Spotlight Vulnerabilities

Using the Spotlight Vulnerabilities service collection

Table of Contents

Operation ID	Description
combinedQueryVulnerabilities PEP 8 query_vulnerabilities_combined	Search for Vulnerabilities in your environment by providing a FQL filter and paging details. Returns a set of Vulnerability entities which match the filter criteria.
getRemediationsV2 PEP 8 get_remediations_v2	Get details on remediation by providing one or more IDs.
getVulnerabilities PEP 8 get_vulnerabilities	Get details on vulnerabilities by providing one or more IDs.
queryVulnerabilities PEP 8 query_vulnerabilities	Search for Vulnerabilities in your environment by providing a FQL filter and paging details. Returns a set of Vulnerability IDs which match the filter criteria.

combinedQueryVulnerabilities

Search for Vulnerabilities in your environment by providing a FQL filter and paging details. Returns a set of Vulnerability entities which match the filter criteria.

PEP8 method name

query_vulnerabilities_combined

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
after			query	string	A pagination token used with the limit parameter to manage pagination of results. On your first request, don't provide an after token. On subsequent requests, provide the after token from the previous response to continue from that place in the results. To access more than 10k indicators, use the after parameter instead of offset.
facet			query	string	Select various detail blocks to be returned for each vulnerability. Supported values: host_info remediation cve
filter			query	string	FQL Syntax formatted filter that should be used to limit the results. Wildcards * are unsupported. You must provide a filter, either via this keyword or as part of a parameters payload in order to use this method.
limit			query	integer	Maximum number of results to return. (Max: 400, Default: 100)
parameters			query	string	Full query string parameters payload in JSON format.
sort			query	string	FQL Syntax formatted sort filter. Common sort options include: created_timestamp|desc closed_timestamp|asc

Usage

You must provide a value for filter to make use of this operation, either by using the filter keyword or as part of your parameters payload.

Service class example (PEP8 syntax)

from falconpy import SpotlightVulnerabilities

falcon = SpotlightVulnerabilities(client_id="API_CLIENT_ID_HERE",
                                  client_secret="API_CLIENT_SECRET_HERE"
                                  )

response = falcon.query_vulnerabilities_combined(filter="string",
                                                 facet="string",
                                                 limit=integer,
                                                 sort="string",
                                                 after="string"
                                                 )
print(response)

Service class example (Operation ID syntax)

from falconpy import SpotlightVulnerabilities

falcon = SpotlightVulnerabilities(client_id="API_CLIENT_ID_HERE",
                                  client_secret="API_CLIENT_SECRET_HERE"
                                  )

response = falcon.combinedQueryVulnerabilities(filter="string",
                                               facet="string",
                                               limit=integer,
                                               sort="string",
                                               after="string"
                                               )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

response = falcon.command("combinedQueryVulnerabilities",
                          filter="string",
                          facet="string",
                          limit=integer,
                          sort="string",
                          after="string"
                          )
print(response)

getRemediationsV2

Get details on remediation by providing one or more IDs

PEP8 method name

get_remediations_v2

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
ids			query	string or list of strings	One or more remediation IDs.
parameters			query	string	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SpotlightVulnerabilities

falcon = SpotlightVulnerabilities(client_id="API_CLIENT_ID_HERE",
                                  client_secret="API_CLIENT_SECRET_HERE"
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_remediations_v2(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy import SpotlightVulnerabilities

falcon = SpotlightVulnerabilities(client_id="API_CLIENT_ID_HERE",
                                  client_secret="API_CLIENT_SECRET_HERE"
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getRemediationsV2(ids=id_list)
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getRemediationsV2", ids=id_list)
print(response)

getVulnerabilities

Get details on vulnerabilities by providing one or more IDs

PEP8 method name

get_vulnerabilities

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
ids			query	string or list of strings	One or more vulnerability IDs (max: 400). Find vulnerability IDs with queryVulnerabilities.
parameters			query	string	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SpotlightVulnerabilities

falcon = SpotlightVulnerabilities(client_id="API_CLIENT_ID_HERE",
                                  client_secret="API_CLIENT_SECRET_HERE"
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_vulnerabilities(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy import SpotlightVulnerabilities

falcon = SpotlightVulnerabilities(client_id="API_CLIENT_ID_HERE",
                                  client_secret="API_CLIENT_SECRET_HERE"
                                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getVulnerabilities(ids=id_list)
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getVulnerabilities", ids=id_list)
print(response)

queryVulnerabilities

Search for Vulnerabilities in your environment by providing a FQL filter and paging details. Returns a set of Vulnerability IDs which match the filter criteria

PEP8 method name

query_vulnerabilities

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
after			query	string	A pagination token used with the limit parameter to manage pagination of results. On your first request, don't provide an after token. On subsequent requests, provide the after token from the previous response to continue from that place in the results.
limit			query	integer	The number of items to return in this response (default: 100, max: 400). Use with the after parameter to manage pagination of results.
parameters			query	string	Full query string parameters payload in JSON format.
sort			query	string	Sort vulnerabilities by their properties. Common sort options include: created_timestamp|desc closed_timestamp|asc
filter			query	string	Filter items using a query in Falcon Query Language (FQL). Wildcards * are unsupported. Common filter options include: created_timestamp:>'2019-11-25T22:36:12Z' closed_timestamp:>'2019-11-25T22:36:12Z' aid:'8e7656b27d8c49a34a1af416424d6231' You must provide a filter, either via this keyword or as part of a parameters payload in order to use this method.

Usage

You must provide a value for filter to make use of this operation, either by using the filter keyword or as part of your parameters payload.

Service class example (PEP8 syntax)

from falconpy import SpotlightVulnerabilities

falcon = SpotlightVulnerabilities(client_id="API_CLIENT_ID_HERE",
                                  client_secret="API_CLIENT_SECRET_HERE"
                                  )

response = falcon.query_vulnerabilities(after="string",
                                        limit=integer,
                                        sort="string",
                                        filter="string"
                                        )
print(response)

Service class example (Operation ID syntax)

from falconpy import SpotlightVulnerabilities

falcon = SpotlightVulnerabilities(client_id="API_CLIENT_ID_HERE",
                                  client_secret="API_CLIENT_SECRET_HERE"
                                  )

response = falcon.queryVulnerabilities(after="string",
                                       limit=integer,
                                       sort="string",
                                       filter="string"
                                       )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "after": "string",
    "limit": integer,
    "sort": "string",
    "filter": "string"
}

response = falcon.command("queryVulnerabilities",
                          after="string",
                          limit=integer,
                          sort="string",
                          filter="string"
                          )
print(response)