Skip to content

IOA Exclusions

Joshua Hiller edited this page Apr 17, 2021 · 22 revisions

CrowdStrike Falcon Twitter URL

Using the IOA Exclusions service collection

Uber class support Uber class support

Table of Contents

API Function Description
getIOAExclusionsV1 Get a set of IOA Exclusions by specifying their IDs
createIOAExclusionsV1 Create the IOA exclusions
deleteIOAExclusionsV1 Delete the IOA exclusions by id
updateIOAExclusionsV1 Update the IOA exclusions
queryIOAExclusionsV1 Search for IOA exclusions.

getIOAExclusionsV1

Get a set of IOA Exclusions by specifying their IDs

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
ids query array (string) The ids of the exclusions to retrieve

Usage

Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

IDS = 'ID1,ID2,ID3'

response = falcon.command('getIOAExclusionsV1', ids=IDS)
print(response)
falcon.deauthenticate()

createIOAExclusionsV1

Create the IOA exclusions

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
body body string

Usage

Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

BODY = {
    'Body Payload': 'See body description above'
}

response = falcon.command('createIOAExclusionsV1', body=BODY)
print(response)
falcon.deauthenticate()

deleteIOAExclusionsV1

Delete the IOA exclusions by id

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
ids query array (string) The ids of the exclusions to delete
comment query string Explains why this exclusions was deleted

Usage

Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

PARAMS = {
    'comment': 'string'
}

IDS = 'ID1,ID2,ID3'

response = falcon.command('deleteIOAExclusionsV1', parameters=PARAMS, ids=IDS)
print(response)
falcon.deauthenticate()

updateIOAExclusionsV1

Update the IOA exclusions

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
body body string

Usage

Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

BODY = {
    'Body Payload': 'See body description above'
}

response = falcon.command('updateIOAExclusionsV1', body=BODY)
print(response)
falcon.deauthenticate()

queryIOAExclusionsV1

Search for IOA exclusions.

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
filter query string The filter expression that should be used to limit the results.
offset query integer The offset to start retrieving records from
limit query integer The maximum records to return. [1-500]
sort query string The sort expression that should be used to sort the results.

Usage

Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

PARAMS = {
    'filter': 'string',
    'offset': integer,
    'limit': integer,
    'sort': 'string'
}

response = falcon.command('queryIOAExclusionsV1', parameters=PARAMS)
print(response)
falcon.deauthenticate()

CrowdStrike Falcon

Clone this wiki locally