavior_detections

Endpoint

Method	Route
	`/detects/entities/ioa/v1`

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
account_id	query	string	Cloud account ID (e.g.: AWS AccountID, Azure SubscriptionID).
aws_account_id	query	string	AWS Account ID.
azure_subscription_id	query	string	Azure Subscription ID.
azure_tenant_id	query	string	Azure Tenant ID.
cloud_provider	query	string	Cloud Provider (azure, aws, gcp).
date_time_since	query	string	Filter to retrieve all events after specified date. RFC3339 format. Example: `2006-01-01T12:00:01Z07:00`.
limit	query	integer	Maximum number of results to return. (Max: 500)
next_token	query	string	String to get next page of results, associated with the previous execution. Must include all filters from previous execution.
service	query	string	Filter by Cloud Service. A list of available services can be found here.
severity	query	string	Filter by severity. Example: `High`, `Medium` or `Informational`.
state	query	string	Filter by state. Example: `open` or `closed`.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Available Services


ACM	Identity
ACR	KMS
Any	KeyVault
App Engine	Kinesis
BigQuery	Kubernetes
Cloud Load Balancing	Lambda
Cloud Logging	LoadBalancer
Cloud SQL	Monitor
Cloud Storage	NLB/ALB
CloudFormation	NetworkSecurityGroup
CloudTrail	PostgreSQL
CloudWatch Logs	RDS
Cloudfront	Redshift
Compute Engine	S3
Config	SES
Disk	SNS
DynamoDB	SQLDatabase
EBS	SQLServer
EC2	SQS
ECR	SSM
EFS	Serverless Application Repository
EKS	StorageAccount
ELB	Subscriptions
EMR	VPC
Elasticache	VirtualMachine
GuardDuty	VirtualNetwork
IAM

Usage

Service class example (PEP8 syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.get_behavior_detections(account_id="string",
                                          aws_account_id="string",
                                          azure_subscription_id="string",
                                          azure_tenant_id="string",
                                          cloud_provider="string",
                                          date_time_since="string",
                                          limit=integer,
                                          next_token="string",
                                          service="string",
                                          severity="string",
                                          state="string"
                                          )
print(response)

Service class example (Operation ID syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.GetBehaviorDetections(account_id="string",
                                        aws_account_id="string",
                                        azure_subscription_id="string",
                                        azure_tenant_id="string",
                                        cloud_provider="string",
                                        date_time_since="string",
                                        limit=integer,
                                        next_token="string",
                                        service="string",
                                        severity="string",
                                        state="string"
                                        )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("GetBehaviorDetections",
                          account_id="string",
                          aws_account_id="string",
                          azure_subscription_id="string",
                          azure_tenant_id="string",
                          cloud_provider="string",
                          date_time_since="string",
                          limit=integer,
                          next_token="string",
                          service="string",
                          severity="string",
                          state="string"
                          )
print(response)

GetConfigurationDetections

Retrieve list of detected behaviors.

PEP8 method name

get_configuration_detections

Endpoint

Method	Route
	`/detects/entities/iom/v1`

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
account_id	query	string	Cloud account ID (e.g.: AWS AccountID, Azure SubscriptionID).
aws_account_id	query	string	AWS Account ID.
azure_subscription_id	query	string	Azure Subscription ID.
azure_tenant_id	query	string	Azure Tenant ID.
cloud_provider	query	string	Cloud Provider (azure, aws, gcp).
limit	query	integer	Maximum number of results to return. (Max: 500)
next_token	query	string	String to get next page of results, associated with the previous execution. Must include all filters from previous execution.
region	query	string	Cloud Provider Region. Example: `us-east-1`.
service	query	string	Filter by Cloud Service. A list of available services can be found here.
severity	query	string	Filter by severity. Example: `High`, `Medium` or `Informational`.
status	query	string	Filter by status. Example: `new`, `reoccurring` or `all`.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Available Services


ACM	Identity
ACR	KMS
Any	KeyVault
App Engine	Kinesis
BigQuery	Kubernetes
Cloud Load Balancing	Lambda
Cloud Logging	LoadBalancer
Cloud SQL	Monitor
Cloud Storage	NLB/ALB
CloudFormation	NetworkSecurityGroup
CloudTrail	PostgreSQL
CloudWatch Logs	RDS
Cloudfront	Redshift
Compute Engine	S3
Config	SES
Disk	SNS
DynamoDB	SQLDatabase
EBS	SQLServer
EC2	SQS
ECR	SSM
EFS	Serverless Application Repository
EKS	StorageAccount
ELB	Subscriptions
EMR	VPC
Elasticache	VirtualMachine
GuardDuty	VirtualNetwork
IAM

Usage

Service class example (PEP8 syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.get_configuration_detections(account_id="string",
                                               aws_account_id="string",
                                               azure_subscription_id="string",
                                               azure_tenant_id="string",
                                               cloud_provider="string",
                                               limit=integer,
                                               next_token="string",
                                               region="string,
                                               service="string",
                                               severity="string",
                                               status="string"
                                               )
print(response)

Service class example (Operation ID syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.GetConfigurationDetections(account_id="string",
                                             aws_account_id="string",
                                             azure_subscription_id="string",
                                             azure_tenant_id="string",
                                             cloud_provider="string",
                                             limit=integer,
                                             next_token="string",
                                             region="string",
                                             service="string",
                                             severity="string",
                                             status="string"
                                             )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("GetConfigurationDetections",
                          account_id="string",
                          aws_account_id="string",
                          azure_subscription_id="string",
                          azure_tenant_id="string",
                          cloud_provider="string",
                          limit=integer,
                          next_token="string",
                          region="string",
                          service="string",
                          severity="string",
                          status="string"
                          )
print(response)

GetIOAEvents

For CSPM IOA events, gets list of IOA events.

PEP8 method name

get_ioa_events

Endpoint

Method	Route
	`/ioa/entities/events/v1`

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
account_id	query	string	Cloud account ID (e.g.: AWS AccountID, Azure SubscriptionID).
aws_account_id	query	string	AWS Account ID.
azure_subscription_id	query	string	Azure Subscription ID.
azure_tenant_id	query	string	Azure Tenant ID.
cloud_provider	query	string	Cloud Provider (azure, aws, gcp).
limit	query	integer	Maximum number of results to return. (Max: 500)
offset	query	integer	Starting record position.
parameters	query	dictionary	Full query string parameters payload in JSON format.
policy_id	query	string	IOA Policy ID.
state	query	string	Filter by account state.
user_ids	query	string or list of strings	User ID(s).

Usage

Service class example (PEP8 syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_ioa_events(policy_id="string",
                                 cloud_provider="string",
                                 account_id="string",
                                 aws_account_id="string",
                                 azure_subscription_id="string",
                                 azure_tenant_id="string",
                                 user_ids=id_list,
                                 state="string",
                                 offset=integer,
                                 limit=integer
                                 )
print(response)

Service class example (Operation ID syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetIOAEvents(policy_id="string",
                               cloud_provider="string",
                               account_id="string",
                               aws_account_id="string",
                               azure_subscription_id="string",
                               azure_tenant_id="string",
                               user_ids=id_list,
                               state="string",
                               offset=integer,
                               limit=integer
                               )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetIOAEvents",
                          policy_id="string",
                          cloud_provider="string",
                          account_id="string",
                          aws_account_id="string",
                          azure_subscription_id="string",
                          azure_tenant_id="string",
                          user_ids=id_list,
                          state="string",
                          offset=integer,
                          limit=integer
                          )
print(response)

GetIOAUsers

For CSPM IOA users, gets list of IOA users.

PEP8 method name

get_ioa_users

Endpoint

Method	Route
	`/ioa/entities/users/v1`

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
account_id	query	string	Cloud account ID (e.g.: AWS AccountID, Azure SubscriptionID).
aws_account_id	query	string	AWS Account ID.
azure_subscription_id	query	string	Azure Subscription ID.
azure_tenant_id	query	string	Azure Tenant ID.
cloud_provider	query	string	Cloud Provider (azure, aws, gcp).
parameters	query	dictionary	Full query string parameters payload in JSON format.
policy_id	query	string	IOA Policy ID.
state	query	string	Filter by account state.

Usage

Service class example (PEP8 syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.get_ioa_users(policy_id="string",
                                state="string",
                                cloud_provider="string",
                                account_id="string",
                                aws_account_id="string",
                                azure_subscription_id="string",
                                azure_tenant_id="string"
                                )
print(response)

Service class example (Operation ID syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.GetIOAUsers(policy_id="string",
                              state="string",
                              cloud_provider="string",
                              account_id="string",
                              aws_account_id="string",
                              azure_subscription_id="string",
                              azure_tenant_id="string"
                              )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("GetIOAUsers",
                          policy_id="string",
                          state="string",
                          cloud_provider="string",
                          account_id="string",
                          aws_account_id="string",
                          azure_subscription_id="string",
                          azure_tenant_id="string"
                          )
print(response)

GetCSPMPolicy

Given a policy ID, returns detailed policy information.

PEP8 method name

get_policy

Endpoint

Method	Route
	`/settings/entities/policy-details/v1`

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
ids			query	string or list of strings	Policy IDs to retrieve.
parameters			query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_policy(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetCSPMPolicy(ids=id_list)
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetCSPMPolicy", ids=id_list)
print(response)

GetCSPMPolicySettings

Returns information about current policy settings.

PEP8 method name

get_policy_settings

Endpoint

Method	Route
	`/settings/entities/policy/v1`

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
cloud_platform	query	string	Cloud Provider (azure, aws, gcp).
parameters	query	dictionary	Full query string parameters payload in JSON format.
policy_id	query	string	IOA Policy ID.
service	query	string	Filter by Service type.

Usage

Service class example (PEP8 syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.get_policy_settings(service="string",
                                      policy_id="string",
                                      cloud_platform="string"
                                      )
print(response)

Service class example (Operation ID syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.GetCSPMPolicySettings(service="string",
                                        policy_id="string",
                                        cloud_platform="string"
                                        )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("GetCSPMPolicySettings",
                          service="string",
                          policy_id="string",
                          cloud_platform="string"
                          )
print(response)

UpdateCSPMPolicySettings

Updates a policy setting - can be used to override policy severity or to disable a policy entirely.

PEP8 method name

update_policy_settings

Endpoint

Method	Route
	`/settings/entities/policy/v1`

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
account_id	body	string	Cloud Account ID to impact.
body	body	dictionary	Full body payload in JSON format.
enabled	body	boolean	Flag indicating if this policy is enabled.
policy_id	body	integer	Policy ID to be updated.
regions	body	string or list of strings	List of regions where this policy is enforced.
severity	body	string	Policy severity value.
tag_excluded	body	boolean	Tag exclusion flag.

Usage

Service class example (PEP8 syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

region_list = 'REG1,REG2,REG3'  # Can also pass a list here: ['REG1', 'REG2', 'REG3']

response = falcon.update_policy_settings(account_id="string",
                                         enabled=boolean,
                                         policy_id=integer,
                                         regions=region_list
                                         severity="string",
                                         tag_excluded=boolean
                                         )
print(response)

Service class example (Operation ID syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

region_list = 'REG1,REG2,REG3'  # Can also pass a list here: ['REG1', 'REG2', 'REG3']

response = falcon.UpdateCSPMPolicySettings(account_id="string",
                                           enabled=boolean,
                                           policy_id=integer,
                                           regions=region_list
                                           severity="string",
                                           tag_excluded=boolean
                                           )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

BODY = {
    "resources": [
        {
        "account_id": "string",
        "enabled": boolean,
        "policy_id": integer,
        "regions": [
            "string"
        ],
        "severity": "string",
        "tag_excluded": boolean
        }
    ]
}

response = falcon.command("UpdateCSPMPolicySettings", body=BODY)
print(response)

GetCSPMScanSchedule

Returns scan schedule configuration for one or more cloud platforms.

PEP8 method name

get_scan_schedule

Endpoint

Method	Route
	`/settings/scan-schedule/v1`

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
cloud_platform			query	string or list of strings	The Cloud Platform. (`Azure`, `AWS`, `GCP`)
parameters			query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

clouds = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_scan_schedule(cloud_platform=clouds)
print(response)

Service class example (Operation ID syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

clouds = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetCSPMScanSchedule(cloud_platform=clouds)
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

clouds = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetCSPMScanSchedule", cloud_platform=clouds)
print(response)

UpdateCSPMScanSchedule

Updates scan schedule configuration for one or more cloud platforms.

PEP8 method name

update_scan_schedule

Endpoint

Method	Route
	`/settings/scan-schedule/v1`

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
cloud_platform	body	string	Cloud platform (Azure, AWS, GCP).
next_scan_timestamp	body	string	UTC formatted string.
scan_schedule	body	string	Scan schedule type.

Usage

Service class example (PEP8 syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.update_scan_schedule(cloud_platform="string",
                                       next_scan_timestampt="string",
                                       scan_schedule="string"
                                       )
print(response)

Service class example (Operation ID syntax)

from falconpy import CSPMRegistration

# Do not hardcode API credentials!
falcon = CSPMRegistration(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.UpdateCSPMScanSchedule(cloud_platform="string",
                                         next_scan_timestampt="string",
                                         scan_schedule="string"
                                         )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

BODY = {
    "resources": [
        {
            "cloud_platform": "string",
            "next_scan_timestamp": "2021-10-25T05:22:27.365Z",
            "scan_schedule": "string"
        }
    ]
}

response = falcon.command("UpdateCSPMScanSchedule", body=BODY)
print(response)

Home
Discussions Board
Glossary of Terms
Installation, Upgrades and Removal
Samples Collection
Using FalconPy
API Operations
Service Collections
Documentation Support
- Report broken link
- Report documentation error
CrowdStrike SDKs
- Crimson Falcon - Ruby
- FalconPy - Python 3
- FalconJS - Javascript
- goFalcon - Go
- PSFalcon - Powershell
- Rusty Falcon - Rust

CrowdStrike Falcon

CSPM Registration

Using the CSPM Registration service collection

Table of Contents

Passing credentials

GetCSPMAwsAccount

PEP8 method name

Endpoint

Content-Type

Keyword Arguments

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

CreateCSPMAwsAccount

PEP8 method name

Endpoint

Content-Type

Keyword Arguments

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

DeleteCSPMAwsAccount

PEP8 method name

Endpoint

Content-Type

Keyword Arguments

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

PatchCSPMAwsAccount

PEP8 method name

Endpoint

Content-Type

Keyword Arguments

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

GetCSPMAwsConsoleSetupURLs

PEP8 method name

Endpoint

Content-Type

Keyword Arguments

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

GetCSPMAwsAccountScriptsAttachment

PEP8 method name

Endpoint

Content-Type

Keyword Arguments

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

GetCSPMAzureAccount

PEP8 method name

Endpoint

Content-Type

Keyword Arguments

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

CreateCSPMAzureAccount

PEP8 method name

Endpoint

Content-Type

Keyword Arguments

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

DeleteCSPMAzureAccount

PEP8 method name

Endpoint

Content-Type