Skip to content

IOA Exclusions

Joshua Hiller edited this page Aug 30, 2021 · 22 revisions

CrowdStrike Falcon Twitter URL

Using the IOA Exclusions service collection

Uber class support Service class support

Table of Contents

Operation ID Description
getIOAExclusionsV1
PEP8 get_exclusions
Get a set of IOA Exclusions by specifying their IDs
createIOAExclusionsV1
PEP8 create_exclusions
Create the IOA exclusions
deleteIOAExclusionsV1
PEP8 delete_exclusions
Delete the IOA exclusions by id
updateIOAExclusionsV1
PEP8 update_exclusions
Update the IOA exclusions
queryIOAExclusionsV1
PEP8 query_exclusions
Search for IOA exclusions.

getIOAExclusionsV1

Get a set of IOA Exclusions by specifying their IDs

PEP8 method name

get_exclusions

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
ids query array (string) The ids of the exclusions to retrieve

Usage

Service class example (PEP8 syntax)
from falconpy.ioa_exclusions import IOAExclusions

falcon = IOAExclusions(client_id="API_CLIENT_ID_HERE",
                       client_secret="API_CLIENT_SECRET_HERE"
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_exclusions(ids=id_list)
print(response)
Service class example (Operation ID syntax)
from falconpy.ioa_exclusions import IOAExclusions

falcon = IOAExclusions(client_id="API_CLIENT_ID_HERE",
                       client_secret="API_CLIENT_SECRET_HERE"
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getIOAExclusionsV1(ids=id_list)
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getIOAExclusionsV1", ids=id_list)
print(response)

createIOAExclusionsV1

Create the IOA exclusions

PEP8 method name

create_exclusions

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
body body string

Usage

Service class example (PEP8 syntax)
from falconpy.ioa_exclusions import IOAExclusions

falcon = IOAExclusions(client_id="API_CLIENT_ID_HERE",
                       client_secret="API_CLIENT_SECRET_HERE"
                       )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.create_exclusions(body=BODY)
print(response)
Service class example (Operation ID syntax)
from falconpy.ioa_exclusions import IOAExclusions

falcon = IOAExclusions(client_id="API_CLIENT_ID_HERE",
                       client_secret="API_CLIENT_SECRET_HERE"
                       )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.createIOAExclusionsV1(body=BODY)
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.command("createIOAExclusionsV1", body=BODY)
print(response)

deleteIOAExclusionsV1

Delete the IOA exclusions by id

PEP8 method name

delete_exclusions

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
ids query array (string) The ids of the exclusions to delete
comment query string Explains why this exclusions was deleted

Usage

Service class example (PEP8 syntax)
from falconpy.ioa_exclusions import IOAExclusions

falcon = IOAExclusions(client_id="API_CLIENT_ID_HERE",
                       client_secret="API_CLIENT_SECRET_HERE"
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_exclusions(comment="string", ids=id_list)
print(response)
Service class example (Operation ID syntax)
from falconpy.ioa_exclusions import IOAExclusions

falcon = IOAExclusions(client_id="API_CLIENT_ID_HERE",
                       client_secret="API_CLIENT_SECRET_HERE"
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteIOAExclusionsV1(comment="string", ids=id_list)
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "comment": "string"
}

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deleteIOAExclusionsV1", parameters=PARAMS, ids=id_list)
print(response)

updateIOAExclusionsV1

Update the IOA exclusions

PEP8 method name

update_exclusions

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
body body string

Usage

Service class example (PEP8 syntax)
from falconpy.ioa_exclusions import IOAExclusions

falcon = IOAExclusions(client_id="API_CLIENT_ID_HERE",
                       client_secret="API_CLIENT_SECRET_HERE"
                       )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.update_exclusions(body=BODY)
print(response)
Service class example (Operation ID syntax)
from falconpy.ioa_exclusions import IOAExclusions

falcon = IOAExclusions(client_id="API_CLIENT_ID_HERE",
                       client_secret="API_CLIENT_SECRET_HERE"
                       )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.updateIOAExclusionsV1(body=BODY)
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.command("updateIOAExclusionsV1", body=BODY)
print(response)

queryIOAExclusionsV1

Search for IOA exclusions.

PEP8 method name

query_exclusions

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
filter query string The filter expression that should be used to limit the results.
offset query integer The offset to start retrieving records from
limit query integer The maximum records to return. [1-500]
sort query string The sort expression that should be used to sort the results.

Usage

Service class example (PEP8 syntax)
from falconpy.ioa_exclusions import IOAExclusions

falcon = IOAExclusions(client_id="API_CLIENT_ID_HERE",
                       client_secret="API_CLIENT_SECRET_HERE"
                       )

response = falcon.query_exclusions(filter="string",
                                   offset=integer,
                                   limit=integer,
                                   sort="string"
                                   )
print(response)
Service class example (Operation ID syntax)
from falconpy.ioa_exclusions import IOAExclusions

falcon = IOAExclusions(client_id="API_CLIENT_ID_HERE",
                       client_secret="API_CLIENT_SECRET_HERE"
                       )

response = falcon.queryIOAExclusionsV1(filter="string",
                                       offset=integer,
                                       limit=integer,
                                       sort="string"
                                       )
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "filter": "string",
    "offset": integer,
    "limit": integer,
    "sort": "string"
}

response = falcon.command("queryIOAExclusionsV1", parameters=PARAMS)
print(response)

CrowdStrike Falcon

Clone this wiki locally