-
Notifications
You must be signed in to change notification settings - Fork 130
User Management
API Function | Description |
---|---|
GetRoles | Get info about a role |
GrantUserRoleIds | Assign one or more roles to a user |
RevokeUserRoleIds | Revoke one or more roles from a user |
GetAvailableRoleIds | Show role IDs for all roles available in your customer account. For more information on each role, provide the role ID to /customer/entities/roles/v1 . |
GetUserRoleIds | Show role IDs of roles assigned to a user. For more information on each role, provide the role ID to /customer/entities/roles/v1 . |
RetrieveUser | Get info about a user |
CreateUser | Create a new user. After creating a user, assign one or more roles with POST /user-roles/entities/user-roles/v1 |
DeleteUser | Delete a user permanently |
UpdateUser | Modify an existing user's first or last name |
RetrieveEmailsByCID | List the usernames (usually an email address) for all users in your customer account |
RetrieveUserUUIDsByCID | List user IDs for all users in your customer account. For more information on each user, provide the user ID to /users/entities/user/v1 . |
RetrieveUserUUID | Get a user's ID by providing a username (usually an email address) |
Get info about a role
- Consumes: application/json
- Produces: application/json
Required | Name | Type | Datatype | Description |
---|---|---|---|---|
✅ | ids | query | array (string) | ID of a role. Find a role ID from /customer/queries/roles/v1 or /users/queries/roles/v1 . |
from falconpy import user_management as FalconUsers
falcon = FalconUsers.User_Management(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
})
IDS = 'ID1,ID2,ID3'
response = falcon.GetRoles(ids=IDS)
print(response)
from falconpy import api_complete as FalconSDK
falcon = FalconSDK.APIHarness(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
}
)
IDS = 'ID1,ID2,ID3'
response = falcon.command('GetRoles', ids=IDS)
print(response)
falcon.deauthenticate()
Assign one or more roles to a user
- Consumes: application/json
- Produces: application/json
Required | Name | Type | Datatype | Description |
---|---|---|---|---|
✅ | user_uuid | query | string | ID of a user. Find a user's ID from /users/entities/user/v1 . |
✅ | body | body | string | Role ID(s) of the role you want to assign |
from falconpy import user_management as FalconUsers
falcon = FalconUsers.User_Management(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
})
PARAMS = {
'user_uuid': 'string'
}
BODY = {
'Body Payload': 'See body description above'
}
response = falcon.GrantUserRoleIds(parameters=PARAMS, body=BODY)
print(response)
from falconpy import api_complete as FalconSDK
falcon = FalconSDK.APIHarness(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
}
)
PARAMS = {
'user_uuid': 'string'
}
BODY = {
'Body Payload': 'See body description above'
}
response = falcon.command('GrantUserRoleIds', parameters=PARAMS, body=BODY)
print(response)
falcon.deauthenticate()
Revoke one or more roles from a user
- Consumes: application/json
- Produces: application/json
Required | Name | Type | Datatype | Description |
---|---|---|---|---|
✅ | user_uuid | query | string | ID of a user. Find a user's ID from /users/entities/user/v1 . |
✅ | ids | query | array (string) | One or more role IDs to revoke. Find a role's ID from /users/queries/roles/v1 . |
from falconpy import user_management as FalconUsers
falcon = FalconUsers.User_Management(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
})
PARAMS = {
'user_uuid': 'string'
}
IDS = 'ID1,ID2,ID3'
response = falcon.RevokeUserRoleIds(parameters=PARAMS, ids=IDS)
print(response)
from falconpy import api_complete as FalconSDK
falcon = FalconSDK.APIHarness(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
}
)
PARAMS = {
'user_uuid': 'string'
}
IDS = 'ID1,ID2,ID3'
response = falcon.command('RevokeUserRoleIds', parameters=PARAMS, ids=IDS)
print(response)
falcon.deauthenticate()
Show role IDs for all roles available in your customer account. For more information on each role, provide the role ID to /customer/entities/roles/v1
.
- Consumes: application/json
- Produces: application/json
No parameters
from falconpy import user_management as FalconUsers
falcon = FalconUsers.User_Management(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
})
response = falcon.GetAvailableRoleIds()
print(response)
from falconpy import api_complete as FalconSDK
falcon = FalconSDK.APIHarness(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
}
)
response = falcon.command('GetAvailableRoleIds')
print(response)
falcon.deauthenticate()
Show role IDs of roles assigned to a user. For more information on each role, provide the role ID to /customer/entities/roles/v1
.
- Consumes: application/json
- Produces: application/json
Required | Name | Type | Datatype | Description |
---|---|---|---|---|
✅ | user_uuid | query | string | ID of a user. Find a user's ID from /users/entities/user/v1 . |
from falconpy import user_management as FalconUsers
falcon = FalconUsers.User_Management(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
})
PARAMS = {
'user_uuid': 'string'
}
response = falcon.GetUserRoleIds(parameters=PARAMS)
print(response)
from falconpy import api_complete as FalconSDK
falcon = FalconSDK.APIHarness(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
}
)
PARAMS = {
'user_uuid': 'string'
}
response = falcon.command('GetUserRoleIds', parameters=PARAMS)
print(response)
falcon.deauthenticate()
Get info about a user
- Consumes: application/json
- Produces: application/json
Required | Name | Type | Datatype | Description |
---|---|---|---|---|
✅ | ids | query | array (string) | ID of a user. Find a user's ID from /users/entities/user/v1 . |
from falconpy import user_management as FalconUsers
falcon = FalconUsers.User_Management(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
})
IDS = 'ID1,ID2,ID3'
response = falcon.RetrieveUser(ids=IDS)
print(response)
from falconpy import api_complete as FalconSDK
falcon = FalconSDK.APIHarness(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
}
)
IDS = 'ID1,ID2,ID3'
response = falcon.command('RetrieveUser', ids=IDS)
print(response)
falcon.deauthenticate()
Create a new user. After creating a user, assign one or more roles with POST /user-roles/entities/user-roles/v1
- Consumes: application/json
- Produces: application/json
Required | Name | Type | Datatype | Description |
---|---|---|---|---|
✅ | body | body | string | Attributes for this user. uid (required) is the user's email address, which is their username in Falcon. Optional attributes:
password . If single sign-on is enabled for your customer account, the password attribute is ignored. If single sign-on is not enabled, we send a user activation request to their email address when you create the user with no password . The user should use the activation email to set their own password. |
from falconpy import user_management as FalconUsers
falcon = FalconUsers.User_Management(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
})
BODY = {
'Body Payload': 'See body description above'
}
response = falcon.CreateUser(body=BODY)
print(response)
from falconpy import api_complete as FalconSDK
falcon = FalconSDK.APIHarness(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
}
)
BODY = {
'Body Payload': 'See body description above'
}
response = falcon.command('CreateUser', body=BODY)
print(response)
falcon.deauthenticate()
Delete a user permanently
- Consumes: application/json
- Produces: application/json
Required | Name | Type | Datatype | Description |
---|---|---|---|---|
✅ | user_uuid | query | string | ID of a user. Find a user's ID from /users/entities/user/v1 . |
from falconpy import user_management as FalconUsers
falcon = FalconUsers.User_Management(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
})
PARAMS = {
'user_uuid': 'string'
}
response = falcon.DeleteUser(parameters=PARAMS)
print(response)
from falconpy import api_complete as FalconSDK
falcon = FalconSDK.APIHarness(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
}
)
PARAMS = {
'user_uuid': 'string'
}
response = falcon.command('DeleteUser', parameters=PARAMS)
print(response)
falcon.deauthenticate()
Modify an existing user's first or last name
- Consumes: application/json
- Produces: application/json
Required | Name | Type | Datatype | Description |
---|---|---|---|---|
✅ | user_uuid | query | string | ID of a user. Find a user's ID from /users/entities/user/v1 . |
✅ | body | body | string | Attributes for this user. All attributes (shown below) are optional. |
from falconpy import user_management as FalconUsers
falcon = FalconUsers.User_Management(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
})
PARAMS = {
'user_uuid': 'string'
}
BODY = {
'Body Payload': 'See body description above'
}
response = falcon.UpdateUser(parameters=PARAMS, body=BODY)
print(response)
from falconpy import api_complete as FalconSDK
falcon = FalconSDK.APIHarness(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
}
)
PARAMS = {
'user_uuid': 'string'
}
BODY = {
'Body Payload': 'See body description above'
}
response = falcon.command('UpdateUser', parameters=PARAMS, body=BODY)
print(response)
falcon.deauthenticate()
List the usernames (usually an email address) for all users in your customer account
- Consumes: application/json
- Produces: application/json
No parameters
from falconpy import user_management as FalconUsers
falcon = FalconUsers.User_Management(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
})
response = falcon.RetrieveEmailsByCID()
print(response)
from falconpy import api_complete as FalconSDK
falcon = FalconSDK.APIHarness(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
}
)
response = falcon.command('RetrieveEmailsByCID')
print(response)
falcon.deauthenticate()
List user IDs for all users in your customer account. For more information on each user, provide the user ID to /users/entities/user/v1
.
- Consumes: application/json
- Produces: application/json
No parameters
from falconpy import user_management as FalconUsers
falcon = FalconUsers.User_Management(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
})
response = falcon.RetrieveUserUUIDsByCID()
print(response)
from falconpy import api_complete as FalconSDK
falcon = FalconSDK.APIHarness(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
}
)
response = falcon.command('RetrieveUserUUIDsByCID')
print(response)
falcon.deauthenticate()
Get a user's ID by providing a username (usually an email address)
- Consumes: application/json
- Produces: application/json
Required | Name | Type | Datatype | Description |
---|---|---|---|---|
✅ | uid | query | array (string) | A username. This is usually the user's email address, but may vary based on your configuration. |
from falconpy import user_management as FalconUsers
falcon = FalconUsers.User_Management(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
})
PARAMS = {
'uid': [
'string',
'string'
]
}
response = falcon.RetrieveUserUUID(parameters=PARAMS)
print(response)
from falconpy import api_complete as FalconSDK
falcon = FalconSDK.APIHarness(creds={
'client_id': falcon_client_id,
'client_secret': falcon_client_secret
}
)
PARAMS = {
'uid': [
'string',
'string'
]
}
response = falcon.command('RetrieveUserUUID', parameters=PARAMS)
print(response)
falcon.deauthenticate()
- Home
- Discussions Board
- Glossary of Terms
- Installation, Upgrades and Removal
- Samples Collection
- Using FalconPy
- API Operations
-
Service Collections
- Alerts
- API Integrations
- ASPM
- CAO Hunting
- Certificate Based Exclusions
- Cloud AWS Registration
- Cloud Azure Registration
- Cloud OCI Registration
- Cloud Connect AWS (deprecated)
- Cloud Security Assets
- Cloud Snapshots
- Configuration Assessment
- Configuration Assessment Evaluation Logic
- Container Alerts
- Container Detections
- Container Image Compliance
- Container Images
- Container Packages
- Container Vulnerabilities
- Content Update Policies
- Correlation Rules
- CSPM Registration
- Custom IOAs
- Custom Storage
- D4C Registration (deprecated)
- DataScanner (deprecated)
- Delivery Settings
- Deployments
- Detects
- Device Content
- Device Control Policies
- Discover
- Downloads
- Drift Indicators
- Event Streams
- Exposure Management
- FaaS Execution
- Falcon Complete Dashboard
- Falcon Container
- Falcon Intelligence Sandbox
- FDR
- FileVantage
- Firewall Management
- Firewall Policies
- Foundry LogScale
- Host Group
- Host Migration
- Hosts
- Identity Protection
- Image Assessment Policies
- Incidents
- Installation Tokens
- Intel
- Intelligence Feeds
- Intelligence Indicator Graph
- IOA Exclusions
- IOC
- IOCs (deprecated)
- Kubernetes Protection
- MalQuery
- Message Center
- ML Exclusions
- Mobile Enrollment
- MSSP (Flight Control)
- NGSIEM
- OAuth2
- ODS (On Demand Scan)
- Overwatch Dashboard
- Prevention Policy
- Quarantine
- Quick Scan
- Quick Scan Pro
- Real Time Response
- Real Time Response Admin
- Real Time Response Audit
- Recon
- Report Executions
- Response Policies
- Sample Uploads
- Scheduled Reports
- Sensor Download
- Sensor Update Policy
- Sensor Usage
- Sensor Visibility Exclusions
- Serverless Vulnerabilities
- Spotlight Evaluation Logic
- Spotlight Vulnerabilities
- Tailored Intelligence
- ThreatGraph
- Unidentified Containers
- User Management
- Workflows
- Zero Trust Assessment
- Documentation Support
-
CrowdStrike SDKs
- Crimson Falcon - Ruby
- FalconPy - Python 3
- FalconJS - Javascript
- goFalcon - Go
- PSFalcon - Powershell
- Rusty Falcon - Rust