Skip to content

Kubernetes Protection

Jump to bottom
Joshua Hiller edited this page Aug 30, 2021 · 23 revisions

CrowdStrike Falcon Twitter URL

Using the Kubernetes Protection service collection

Uber class support Service class support

Table of Contents

Operation ID Description
GetAWSAccountsMixin0
PEP8 get_aws_accounts
Provides a list of AWS accounts.
CreateAWSAccount
PEP8 create_aws_account
Creates a new AWS account in our system for a customer and generates the installation script
DeleteAWSAccountsMixin0
PEP8 delete_aws_accounts
Delete AWS accounts.
UpdateAWSAccount
PEP8 update_aws_account
Updates the AWS account per the query parameters provided
GetLocations
PEP8 get_locations
Provides the cloud locations acknowledged by the Kubernetes Protection service
GetHelmValuesYaml
PEP8 get_helm_values_yaml
Provides a sample Helm values.yaml file for a customer to install alongside the agent Helm chart
RegenerateAPIKey
PEP8 regenerate
Regenerate API key for docker registry integrations
GetClusters
PEP8 get_clusters
Provides the clusters acknowledged by the Kubernetes Protection service
TriggerScan
PEP8 trigger_scan
Triggers a dry run or a full scan of a customer's kubernetes footprint

GetAWSAccountsMixin0

Provides a list of AWS accounts.

PEP8 method name

get_aws_accounts

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
ids query array (string) AWS Account IDs
status query string Filter by account status
limit query integer Limit returned accounts
offset query integer Offset returned accounts

Usage

Service class example (PEP8 syntax)
from falconpy.kubernetes_protection import KubernetesProtection

falcon = KubernetesProtection(client_id="API_CLIENT_ID_HERE",
                              client_secret="API_CLIENT_SECRET_HERE"
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_aws_accounts(status="string",
                                   limit=integer,
                                   offset=integer,
                                   ids=id_list
                                   )
print(response)
Service class example (Operation ID syntax)
from falconpy.kubernetes_protection import KubernetesProtection

falcon = KubernetesProtection(client_id="API_CLIENT_ID_HERE",
                              client_secret="API_CLIENT_SECRET_HERE"
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetAWSAccountsMixin0(status="string",
                                       limit=integer,
                                       offset=integer,
                                       ids=id_list
                                       )
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "status": "string",
    "limit": integer,
    "offset": integer
}

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetAWSAccountsMixin0", parameters=PARAMS, ids=id_list)
print(response)

CreateAWSAccount

Creates a new AWS account in our system for a customer and generates the installation script

PEP8 method name

create_aws_account

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
✅ body body string

Usage

Service class example (PEP8 syntax)
from falconpy.kubernetes_protection import KubernetesProtection

falcon = KubernetesProtection(client_id="API_CLIENT_ID_HERE",
                              client_secret="API_CLIENT_SECRET_HERE"
                              )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.create_aws_account(body=BODY)
print(response)
Service class example (Operation ID syntax)
from falconpy.kubernetes_protection import KubernetesProtection

falcon = KubernetesProtection(client_id="API_CLIENT_ID_HERE",
                              client_secret="API_CLIENT_SECRET_HERE"
                              )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.CreateAWSAccount(body=BODY)
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.command("CreateAWSAccount", body=BODY)
print(response)

DeleteAWSAccountsMixin0

Delete AWS accounts.

PEP8 method name

delete_aws_accounts

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
✅ ids query array (string) AWS Account IDs

Usage

Service class example (PEP8 syntax)
from falconpy.kubernetes_protection import KubernetesProtection

falcon = KubernetesProtection(client_id="API_CLIENT_ID_HERE",
                              client_secret="API_CLIENT_SECRET_HERE"
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_aws_accounts(ids=id_list)
print(response)
Service class example (Operation ID syntax)
from falconpy.kubernetes_protection import KubernetesProtection

falcon = KubernetesProtection(client_id="API_CLIENT_ID_HERE",
                              client_secret="API_CLIENT_SECRET_HERE"
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteAWSAccountsMixin0(ids=id_list)
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteAWSAccountsMixin0", ids=id_list)
print(response)

UpdateAWSAccount

Updates the AWS account per the query parameters provided

PEP8 method name

update_aws_account

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
✅ ids query array (string) AWS Account ID
region query string Default Region for Account Automation

Usage

Service class example (PEP8 syntax)
from falconpy.kubernetes_protection import KubernetesProtection

falcon = KubernetesProtection(client_id="API_CLIENT_ID_HERE",
                              client_secret="API_CLIENT_SECRET_HERE"
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.update_aws_account(region="string", ids=id_list)
print(response)
Service class example (Operation ID syntax)
from falconpy.kubernetes_protection import KubernetesProtection

falcon = KubernetesProtection(client_id="API_CLIENT_ID_HERE",
                              client_secret="API_CLIENT_SECRET_HERE"
                              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.UpdateAWSAccount(region="string", ids=id_list)
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "region": "string"
}

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("UpdateAWSAccount", parameters=PARAMS, ids=id_list)
print(response)

GetLocations

Provides the cloud locations acknowledged by the Kubernetes Protection service

PEP8 method name

get_locations

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
clouds query array (string) Cloud Provider

Usage

Service class example (PEP8 syntax)
from falconpy.kubernetes_protection import KubernetesProtection

falcon = KubernetesProtection(client_id="API_CLIENT_ID_HERE",
                              client_secret="API_CLIENT_SECRET_HERE"
                              )

response = falcon.get_locations(clouds=["string", "string"])
print(response)
Service class example (Operation ID syntax)
from falconpy.kubernetes_protection import KubernetesProtection

falcon = KubernetesProtection(client_id="API_CLIENT_ID_HERE",
                              client_secret="API_CLIENT_SECRET_HERE"
                              )

response = falcon.GetLocations(clouds=["string", "string"])
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "clouds": [
       "string",
       "string"
    ]
}

response = falcon.command("GetLocations", parameters=PARAMS)
print(response)

GetHelmValuesYaml

Provides a sample Helm values.yaml file for a customer to install alongside the agent Helm chart

PEP8 method name

get_helm_values_yaml

Content-Type

  • Consumes: application/json
  • Produces: application/yaml

Parameters

Required Name Type Datatype Description
✅ cluster_name query string Cluster name. For EKS it will be cluster ARN.

Usage

Service class example (PEP8 syntax)
from falconpy.kubernetes_protection import KubernetesProtection

falcon = KubernetesProtection(client_id="API_CLIENT_ID_HERE",
                              client_secret="API_CLIENT_SECRET_HERE"
                              )

response = falcon.get_helm_values_yaml(cluster_name="string")
print(response)
Service class example (Operation ID syntax)
from falconpy.kubernetes_protection import KubernetesProtection

falcon = KubernetesProtection(client_id="API_CLIENT_ID_HERE",
                              client_secret="API_CLIENT_SECRET_HERE"
                              )

response = falcon.GetHelmValuesYaml(cluster_name="string")
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "cluster_name": "string"
}

response = falcon.command("GetHelmValuesYaml", parameters=PARAMS)
print(response)

RegenerateAPIKey

Regenerate API key for docker registry integrations

PEP8 method name

regenerate

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

No parameters

Usage

Service class example (PEP8 syntax)
from falconpy.kubernetes_protection import KubernetesProtection

falcon = KubernetesProtection(client_id="API_CLIENT_ID_HERE",
                              client_secret="API_CLIENT_SECRET_HERE"
                              )

response = falcon.regenerate()
print(response)
Service class example (Operation ID syntax)
from falconpy.kubernetes_protection import KubernetesProtection

falcon = KubernetesProtection(client_id="API_CLIENT_ID_HERE",
                              client_secret="API_CLIENT_SECRET_HERE"
                              )

response = falcon.RegenerateAPIKey()
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

response = falcon.command("RegenerateAPIKey")
print(response)

GetClusters

Provides the clusters acknowledged by the Kubernetes Protection service

PEP8 method name

get_clusters

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
cluster_names query array (string) Cluster name. For EKS it will be cluster ARN.
account_ids query array (string) Cluster Account id. For EKS it will be AWS account ID.
locations query array (string) Cloud location
cluster_service query string Cluster Service
limit query integer Limit returned accounts
offset query integer Offset returned accounts

Usage

Service class example (PEP8 syntax)
from falconpy.kubernetes_protection import KubernetesProtection

falcon = KubernetesProtection(client_id="API_CLIENT_ID_HERE",
                              client_secret="API_CLIENT_SECRET_HERE"
                              )

response = falcon.get_clusters(cluster_names=["string", "string"],
                               account_ids=["string", "string"],
                               locations=["string", "string"],
                               cluster_service="string",
                               limit=integer,
                               offset=integer
                               )
print(response)
Service class example (Operation ID syntax)
from falconpy.kubernetes_protection import KubernetesProtection

falcon = KubernetesProtection(client_id="API_CLIENT_ID_HERE",
                              client_secret="API_CLIENT_SECRET_HERE"
                              )

response = falcon.GetClusters(cluster_names=["string", "string"],
                              account_ids=["string", "string"],
                              locations=["string", "string"],
                              cluster_service="string",
                              limit=integer,
                              offset=integer
                              )
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "cluster_names": [
       "string",
       "string"
    ],
    "account_ids": [
       "string",
       "string"
    ],
    "locations": [
       "string",
       "string"
    ],
    "cluster_service": "string",
    "limit": integer,
    "offset": integer
}

response = falcon.command("GetClusters", parameters=PARAMS)
print(response)

TriggerScan

Triggers a dry run or a full scan of a customer's kubernetes footprint

PEP8 method name

trigger_scan

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
✅ scan_type query string Scan Type to do

Usage

Service class example (PEP8 syntax)
from falconpy.kubernetes_protection import KubernetesProtection

falcon = KubernetesProtection(client_id="API_CLIENT_ID_HERE",
                              client_secret="API_CLIENT_SECRET_HERE"
                              )

response = falcon.trigger_scan(scan_type="string")
print(response)
Service class example (Operation ID syntax)
from falconpy.kubernetes_protection import KubernetesProtection

falcon = KubernetesProtection(client_id="API_CLIENT_ID_HERE",
                              client_secret="API_CLIENT_SECRET_HERE"
                              )

response = falcon.TriggerScan(scan_type="string")
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "scan_type": "string"
}

response = falcon.command("TriggerScan", parameters=PARAMS)
print(response)

CrowdStrike Falcon

Clone this wiki locally