Skip to content

Identity Protection

Joshua Hiller edited this page Dec 11, 2021 · 15 revisions

CrowdStrike Falcon Twitter URL

Using the Identity Protection service collection

Uber class support Service class support Documentation Version

Table of Contents

Operation ID Description
api_preempt_proxy_post_graphql
PEP 8 graphql
Identity Protection GraphQL API. Allows to retrieve entities, timeline activities, identity-based incidents and security assessment. Allows to perform actions on entities and identity-based incidents.

api_preempt_proxy_post_graphql

Identity Protection GraphQL API. Allows to retrieve entities, timeline activities, identity-based incidents and security assessment. Allows to perform actions on entities and identity-based incidents.

PEP8 method name

graphql

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
body
Service Class Support

Uber Class Support
body string Full BODY payload in JSON format.
query
Service Class Support

Uber Class Support
body string JSON-similar formatted query to perform.

Usage

Service class example (PEP8 syntax)
from falconpy import IdentityProtection

falcon = IdentityProtection(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

idp_query = "{\n  entities(first: 1)\n  {\n    nodes {\n      entityId    \n    }\n  }\n}"

response = falcon.graphql(query=idp_query)
print(response)
Service class example (Operation ID syntax)
from falconpy import IdentityProtection

falcon = IdentityProtection(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

idp_query = "{\n  entities(first: 1)\n  {\n    nodes {\n      entityId    \n    }\n  }\n}"

response = falcon.api_preempt_proxy_post_graphql(query=idp_query)
print(response)
Uber class example
from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )
BODY = {
    "query": "{\n  entities(first: 1)\n  {\n    nodes {\n      entityId    \n    }\n  }\n}"
}

response = falcon.command("api_preempt_proxy_post_graphql", body=BODY)
print(response)

CrowdStrike Falcon

Clone this wiki locally