Firewall Management

Using the Firewall Management service collection

Uber class support Service class support Documentation Version

Name	Type	Data type	Description
body	body	string	Full body payload in JSON format.
date_ranges	body	list of dictionaries
field	body	string
filter	body	string	FQL syntax
interval	body	string
min_doc_count	body	integer	Minimum number of documents required to match.
missing	body	string
name	body	string
q	body	string	FQL syntax
ranges	body	list of dictionaries
size	body	integer
sort	body	string	FQL syntax
time_zone	body	string
type	body	string

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import FirewallManagement

falcon = FirewallManagement(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.aggregate_events(date_ranges=date_ranges,
                                   field="string",
                                   filter="string",
                                   interval="string",
                                   min_doc_count=integer,
                                   missing="string",
                                   name="string",
                                   q="string",
                                   ranges=ranges,
                                   size=integer,
                                   sort="string",
                                   time_zone="string",
                                   type="string"
                                   )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

BODY = [{
    "date_ranges": date_ranges,
    "field": "string",
    "filter": "string",
    "interval": "string",
    "min_doc_count": 0,
    "missing": "string",
    "name": "string",
    "q": "string",
    "ranges": ranges,
    "size": 0,
    "sort": "string",
    "sub_aggregates": [
        null
    ],
    "time_zone": "string",
    "type": "string"
}]

response = falcon.command("aggregate_events", body=BODY)
print(response)

aggregate_policy_rules

Aggregate rules within a policy for customer

PEP8 method name

aggregate_policy_rules

Content-Type

Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
body	body	string	Full body payload in JSON format.
date_ranges	body	list of dictionaries
field	body	string
filter	body	string	FQL syntax
interval	body	string
min_doc_count	body	integer	Minimum number of documents required to match.
missing	body	string
name	body	string
q	body	string	FQL syntax
ranges	body	list of dictionaries
size	body	integer
sort	body	string	FQL syntax
time_zone	body	string
type	body	string

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import FirewallManagement

falcon = FirewallManagement(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.aggregate_policy_rules(date_ranges=date_ranges,
                                         field="string",
                                         filter="string",
                                         interval="string",
                                         min_doc_count=integer,
                                         missing="string",
                                         name="string",
                                         q="string",
                                         ranges=ranges,
                                         size=integer,
                                         sort="string",
                                         time_zone="string",
                                         type="string"
                                         )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

BODY = [{
    "date_ranges": date_ranges,
    "field": "string",
    "filter": "string",
    "interval": "string",
    "min_doc_count": 0,
    "missing": "string",
    "name": "string",
    "q": "string",
    "ranges": ranges,
    "size": 0,
    "sort": "string",
    "sub_aggregates": [
        null
    ],
    "time_zone": "string",
    "type": "string"
}]

response = falcon.command("aggregate_policy_rules", body=BODY)
print(response)

aggregate_rule_groups

Aggregate rule groups for customer

PEP8 method name

aggregate_rule_groups

Content-Type

Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
body	body	string	Full body payload in JSON format.
date_ranges	body	list of dictionaries
field	body	string
filter	body	string	FQL syntax
interval	body	string
min_doc_count	body	integer	Minimum number of documents required to match.
missing	body	string
name	body	string
q	body	string	FQL syntax
ranges	body	list of dictionaries
size	body	integer
sort	body	string	FQL syntax
time_zone	body	string
type	body	string

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import FirewallManagement

falcon = FirewallManagement(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.aggregate_rule_groups(date_ranges=date_ranges,
                                        field="string",
                                        filter="string",
                                        interval="string",
                                        min_doc_count=integer,
                                        missing="string",
                                        name="string",
                                        q="string",
                                        ranges=ranges,
                                        size=integer,
                                        sort="string",
                                        time_zone="string",
                                        type="string"
                                        )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

BODY = [{
    "date_ranges": date_ranges,
    "field": "string",
    "filter": "string",
    "interval": "string",
    "min_doc_count": 0,
    "missing": "string",
    "name": "string",
    "q": "string",
    "ranges": ranges,
    "size": 0,
    "sort": "string",
    "sub_aggregates": [
        null
    ],
    "time_zone": "string",
    "type": "string"
}]

response = falcon.command("aggregate_rule_groups", body=BODY)
print(response)

aggregate_rules

Aggregate rules for customer

PEP8 method name

aggregate_rules

Content-Type

Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
body	body	string	Full body payload in JSON format.
date_ranges	body	list of dictionaries
field	body	string
filter	body	string	FQL syntax
interval	body	string
min_doc_count	body	integer	Minimum number of documents required to match.
missing	body	string
name	body	string
q	body	string	FQL syntax
ranges	body	list of dictionaries
size	body	integer
sort	body	string	FQL syntax
time_zone	body	string
type	body	string

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import FirewallManagement

falcon = FirewallManagement(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.aggregate_rules(date_ranges=date_ranges,
                                  field="string",
                                  filter="string",
                                  interval="string",
                                  min_doc_count=integer,
                                  missing="string",
                                  name="string",
                                  q="string",
                                  ranges=ranges,
                                  size=integer,
                                  sort="string",
                                  time_zone="string",
                                  type="string"
                                  )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

BODY = [{
    "date_ranges": date_ranges,
    "field": "string",
    "filter": "string",
    "interval": "string",
    "min_doc_count": 0,
    "missing": "string",
    "name": "string",
    "q": "string",
    "ranges": ranges,
    "size": 0,
    "sort": "string",
    "sub_aggregates": [
        null
    ],
    "time_zone": "string",
    "type": "string"
}]

response = falcon.command("aggregate_rules", body=BODY)
print(response)

get_events

Get events entities by ID and optionally version

PEP8 method name

get_events

Content-Type

Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
ids			query	string or list of strings	The events to retrieve, identified by ID.
parameters			query	string	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import FirewallManagement

falcon = FirewallManagement(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_events(ids=id_list)
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_events", ids=id_list)
print(response)

get_firewall_fields

Get the firewall field specifications by ID

PEP8 method name

get_firewall_fields

Content-Type

Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
ids			query	string or list of strings	The rule types to retrieve, identified by ID.
parameters			query	string	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import FirewallManagement

falcon = FirewallManagement(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_firewall_fields(ids=id_list)
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_firewall_fields", ids=id_list)
print(response)

get_platforms

Get platforms by ID, e.g., windows or mac or droid

PEP8 method name

get_platforms

Content-Type

Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
ids			query	string or list of strings	The platforms to retrieve, identified by ID.
parameters			query	string	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import FirewallManagement

falcon = FirewallManagement(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_platforms(ids=id_list)
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_platforms", ids=id_list)
print(response)

get_policy_containers

Get policy container entities by policy ID

PEP8 method name

get_policy_containers

Content-Type

Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
ids			query	string or list of strings	The policy container(s) to retrieve, identified by policy ID.
parameters			query	string	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import FirewallManagement

falcon = FirewallManagement(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_policy_containers(ids=id_list)
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_policy_containers", ids=id_list)
print(response)

update_policy_container

Update an identified policy container

PEP8 method name

update_policy_container

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
body	body	string	Full body payload in JSON format.
default_inbound	body	string	Default inbound.
default_outbound	body	string	Default outbound.
enforce	body	boolean	Enforcement flag.
is_default_policy	body	boolean	Default policy flag.
platform_id	body	string	ID of the platform this policy container.
policy_id	body	string	Policy ID to apply to this container.
rule_group_ids	body	string or list of strings	Rule group IDs to include in this container.
test_mode	body	boolean	Flag indicating if this container is in test mode.
tracking	body	string	Tracking.

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import FirewallManagement

falcon = FirewallManagement(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

rule_groups = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_policy_container(default_inbound="string",
                                          default_outbound="string",
                                          enforce=boolean,
                                          is_default_policy=boolean,
                                          platform_id="string",
                                          policy_id="string",
                                          rule_group_ids=rule_groups,
                                          test_mode=boolean,
                                          tracking="string"
                                          )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

rule_groups = ['ID1', 'ID2', 'ID3']

BODY = {
    "default_inbound": "string",
    "default_outbound": "string",
    "enforce": true,
    "is_default_policy": true,
    "platform_id": "string",
    "policy_id": "string",
    "rule_group_ids": rule_groups,
    "test_mode": true,
    "tracking": "string"
}

response = falcon.command("update_policy_container", body=BODY)
print(response)

get_rule_groups

Get rule group entities by ID. These groups do not contain their rule entites, just the rule IDs in precedence order.

PEP8 method name

get_rule_groups

Content-Type

Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
ids			query	string or list of strings	The ID(s) of the rule group to retrieve.
parameters			query	string	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import FirewallManagement

falcon = FirewallManagement(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rule_groups(ids=id_list)
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_rule_groups", ids=id_list)
print(response)

create_rule_group

Create new rule group on a platform for a customer with a name and description, and return the ID

PEP8 method name

create_rule_group

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
body	body	string	Full body payload in JSON format.
clone_id	query	string	A rule group ID from which to copy rules. If this is provided then the 'rules' property of the body is ignored.
comment	query	string	Comment for this rule group.
description	body	string	Rule group description.
enabled	body	boolean	Flag indicating if the rule group is enabled.
library	query	string	If this flag is set to true then the rules will be cloned from the clone_id from the CrowdStrike Firewal Rule Groups Library.
name	body	string	Rule group name.
parameters	query	string	Full query string parameters payload in JSON format.
rules	body	dictionary or list of dictionaries	Rule(s) in JSON format.

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import FirewallManagement

falcon = FirewallManagement(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

new_rule = {
    "action": "string",
    "address_family": "string",
    "description": "string",
    "direction": "string",
    "enabled": boolean,
    "fields": [
        {
            "final_value": "string",
            "label": "string",
            "name": "string",
            "type": "string",
            "value": "string",
            "values": [
                "string"
            ]
        }
    ],
    "icmp": {
        "icmp_code": "string",
        "icmp_type": "string"
    },
    "local_address": [
        {
            "address": "string",
            "netmask": integer
        }
    ],
    "local_port": [
        {
            "end": integer,
            "start": integer
        }
    ],
    "log": boolean,
    "monitor": {
        "count": "string",
        "period_ms": "string"
    },
    "name": "string",
    "platform_ids": [
        "string"
    ],
    "protocol": "string",
    "remote_address": [
        {
            "address": "string",
            "netmask": integer
        }
    ],
    "remote_port": [
        {
            "end": integer,
            "start": integer
        }
    ],
    "temp_id": "string"
}

response = falcon.create_rule_group(clone_id="string",
                                    library="string",
                                    comment="string",
                                    description="string",
                                    enabled=boolean,
                                    name="string",
                                    rules=new_rule
                                    )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

new_rule = {
    "action": "string",
    "address_family": "string",
    "description": "string",
    "direction": "string",
    "enabled": boolean,
    "fields": [
        {
            "final_value": "string",
            "label": "string",
            "name": "string",
            "type": "string",
            "value": "string",
            "values": [
                "string"
            ]
        }
    ],
    "icmp": {
        "icmp_code": "string",
        "icmp_type": "string"
    },
    "local_address": [
        {
            "address": "string",
            "netmask": integer
        }
    ],
    "local_port": [
        {
            "end": integer,
            "start": integer
        }
    ],
    "log": boolean,
    "monitor": {
        "count": "string",
        "period_ms": "string"
    },
    "name": "string",
    "platform_ids": [
        "string"
    ],
    "protocol": "string",
    "remote_address": [
        {
            "address": "string",
            "netmask": integer
        }
    ],
    "remote_port": [
        {
            "end": integer,
            "start": integer
        }
    ],
    "temp_id": "string"
}

BODY = {
    "description": "string",
    "enabled": boolean,
    "name": "string",
    "rules": [new_rule]
}

response = falcon.command("create_rule_group",
                          body=BODY,
                          clone_id="string",
                          library="string",
                          comment="string"
                          )
print(response)

delete_rule_groups

Delete rule group entities by ID

PEP8 method name

delete_rule_groups

Content-Type

Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
comment	query	string or list of strings	Audit log comment for this operation.
ids	query	string or list of strings	The rules to retrieve, identified by ID.
parameters	query	string	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import FirewallManagement

falcon = FirewallManagement(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_rule_groups(comment="string", ids=id_list)
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("delete_rule_groups", comment="string", ids=id_list)
print(response)

update_rule_group

Update name, description, or enabled status of a rule group, or create, edit, delete, or reorder rules

PEP8 method name

update_rule_group

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
body	body	string	Full body payload in JSON format.
comment	query	string	Audit log comment for this action.
diff_operations	body	dictionary or list of dictionaries	Differential operations to perform against the rule group.
diff_type	body	string	Type of diff to apply.
id	body	string	ID of the rule group to update.
parameters	query	string	Full query string parameters payload in JSON format.
rule_ids	body	list of strings	Rule ID(s) to add to the rule group.
rule_versions	body	list of integers	Rule group versions.
tracking	body	string	Tracking.

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import FirewallManagement

falcon = FirewallManagement(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

rules = ['ID1', 'ID2', 'ID3']
versions = [1, 2, 3]
diffs = {
    "from": "string",
    "op": "string",
    "path": "string"
}

response = falcon.update_rule_group(comment="string",
                                    diff_operations=diffs,
                                    diff_type="string",
                                    id="string",
                                    rule_ids=rules,
                                    rule_versions=versions,
                                    tracking="string"
                                    )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

rules = ['ID1', 'ID2', 'ID3']
versions = [1, 2, 3]
diffs = {
    "from": "string",
    "op": "string",
    "path": "string"
}

BODY = {
    "diff_operations": [diffs],
    "diff_type": "string",
    "id": "string",
    "rule_ids": rules,
    "rule_versions": versions,
    "tracking": "string"
}

response = falcon.command("update_rule_group",
                          comments="string",
                          body=BODY
                          )
print(response)

get_rules

Get rule entities by ID (64-bit unsigned int as decimal string) or Family ID (32-character hexadecimal string)

PEP8 method name

get_rules

Content-Type

Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
ids			query	string or list of strings	The rules to retrieve, identified by ID.
parameters			query	string	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import FirewallManagement

falcon = FirewallManagement(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rules(ids=id_list)
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_rules", ids=id_list)
print(response)

query_events

Find all event IDs matching the query with filter

PEP8 method name

query_events

Content-Type

Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
after	query	string	A pagination token used with the `limit` parameter to manage pagination of results. On your first request, don't provide an `after` token. On subsequent requests, provide the `after` token from the previous response to continue from that place in the results. To access more than 10k indicators, use the `after` parameter instead of `offset`.
filter	query	string	FQL Syntax formatted filter that should be used to limit the results.
limit	query	integer	Maximum number of results to return.
offset	query	integer	The offset to start retrieving records from. Offset and After params are mutually exclusive. If none provided then scrolling will be used by default. To access more than 10k iocs, use the `after` parameter instead of `offset`.
parameters	query	string	Full query string parameters payload in JSON format.
q	query	string	Free text search across all indexed fields.
sort	query	string	FQL Syntax formatted sort filter.

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import FirewallManagement

falcon = FirewallManagement(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

response = falcon.query_events(sort="string",
                               filter="string",
                               q="string",
                               offset=integer,
                               after="string",
                               limit=integer
                               )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

response = falcon.command("query_events",
                          sort="string",
                          filter="string",
                          q="string",
                          offset=integer,
                          after="string",
                          limit=integer
                          )
print(response)

query_firewall_fields

Get the firewall field specification IDs for the provided platform

PEP8 method name

query_firewall_fields

Content-Type

Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
limit	query	integer	Maximum number of results to return.
offset	query	integer	The offset to start retrieving records from. Offset and After params are mutually exclusive. If none provided then scrolling will be used by default. To access more than 10k iocs, use the `after` parameter instead of `offset`.
parameters	query	string	Full query string parameters payload in JSON format.
platform_id	query	string	Field configurations specific to this platform.

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import FirewallManagement

falcon = FirewallManagement(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

response = falcon.query_firewall_fields(platform_id="string",
                                        offset=integer,
                                        limit=integer
                                        )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

response = falcon.command("query_firewall_fields", 
                          platform_id="string",
                          limit=integer,
                          offset=integer
                          )
print(response)

query_platforms

Get the list of platform names

PEP8 method name

query_platforms

Content-Type

Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
limit	query	integer	Maximum number of results to return.
offset	query	integer	The offset to start retrieving records from. Offset and After params are mutually exclusive. If none provided then scrolling will be used by default. To access more than 10k iocs, use the `after` parameter instead of `offset`.
parameters	query	string	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import FirewallManagement

falcon = FirewallManagement(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

response = falcon.query_platforms(offset=integer, limit=integer)
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

response = falcon.command("query_platforms", limit=integer, offset=integer)
print(response)

query_policy_rules

Find all firewall rule IDs matching the query with filter, and return them in precedence order

PEP8 method name

query_policy_rules

Content-Type

Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
after	query	string	A pagination token used with the `limit` parameter to manage pagination of results. On your first request, don't provide an `after` token. On subsequent requests, provide the `after` token from the previous response to continue from that place in the results. To access more than 10k indicators, use the `after` parameter instead of `offset`.
filter	query	string	FQL Syntax formatted filter that should be used to limit the results.
id	query	string	The ID of the policy container within which to query.
limit	query	integer	Maximum number of results to return.
offset	query	integer	The offset to start retrieving records from. Offset and After params are mutually exclusive. If none provided then scrolling will be used by default. To access more than 10k iocs, use the `after` parameter instead of `offset`.
parameters	query	string	Full query string parameters payload in JSON format.
q	query	string	Free text search across all indexed fields.
sort	query	string	FQL Syntax formatted sort filter.

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import FirewallManagement

falcon = FirewallManagement(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

response = falcon.query_policy_rules(id="string",
                                     sort="string",
                                     filter="string",
                                     q="string",
                                     offset=integer,
                                     limit=integer,
                                     after="string"
                                     )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

response = falcon.command("query_policy_rules",
                          id="string",
                          sort="string",
                          filter="string",
                          q="string",
                          offset=integer,
                          limit=integer,
                          after="string"
                          )
print(response)

query_rule_groups

Find all rule group IDs matching the query with filter

PEP8 method name

query_rule_groups

Content-Type

Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
after	query	string	A pagination token used with the `limit` parameter to manage pagination of results. On your first request, don't provide an `after` token. On subsequent requests, provide the `after` token from the previous response to continue from that place in the results. To access more than 10k indicators, use the `after` parameter instead of `offset`.
filter	query	string	FQL Syntax formatted filter that should be used to limit the results.
limit	query	integer	Maximum number of results to return.
offset	query	integer	The offset to start retrieving records from. Offset and After params are mutually exclusive. If none provided then scrolling will be used by default. To access more than 10k iocs, use the `after` parameter instead of `offset`.
parameters	query	string	Full query string parameters payload in JSON format.
q	query	string	Free text search across all indexed fields.
sort	query	string	FQL Syntax formatted sort filter.

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import FirewallManagement

falcon = FirewallManagement(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

response = falcon.query_rule_groups(sort="string",
                                    filter="string",
                                    q="string",
                                    offset="string",
                                    after="string",
                                    limit=integer
                                    )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

response = falcon.command("query_rule_groups",
                          sort="string",
                          filter="string",
                          q="string",
                          offset="string",
                          after="string",
                          limit=integer
                          )
print(response)

query_rules

Find all rule IDs matching the query with filter

PEP8 method name

query_rules

Content-Type

Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
after	query	string	A pagination token used with the `limit` parameter to manage pagination of results. On your first request, don't provide an `after` token. On subsequent requests, provide the `after` token from the previous response to continue from that place in the results. To access more than 10k indicators, use the `after` parameter instead of `offset`.
filter	query	string	FQL Syntax formatted filter that should be used to limit the results.
limit	query	integer	Maximum number of results to return.
offset	query	integer	The offset to start retrieving records from. Offset and After params are mutually exclusive. If none provided then scrolling will be used by default. To access more than 10k iocs, use the `after` parameter instead of `offset`.
parameters	query	string	Full query string parameters payload in JSON format.
q	query	string	Free text search across all indexed fields.
sort	query	string	FQL Syntax formatted sort filter.

Usage

Service class example (PEP8 / Operation ID syntax)

from falconpy import FirewallManagement

falcon = FirewallManagement(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

response = falcon.query_rules(sort="string",
                              filter="string",
                              q="string",
                              offset=integer,
                              after="string",
                              limit=integer
                              )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

response = falcon.command("query_rules",
                          sort="string",
                          filter="string",
                          q="string",
                          offset=integer,
                          after="string",
                          limit=integer
                          )
print(response)

Home
Discussions Board
Glossary of Terms
Installation, Upgrades and Removal
Samples Collection
Using FalconPy
API Operations
Service Collections
Documentation Support
- Report broken link
- Report documentation error
CrowdStrike SDKs
- Crimson Falcon - Ruby
- FalconPy - Python 3
- FalconJS - Javascript
- goFalcon - Go
- PSFalcon - Powershell
- Rusty Falcon - Rust

CrowdStrike Falcon

Firewall Management

Using the Firewall Management service collection

Table of Contents

aggregate_events

PEP8 method name

Content-Type

Keyword Arguments

Usage

Service class example (PEP8 / Operation ID syntax)

Uber class example

aggregate_policy_rules

PEP8 method name

Content-Type

Keyword Arguments

Usage

Service class example (PEP8 / Operation ID syntax)

Uber class example

aggregate_rule_groups

PEP8 method name

Content-Type

Keyword Arguments

Usage

Service class example (PEP8 / Operation ID syntax)

Uber class example

aggregate_rules

PEP8 method name

Content-Type

Keyword Arguments

Usage

Service class example (PEP8 / Operation ID syntax)

Uber class example

get_events

PEP8 method name

Content-Type

Keyword Arguments

Usage

Service class example (PEP8 / Operation ID syntax)

Uber class example

get_firewall_fields

PEP8 method name

Content-Type

Keyword Arguments

Usage

Service class example (PEP8 / Operation ID syntax)

Uber class example

get_platforms

PEP8 method name

Content-Type

Keyword Arguments

Usage

Service class example (PEP8 / Operation ID syntax)

Uber class example

get_policy_containers

PEP8 method name

Content-Type

Keyword Arguments

Usage

Service class example (PEP8 / Operation ID syntax)

Uber class example

update_policy_container

PEP8 method name

Content-Type

Keyword Arguments

Usage

Service class example (PEP8 / Operation ID syntax)

Uber class example

get_rule_groups

PEP8 method name

Content-Type

Keyword Arguments

Usage

Service class example (PEP8 / Operation ID syntax)

Uber class example

create_rule_group

PEP8 method name

Content-Type

Keyword Arguments

Usage

Service class example (PEP8 / Operation ID syntax)

Uber class example